Subject Matter Expert; SME – Authorizing Official​/Designating Representative | R

Description

This role is designed for experienced cybersecurity risk management practitioners to participate in a skills assessment pilot aligned to the Authorizing Official/Designating Representative (Work Role 611 / DD-WRL-006). The purpose of this engagement is assessment validation and standard-setting, not hiring, ranking, or performance evaluation.

The Contract SME will complete a structured assessment and a brief survey only. This role does not involve teaching, instructional design, content creation, consulting, facilitation, or advisory responsibilities.

• Complete a practitioner-level skills assessment
• Complete a short post-assessment survey
• No meetings, facilitation, reviews, or follow-up work

• Estimated assessment length: 297 items
• Estimated completion time:
  Approximately 1 hour
• Assessment window:
  Must be completed within a defined access period (typically 3 business days once access is granted)
• Once started, the assessment must be completed within 24 hours

• Participants must score above 50% on the assessment
• This threshold exists only to confirm practitioner-level participation
• Results are not used for hiring, ranking, or performance evaluation

• Active Authorizing Official, Designated Representative, or related cybersecurity risk management practitioner
• Hands-on experience with authorization and accreditation (A&A) processes
• Comfortable evaluating real-world risk management scenarios
• Familiar with federal/government cybersecurity frameworks (NIST RMF, FedRAMP, FISMA)
• Reliable and able to complete work within a short, defined window

• One completed skills assessment
• One completed post-assessment survey

• Flat-fee contract payment
• Paid upon successful completion of the assessment and survey

• Risk Management Framework (RMF) implementation and authorization processes
• NIST Special Publication 800-37 (Guide for Applying the Risk Management Framework)
• Security control assessment and continuous monitoring programs
• Authority to Operate (ATO) decision-making and risk acceptance processes
• FISMA compliance and federal information system security requirements
• Organizational risk tolerance assessment and risk-based decision making
• Security Authorization Boundary definition and system categorization
• Plan of Action and Milestones (POA&M) management and risk mitigation strategies
• Information system security documentation review and approval processes
• Cybersecurity frameworks integration (NIST CSF, FedRAMP, CMMC)