U.S. flag
        An official website of the United States government
          Here’s how you know
        Here’s how you know**Official websites use .gov**
              
              A **.gov** website belongs to an official government organization in the United States.
        **Secure .gov websites use HTTPS**
              
              A **lock** (  A locked padlock
) or **https://** means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites. https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/nice-framework-focus-charles-britt
  Search NIST
    Search
              Menu

      


Close
    Topics
        All Topics
                                                        Advanced communications
                                                        Artificial intelligence
                                                        Bioscience
                                                        Buildings and construction
                                                        Chemistry
                                                        Climate
                                                        Cybersecurity
                                                        Electronics
                                                        EnergyEnvironment
                                                        Fire
                                                        Forensic science
                                                        Health
                                                        Information technology
                                                        Infrastructure
                                                        Manufacturing
                                                        Materials
                                                        Mathematics and statisticsMetrology
                                                        Nanotechnology
                                                        Neutron research
                                                        Performance excellence
                                                        Physics
                                                        Public safety
                                                        Resilience
                                                        Standards
                                                        Transportation
            Publications
            Labs & Major Programs
        Laboratories
                                Communications Technology Laboratory
                                  Engineering Laboratory
                                  Information Technology Laboratory
                                  Material Measurement Laboratory
                                  Physical Measurement LaboratoryUser Facilities
                                NIST Center for Neutron Research
                                  CNST NanoFab
                                                        Research Test Beds
                                                        Research Projects
                                                        Tools & InstrumentsMajor Programs
                                Baldrige Performance Excellence Program
                                  CHIPS for America Initiative
                                  Manufacturing Extension Partnership (MEP)
                                  Office of Advanced Manufacturing
                                  Special Programs Office
                                  Technology Partnerships Office
            Services & Resources
        Standards and Measurements
                                Calibration Services
                                  Laboratory Accreditation (NVLAP)
                                  Quality System
                                  Standard Reference Materials (SRMs)
                                  Standards.gov
                                  Time Services
                                  Office of Weights and MeasuresSoftware
                                                        Data
                                Chemistry WebBook
                                  National Vulnerability Database
                                  Physical Reference Data
                                  Standard Reference Data (SRD)
                                                        Storefront
                                                        License & PatentsComputer Security Resource Center (CSRC)
                                                        NIST Research Library
            News & Events
        News
                                                        Events
                                                        Blogs
                                                        Feature Stories
                                                        AwardsVideo Gallery
                                                        Image Gallery
                                                        Media Contacts
            About NIST
        About Us
                                Leadership
                                  Organization Structure
                                  Budget & Planning
                                                        Contact Us
                                                        Visit
                                                        Careers
                                Student programsWork with NIST
                                                        History
                                NIST Digital Archives
                                  NIST Museum
                                  NIST and the Nobel
                                                        Educational Resources
 
 Applied Cybersecurity Division /                  NICE
      NICE Framework Resource Center
    
      
  Getting Started
          Current Version
          Resources
                            Expand or Collapse
          Users Group
                      Employer Resources
                      Education and Training Provider Resources
                      Learner Resources
                      Success Stories
                                              Expand or Collapse
                Submission Guidance
                      Framework in Focus
                      Presentations
          Playbook for Workforce Frameworks
          About
                            Expand or Collapse
          History
                      FAQ
                                              Expand or Collapse
                K12 FAQ
                      Revision Process
                      Latest Updates
                      Ways to Engage
          NICE Homepage



  Connect with us
      
      GovDeliveryLinkedInTwitterNICE Framework in Focus: Charles Britt

Share
  Facebook
                      Linkedin
                      Twitter
                      Email

*This Framework in Focus interview was featured in the**Spring 2021 NICE eNewsletter**.*

Audio fileCharles Britt

**Title/Organization**: Information Systems Security Officer, U.S. Food and Drug Administration

**NICE Framework Category**: Oversee and Govern

**NICE Framework Work Roles**: Information Systems Security Manager

**Academic Degrees**: B.S., Information Systems, Capitol Technology University

**Certifications**: Certified Information Systems Security Professional (CISSP)

Charles Britt

**Karen Wetzel**: In this edition of the NICE eNewsletter series “Framework in Focus,” it is my pleasure to speak with Charles Britt, Information Systems Security Officer (ISSO) at the U.S. Food and Drug Administration (FDA). Charles, thank you for letting us learn more about your career pathway and understand the NICE Framework from the lens of someone like yourself who is performing cybersecurity work.

**Charles Britt**: Good afternoon and thank you for the invitation.

**Karen**: I wonder if you can start of by explaining about your role and responsibilities as an Information Systems Security Officer at the FDA?

**Charles**: I am one of about seven or eight ISSOs who are responsible for carrying out cybersecurity activities across different centers and offices across the FDA. In this role I am responsible for managing and coordinating the assessment of our security systems against NIST 800-53 standards as well as FDA policies and HHS guidelines. I also provide technical and policy guidance to centers and systems stakeholders, conduct technology evaluations, and support incident response.

**Karen**: It sounds like you have a lot on your plate! Can you describe a little about your team and the specific roles?

**Charles**: Each ISSO is responsible for our own center and our portfolios range from one or two systems up to a couple dozen systems within our area of responsibility. On our cybersecurity team as a whole we have approximately 80 individuals who support all aspects of our work. Those individuals consist of cybersecurity engineers, incident response analysts, forensics engineers, SOC analysts, or your watch officers who are watching our systems and the perimeters of our network. In addition are the corresponding senior leadership roles that manage and coordinate all these activities across the program.

**Karen**: Can you share about the career path you took to become an Information System Security Officer?

**Charles**: I came on board as an IT support specialist at the Central Intelligence Agency in 2003—a help desk guy running around installing software and troubleshooting for the office I supported, and we were working literally 12-16 hours a day. I was burnt out, so I moved to a systems administrator role. It was behind the scenes, working to maintain critical systems and infrastructure, and I soon missed working with people. That is when an opportunity arose for an ISSO in what was then the growing Information Security Group at the Agency. They were looking for individuals who wanted to dip their toes into the world of cybersecurity and I accepted the challenge. The key to making that transition was having both the technical background and good communications skills. I then moved two or three years ago to my position here at the FDA. It’s a great fit for me because it matches my desire to understand the technology and be impactful in cybersecurity while communicating to individuals within an organization.

**Karen**: That’s really fascinating. Soft skills—or professional skills—seem to have played a big role in where you are now and in what you want to do in your role. Is that fairly common in cybersecurity—the importance of those kinds of skills in addition to the more traditional cybersecurity ones?

**Charles**: It’s very important because technology is constantly changing and the people we’re supporting aren’t focused on cybersecurity. At the FDA, they’re focused 99% of the time on protecting the public health, so they don’t have time to keep up with everchanging cybersecurity trends and policy changes. There is a need for cybersecurity folks who not only understand the technology but also can explain to the business owner—who in my case might be a doctor, physicist, or chemist—how the policies and technology we’re implementing impact the security of their systems and data.

**Karen**: When it comes to skills, what do you do to keep yourself sharp and current?

**Charles**: The interesting thing about an ISSO role is that you have to know about everything. You’re constantly researching, going to training, and taking online courses, both internally as well as externally. Cyber criminals are keeping up with trends and in some cases making trends and, as a defender of our network and infrastructure, I, too, have to be well versed on those and translate how they affect the work we do every day.  It can be difficult to pause your activities for a one-week or three-day course and then come back to your regular workload. It’s not impossible to do, but it does take some balancing. Finding time to get that in is key to your growth. Sometimes you can get stagnant really quick. Putting time aside to stop and make sure you’re keeping your skills up to date keeps you competitive and also ensures you’re contributing great value to the organization.

**Karen**: Can you share your insights about what kinds of cybersecurity jobs you think are most difficult to fill, either in your organization now or as you’ve seen in your roles in cybersecurity?

**Charles**: In a large private sector organization or government organization like the FDA there is a lot of institutional knowledge and for a variety of positions it’s difficult to bring someone in fresh out of college or a boot camp to delve deep and fast in the vast networks and infrastructures that these offices are running. Roles like mine, the ISSO role, are also difficult to fill because of the mix between the technical, project management, and stakeholder management skills you have to bring to the table. Another area we find difficult to fill is in counter-intelligence—people looking at insider threats. There is a high demand in very large organizations such as Amazon and Facebook for people who are looking at the bigger picture of threats and intelligence, but it’s another area where you can’t just go to a boot camp or take a couple online courses and be well versed in it.

**Karen**: Talking a little bit more about workforce—is diversity something you are focusing on at the FDA, and could you share about any efforts you’ve been doing in that space that have been effective?

**Charles**: Yes, in fact, our Chief Information Security Officer has made diversity a part of our strategic plan. We’ve worked to bring in diverse candidates, specifically women, in our department and in our IT division in general and, as a result, we actually have a very high number of female cybersecurity professionals within our department. That’s not common across many organizations and agencies, so it’s a huge plus for our program. Our leadership is also working to build an inclusive culture overall so that, once we get candidates in, everyone feels welcome and included in the work that’s being done, not just in cybersecurity but across the entire FDA.

**Karen**: It can be easy to forget the importance of what happens when someone’s in the door. It’s great to hear about your efforts. I know you touched on it some, but can you add a bit more about what you enjoy most about your work?

**Charles**: I’ve always enjoyed helping people. The ability for me to educate our stakeholders by translating technical and the policy guidance into “plain English,” where they can take actionable steps to protect their systems and data without a lot of back and forth—I like being able to see that lightbulb go off when a stakeholder understands why we are doing something. Then they take the action to ensure that these mechanisms and plans are put into place because they see the value of how these they protect their systems. I also enjoy being responsible for a variety of tasks. In this job every day is different. There are new systems to stand up, issues that arise, patches that need to be deployed, and priorities that can change. This role puts you on the front lines of a lot of the work being done with the Federal Government to protect our systems and, at the end of the day, it’s about ensuring we are safe and secure instead of worrying about being on the front page of the paper because something’s gone wrong.

**Karen**: It must be really fulfilling to actually see the positive impact you’re making. And certainly in this field you have to want to continuously learn and change—it’s not like you can come in and do the same job that you did five years ago.

**Charles**: No, not at all. I had taken a break and I worked in academia at Northern Virginia Community College (NOVA) for five years, helping them develop cybersecurity programs for youth and young adults. When I started this job five years later, things that were just ideas or in beta testing when I had left were now being used. It blew my mind. When I talk to folks as a career coach or in speaking opportunities, I tell them that in cybersecurity you have to be a lifelong learner. You have to be willing to learn the technologies and different ways of doing your job and, in order to be competitive, you have to keep up.

**Karen**: How can training providers and education organizations make sure their students are keeping up to date so they can be effective in the workplace?

**Charles**: This is definitely a challenge. Teacher professional development is really important. I fought very hard to provide opportunities for teachers at the high school and collegiate level to be able to attend cybersecurity conferences to skill-up the information they’re teaching. In the classroom, it is important to use tools and resources to supplement what’s being taught—virtual environments, guest speakers, connections to work-based learning experiences, connecting with a mentor—so, although you may not be providing the cutting-edge technology in the classroom, the students are aware that these technologies exist and know where they can connect with individuals who understand it a lot better.

**Karen**: Do you see that the NICE Framework as helping in that regard?

**Charles**: It’s my go-to. I literally had sheets that I would paste on my board at work so that anytime someone brought up cybersecurity I would say, “Let’s start with the NICE Framework.” Honestly, it is a very simple way to understand the tasks, responsibilities, and skills that are needed to marry up which degree program a student may want to pursue, which job they may be interested in, or whether or not the skills and interests that they have match the type of job they had in mind.

**Karen**: If you had just one piece of advice to give someone who’s considering a career in cybersecurity what would you say?

**Charles**: To be specific about what you’re looking to do. What are you good at that someone is willing to pay you for? It’s a very broad field and you have to go back to the basics. Are you a people person or do you prefer to work by yourself? Do you like to communicate? Do you like to write? Are you creative? The answers to questions like these play into how successful you can be in different roles. If you can be more refined and specific about the paths you’d like to go down, you’re going to be a lot better off finding a job. That’s not to say that you have to stay in that particular role. The beauty of the field is that there are tons of opportunities available to you. But throwing a blind dart at a board is not the best approach. Be specific, but then also flexible when it comes to opportunities.

**Karen**: That really works well for both the employer and the learner. You want to be in a job that’s fulfilling and is makes the most of your abilities, so thinking that carefully through at the beginning versus just going for a title you maybe have heard before is important. Especially since titles from organization to organization can be totally different.

**Charles**: Totally different. But if you understand the basics of the role and ask the right questions during an interview, you’ll see what they’re really looking for. You can craft your job search to ensure that you’re not being pigeonholed into a job that sounds really good with a lot of technical buzz words but isn’t really about performing the tasks you had in mind. You want to be in a position that you enjoy doing every day instead of setting yourself up for failure because you’ve limited your options.

**Karen**: It sounds like you found yourself a role like that and I really appreciate you sharing with us about it today, Charles. Thank you so much for your time.

**Charles**: You’re welcome. It’s been my pleasure.

*To listen to the full audio interview with Charles Britt, click on the audio below:*

Audio file*Download a full transcript of the interview.*
  Cybersecurity education and workforce development

    
    Created April 15, 2021, Updated September 24, 2021
 HEADQUARTERS
            100 Bureau Drive
              Gaithersburg, MD 20899301-975-2000
            Webmaster | Contact Us | Our Other Offices
        Twitter
            
Facebook
            
LinkedIn
            
Instagram
            
YouTube
            
Giphy
            
RSS Feed
            
Mailing List
                              How are we doing? Feedback

  
  Site Privacy
                      Accessibility
                      Privacy Program
                      Copyrights
                      Vulnerability Disclosure
                      No Fear Act Policy
                      FOIA
                      Environmental Policy
                      Scientific Integrity
                      Information Quality Standards
                      Commerce.gov
                      Science.gov
                      USA.gov
                      Vote.gov