Attention: CISA Learning is now available! If you are an EXTERNAL (non-CISA) user access the new system using this url: CISA Learning. The Federal Virtual Training Environment (FedVTE) has been permanently decommissioned and replaced by CISA Learning. Please reference the CISA Learning page for the latest information. Please note: CISA Users (staff and contractors) should access CISA Learning through the internal site. You should have received an email on December 4, 2024, titled “CISA Learning is LIVE!” with more information.

OG-WRL-015

Technology Portfolio Management

Responsible for managing a portfolio of technology investments that align with the overall needs of mission and enterprise priorities.

Task statements

T0220: Resolve conflicts in laws, regulations, policies, standards, or procedures
T1020: Determine the operational and safety impacts of cybersecurity lapses
T1026: Determine procurement requirements
T1227: Manage cybersecurity budget, staffing, and contracting
T1306: Conduct technology program and project audits
T1369: Determine if acquisitions, procurement, and outsourcing efforts address cybersecurity requirements
T1394: Develop independent cybersecurity audit processes for application software, networks, and systems
T1395: Implement independent cybersecurity audit processes for application software, networks, and systems
T1396: Oversee independent cybersecurity audits
T1397: Determine if research and design processes and procedures are in compliance with cybersecurity requirements
T1398: Determine if research and design processes and procedures are accurately followed by cybersecurity staff when performing their day-to-day activities
T1399: Develop supply chain, system, network, and operational security contract language
T1472: Gather customer satisfaction and service performance feedback
T1498: Determine if cybersecurity requirements included in contracts are delivered
T1621: Prepare supply chain security reports
T1622: Prepare risk management reports

Knowledge statements

K0498: Knowledge of operational planning processes
K0674: Knowledge of computer networking protocols
K0675: Knowledge of risk management processes
K0676: Knowledge of cybersecurity laws and regulations
K0677: Knowledge of cybersecurity policies and procedures
K0678: Knowledge of privacy laws and regulations
K0679: Knowledge of privacy policies and procedures
K0680: Knowledge of cybersecurity principles and practices
K0681: Knowledge of privacy principles and practices
K0682: Knowledge of cybersecurity threats
K0683: Knowledge of cybersecurity vulnerabilities
K0684: Knowledge of cybersecurity threat characteristics
K0721: Knowledge of risk management principles and practices
K0734: Knowledge of Risk Management Framework (RMF) requirements
K0735: Knowledge of risk management models and frameworks
K0751: Knowledge of system threats
K0752: Knowledge of system vulnerabilities
K0754: Knowledge of resource management principles and practices
K0803: Knowledge of supply chain risk management principles and practices
K0820: Knowledge of supply chain risks
K0828: Knowledge of supply chain risk management standards and best practices
K0835: Knowledge of risk assessment principles and practices
K0836: Knowledge of threat assessment principles and practices
K0838: Knowledge of supply chain risk management policies and procedures
K0922: Knowledge of the acquisition life cycle models and frameworks
K0983: Knowledge of computer networking principles and practices
K1014: Knowledge of network security principles and practices
K1137: Knowledge of cybersecurity requirements
K1180: Knowledge of organizational cybersecurity goals and objectives
K1206: Knowledge of research and design processes and procedures

Skill statements

S0687: Skill in performing administrative planning activities
S0811: Skill in managing intelligence collection requirements

Source: Workforce Framework for Cybersecurity (NICE Framework) (NIST SP 800-181 Rev 1) (Version: 1.0.0)