Classified Cyber Security Senior Manager

Classified Cyber Security Senior Manager

When to Use

• Govern classified or high-side cyber programs — scope, milestones, RACI, and interfaces to security, IT, and mission owners
• Align cleared workforce and facility posture with cyber requirements — access eligibility themes, visit coordination, high-level continuous evaluation interfaces (not adjudication)
• Coordinate program security plans and system security plans at manager depth — boundaries, inherited controls, plan of action themes, reauthorization cadence
• Interface with authorization officials, ISSOs, and assessors — package status, significant changes, risk acceptance themes (delegate SSP/POA&M maintenance to information-systems-security-officer-classified-specialist)
• Coordinate insider risk with HR, security, and legal — policy alignment, case routing, need-to-know and privileged access themes
• Oversee classified network operations interfaces — change windows, maintenance, cross-domain policy themes, operations center escalation paths
• Escalate incidents to government stakeholders — classification of facts, clock management interfaces, coordinated comms with legal and contracts
• Prepare for audits, inspections, and continuous monitoring — evidence themes, corrective action plans, recurring findings
• Manage classified IT supply chain — approved products, configuration baselines, vendor and subcontractor cyber flow-down
• Brief senior leadership and authorizing officials — posture narrative, top risks, decisions, and resource asks

When NOT to Use

• Triage and close routine SOC alerts → soc-analyst
• Run CSIRT containment, forensics collection, or technical IR playbooks → incident-responder
• Board-level enterprise security strategy, risk appetite, and cyber insurance → chief-information-security-officer
• Deploy controls, SIEM rules, IAM, or remediate findings → information-security-engineer
• Commercial-only cloud compliance mapping and audit packs → cloud-compliance-specialist
• Enterprise reference architecture, zero-trust patterns, ARB standards → enterprise-security-architect
• Build risk registers, FAIR models, or treatment scoring → security-risk-analyst
• GRC program scope, framework mapping, commercial audit prep → compliance-specialist
• SSP maintenance, control status, assessor coordination, POA&M ownership → information-systems-security-officer-classified-specialist
• M&A or investment diligence cyber packs → cyber-diligence-governance
• Legal classification, export, or jurisdiction decisions → route legal/compliance; do not decide in this skill
• CISSP study or certification exam prep → certified-information-systems-security-professional

Related skills

Core Workflows

1. Scope and program boundary

Clarify authority, classified enclave boundaries, and handoffs to engineering, GRC, IR, and mission owners.

See `references/classified_cyber_senior_manager_scope.md`.

2. Cleared program and personnel security interfaces

Workforce eligibility themes, facility alignment, visit coordination, and personnel security case routing.

See `references/cleared_program_and_personnel_security.md`.

3. Accreditation and authorization interfaces

RMF/ATO-style lifecycle at manager depth — boundaries, inherited controls, significant changes, reauthorization.

See `references/accreditation_and_authorization_interfaces.md`.

4. Classified operations and incident escalation

Operations interfaces, maintenance governance, cross-domain themes, and government stakeholder escalation.

See `references/classified_operations_and_incident_escalation.md`.

5. Audit, inspection, and continuous monitoring

Inspection readiness, POA&M themes, recurring findings, and continuous monitoring interfaces.

See `references/audit_inspection_and_continuous_monitoring.md`.

6. Stakeholder briefings and governance

Authorizing official briefings, leadership dashboards, committee cadence, and decision records.

See `references/stakeholder_briefings_and_governance.md`.

Outputs

• Program governance charter — scope, RACI, committees, escalation paths
• Authorization status brief — boundary, milestones, open risks, significant changes pending
• Inspection readiness pack — evidence themes, gaps, POA&M summary, owners and dates
• Incident escalation brief — facts (classified handling per policy), clocks, government interfaces, decisions needed
• Classified supply chain memo — approved products, vendor flow-down, open supply-chain risks
• Leadership briefing — posture, top 5 risks, resource asks, decisions for authorizing officials

Principles

• Manager lens — set direction, interfaces, and accountability; delegate technical execution
• Boundary discipline — enclave scope, data flows, and inherited controls explicit in every narrative
• Government alignment — early engagement on incidents, changes, and inspection themes
• Need-to-know in artifacts — minimum necessary detail; route legal/classification questions out of band
• Evidence over assertion — tie briefings to authorization status, monitoring, and POA&M facts
• Complement, not duplicate — pair with CISO for enterprise strategy; with IR for technical response

When to load references

• Role boundary and handoffs → references/classified_cyber_senior_manager_scope.md
• Cleared workforce and personnel security → references/cleared_program_and_personnel_security.md
• Accreditation and authorization → references/accreditation_and_authorization_interfaces.md
• Operations and incident escalation → references/classified_operations_and_incident_escalation.md
• Audit and continuous monitoring → references/audit_inspection_and_continuous_monitoring.md
• Briefings and governance → references/stakeholder_briefings_and_governance.md

Accreditation and authorization interfaces

Table of contents

1. Manager-level RMF/ATO lens 2. Authorization boundary 3. Lifecycle milestones 4. Inherited controls and dependencies 5. Significant change and continuous monitoring 6. Assessor and ISSO interfaces

Manager-level RMF/ATO lens

At senior manager depth, focus on:

• Authorization boundary — what is in vs out of the package
• Status — authorized, interim, denied, or in progress
• Top risks — POA&M themes, not every control ID
• Decisions — risk acceptance, resources, schedule

Defer control-by-control assessment to ISSOs, assessors, and engineers—summarize impact for leadership.

Authorization boundary

Document for each system or enclave:

Significant change candidates: new interconnection, major version, cloud shift, privileged path change, new data category.

Lifecycle milestones

Typical phases (labels vary by organization):

Track reauthorization date and interim authorization conditions explicitly in status reports.

Inherited controls and dependencies

For each dependency: owner, last assessment date, open POA&M count, and escalation path.

Significant change and continuous monitoring

Significant change board (concept):

1. Change description and mission impact 2. Security impact analysis summary (from ISSO/engineering) 3. Updated boundary or data flow if needed 4. Authorizing official notification if required 5. POA&M updates before production

Continuous monitoring themes: vulnerability scan cadence, configuration drift, privileged access review, contingency test dates.

Assessor and ISSO interfaces

Escalate conflicting assessor positions early—do not let findings accumulate without owner.

Audit, inspection, and continuous monitoring

Table of contents

1. Inspection types 2. Readiness framework 3. POA&M governance 4. Evidence themes 5. Recurring findings 6. Continuous monitoring interfaces

Inspection types

Distinguish findings (assessment) from observations (lower severity)—track both with owners.

Readiness framework

90-day inspection prep (example cadence):

Assign evidence stewards per control family; avoid heroics the week of visit.

POA&M governance

Report velocity (opened vs closed) and aged items over 180 days.

Evidence themes

Organize evidence by theme, not file dump:

• Access control (provisioning, review, termination samples)
• Audit logging (retention, review cadence)
• Configuration management (baseline, drift response)
• Contingency (test dates, results summary)
• Identification and authentication (MFA, privileged access)
• System and communications protection (boundary, encryption themes per policy)
• Supply chain (approved products, vendor attestations)

Use compliance-specialist for commercial framework mapping; keep classified evidence in approved repositories per policy.

Recurring findings

For repeat issues:

1. Root cause category (people, process, tool, funding) 2. Systemic fix vs local fix 3. Metric to prove sustained closure (e.g., % accounts recertified on time) 4. Executive sponsor if cross-organization

Escalate third recurrence to authorizing official briefing.

Continuous monitoring interfaces

Summarize monthly for leadership; tie spikes to POA&M and resource asks.

Classified cyber security senior manager scope

Table of contents

1. Role boundary 2. Program types 3. Questions this role answers 4. Handoffs

Role boundary

This role governs classified cyber programs and interfaces with authorizing officials; it does not operate consoles, write detection rules, or perform assessor-level control testing.

Program types

Typical environments (generic labels only):

Document: system name, classification level (per org policy), authorization status, and owning mission.

Questions this role answers

• What is in scope for this classified cyber program, and who owns each interface?
• Are we on track for authorization milestones, and what decisions do authorizing officials need?
• What must we tell government stakeholders after a suspected or confirmed incident?
• Are we inspection-ready, and what POA&M items block a clean assessment?
• Is cleared workforce and facility posture aligned with cyber access requirements?
• Is classified IT supply chain controlled (approved products, config baselines, vendor attestations)?

Handoffs

Classified operations and incident escalation

Table of contents

1. Operations interfaces 2. Change and maintenance governance 3. Cross-domain and data flow themes 4. Incident classification and escalation 5. Government stakeholder communication 6. Handoff to incident-responder

Operations interfaces

Maintain an operations calendar overlay: patches, cert renewals, DR tests, assessor visits.

Change and maintenance governance

Change categories (example):

Require: maintenance notice, backout, security control validation checklist (summary), and comms to mission.

Cross-domain and data flow themes

At manager depth—do not design technical guards here:

• Approved transfer mechanisms only (organization policy names only)
• No ad-hoc removable media without policy exception
• Remote administration paths documented in authorization package
• Wireless and mobile excluded unless explicitly authorized

Escalate policy exceptions with risk memo and authorizing official awareness.

Incident classification and escalation

Clocks: contract notification windows, government reporting interfaces, internal exec cadence—coordinate with legal and contracts; do not invent deadlines.

Government stakeholder communication

Prepare fact packs (minimum necessary):

• What happened (unclassified summary if allowed; otherwise per classification guide)
• Systems and data in scope (boundary reference)
• Current status: contained / investigating / recovered
• Preliminary root cause themes (not final until validated)
• Actions taken and next 24–72 hours
• Decisions needed from government (access, inspection deferral, additional resources)

Route wording through legal and contracts before external send.

Handoff to incident-responder

After stabilization, manager owns inspection and authorization impact (new POA&M, significant change, reauth timing).

Cleared program and personnel security interfaces

Table of contents

1. Purpose 2. Workforce eligibility themes 3. Facility and physical alignment 4. Access and visit coordination 5. Insider risk coordination 6. Interfaces and RACI

Purpose

Cyber senior managers align classified IT access with personnel security outcomes—they do not adjudicate clearances or conduct background investigations.

Workforce eligibility themes

Maintain a role-to-system matrix at summary level; detail lives with identity and personnel security teams.

Facility and physical alignment

Escalate physical-security gaps that imply cyber exposure (uncontrolled ports, unapproved wireless).

Access and visit coordination

Visit requests: confirm sponsor, dates, escort, and whether cyber access (accounts, VPN, lab) is in scope.

Remote access: dual control themes—MFA, managed device, session logging per policy; no consumer tools on classified paths.

Cross-program access: document data owner approval before granting cross-enclave read paths.

Insider risk coordination

Coordinate with insider-threat program, HR, legal, and security:

Do not run investigations alone—maintain need-to-know in briefings.

Interfaces and RACI

Stakeholder briefings and governance

Table of contents

1. Governance forums 2. Authorizing official briefing 3. Senior leadership narrative 4. Metrics and dashboards 5. Decision records 6. Complement to CISO

Governance forums

Document RACI for: risk acceptance, emergency change, external notification, and POA&M deferrals.

Authorizing official briefing

One-page structure:

1. Authorization status — system/enclave, date, interim conditions 2. Posture summary — green/amber/red themes with evidence pointer 3. Top risks (≤5) — mission impact; POA&M or risk acceptance status 4. Significant changes — in flight or recently deployed 5. Incidents — since last brief; government notifications complete/pending 6. Inspection — next event; readiness gaps 7. Decisions needed — resources, risk acceptance, schedule, scope

Attach appendix only when AO requests detail—default to minimum necessary classification.

Senior leadership narrative

Align with chief-information-security-officer when briefing enterprise execs:

Use plain language for non-cleared executives; separate classified annex per policy.

Metrics and dashboards

Avoid vanity metrics (ticket counts). Pair with security-risk-analyst for enterprise risk register linkage.

Decision records

Record for audit trail:

• Risk acceptance (owner, date, expiration, compensating controls summary)
• Significant change approval
• Emergency change authorization
• Government notification sent (reference number if applicable)
• Resource allocation shifts

Store in program repository per records management policy.

Complement to CISO

Use chief-information-security-officer for enterprise strategy, board cadence, and risk appetite.

Use classified-cyber-security-senior-manager for enclave authorization, cleared-program interfaces, government oversight, and classified supply chain.

Hand off technical execution to information-security-engineer and active IR to incident-responder in all cases.