Modular Task Areas

• Security Risk Management – Risk categorization, assessments, POA&M tracking, risk dashboards, and audit response execution for enterprise assets, including Filing Season Risk Readiness and Disaster Recovery environments. Enables management of interconnected risk views, upstream/downstream dependencies, and oversight of mission-critical systems. Includes annual oversight process planning, surge execution for emerging risk-related requirements, and alignment with new legislative and executive mandates. (NIST SP 800-30, 800-39, FISMA, EO 14028).
• Governance, Compliance, and Audit Execution – FISMA reporting, policy development, audit coordination, compliance (FISMA, OMB A-130).
• Continuous Monitoring (ISCM) – Ongoing control assessments, real-time dashboards, ISSO execution (NIST SP 800-137).
• Identity, Credential, and Access Management (ICAM) – PIV, MFA, ID proofing, IAL/AAL/FAL requirements (NIST SP 800-63-3).
• Incident Response and Recovery – IRP development, exercises, threat detection, forensic execution (NIST SP 800-61r2).
• Security Engineering and Orchestration – Zero Trust design, patching automation, secure SDLC (EO 14028, SP 800-160).
• Threat Intelligence and Analytics – Threat hunting, IOC analysis, automated reporting and dashboards.
• GRC Platform Integration and Risk Reporting – Workflow automation, GRC dashboards, integration of control libraries.
• Workforce Development and Strategic Planning – NICE framework alignment, workforce role mapping, planning artifacts.
• CDM Architecture and Sensor Integration – CDM implementation, data feed reliability, sensor integration.
• Security Program Planning – Strategic program planning, goal alignment, milestone tracking, and performance reporting (OMB A-11, A-130, NIST CSF)
• Risk Quantification and Analytics – Quantitative risk modeling, FAIR-based analysis, executive dashboards, and impact-driven prioritization (NIST SP 800-30, FAIR)
• High Value Asset (HVA) Protection – HVA identification, DHS reporting, threat modeling, protection planning, and risk register integration (DHS HVA Guidance, OMB M-19-03)
• Critical Infrastructure Protection – Identification of mission-critical systems, continuity planning, failover design, and operational resilience (PPD-21, NIST CSF)
• Security Data Aggregation & Analytics – Data correlation across CDM, SIEM, asset/vulnerability tools; dashboard development and risk insights (NIST SP 800-137, EO 14028)
• DevSecOps & CI/CD Supply Chain Security – Security testing in pipelines, code analysis, dependency scanning, and secure SDLC automation (NIST SP 800-218, EO 14028)
• Security Resilience & Chaos Engineering – Resilience validation via controlled disruption, detection testing, and recovery response simulation (NIST SP 800-160v2, EO 14028)
• Enterprise Identity and Systems Integration – ICAM lifecycle management, PIV Data Synchronization (PDS), LACS/MFA implementation, GSA MSO coordination, and Zero Trust identity governance (FIPS 201-3, NIST SP 800-63, CDM Phase II)
• Cyber Policy and Governance Management – Maintenance of TD P 85-01, SOP drafting, governance workflow facilitation, and alignment with evolving OMB, NIST, and EO 14028 policy requirements (NIST SP 800-53, OMB A-130, EO 14028)
• Communications Security (COMSEC) Execution – Cryptographic asset lifecycle management, keying material tracking, NSA/CNSS compliance, SOP development, and inspection readiness (CNSSI 4005, FIPS 140-3, CNSSP No. 1)
• Program Management Office Operations – Integrated schedule management, IPT facilitation, risk tracking, executive reporting, document control, and surge PM execution across all BPA Call Orders (PMBOK 7th Ed., GAO Agile Guide, FAR Part 37)
• AI Cybersecurity Enablement – AI/ML system risk assessments, secure DevSecOps pipeline integration, model access controls, bias and privacy evaluations, and AI governance policy development in alignment with NIST AI RMF, EO 14110, and OMB M-24-10.
• Transition Planning and Execution – Planning and execution of transition-in and transition-out activities, including knowledge transfer, onboarding/offboarding, GFP/system handoff, continuity of operations, and secure data archival, per FAR 42.1204 and DHS IT transition best practices.