UNCLASSIFIED

UNCLASSIFIED

National Geospatial-Intelligence Agency

INSTRUCTION

NUMBER 8010.2

23 September 2019

CIO-T

SUBJECT: Cybersecurity Awareness Training and Certification

References: See Enclosure 1.

1. PURPOSE. This Instruction:

a. Establishes policy and assigns responsibilities for cybersecurity awareness

training and certification for NGA personnel in accordance with (IAW) Reference (b).

b. Establishes the Cybersecurity Workforce Management Program (CWMP) IAW

References (a) and (b).

c. Rescinds NGA Instruction 8010.2, “NGA Instruction for Information System

Security and Training,” 24 December 2008, Administrative Update, 10 November 2015.

2. APPLICABILITY. This Instruction applies to all NGA civilian employees, military

service members, other Government agency personnel assigned to NGA, and 

contractors, hereinafter referred to as personnel.

3. DEFINITIONS. See Glossary.

4. POLICY. It is NGA policy that:

a. All personnel complete required cybersecurity awareness training IAW Reference

(b).

b. Personnel serving in cybersecurity work roles are trained and certified IAW

References (b) and (c).

c. A CWMP is developed, implemented, and managed to protect the Agency from

existing and emerging cyber risks.

5. RESPONSIBILITIES. See Enclosure 2.

UNCLASSIFIED

NGAI 8010.2

3

UNCLASSIFIED

TABLE OF CONTENTS

CHANGE LOG ................................................................................................................ 4

ENCLOSURE 1: REFERENCES..................................................................................... 5

ENCLOSURE 2: RESPONSIBILITIES ............................................................................ 6

Chief Information Officer..................................................................................................6

Chief Information Security Officer....................................................................................6

Director, Human Development ........................................................................................6

Director, Office of Contract Services................................................................................7

Information System Owners and Program Managers ......................................................7

GLOSSARY .................................................................................................................... 8

UNCLASSIFIED

NGAI 8010.2

5

UNCLASSIFIED

ENCLOSURE 1

REFERENCES

(a) National Institute of Standards and Technology (NIST) Special Publication 800-181, 

“National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce 

Framework,” August 2017

(b) DoD Directive 8140.01, “Cyberspace Workforce Management,” 11 August 2015, 

Incorporating Change 1, 31 July 2017

(c) DoD Manual 8570.01-M, “Information Assurance Workforce Improvement 

Program,” 19 December 2005, Incorporating Change 4, 10 November 2015

(d) NGA Directive (NGAD) 1414, “Career Services,” 27 June 2018

(e) NGAD 8000, “Information Management and the Chief Information Officer,”

12 June 2013, Administrative Update 2, 28 October 2015

(f) NGAD 8010, “Information Systems Risk Management Framework (RMF),” 

27 August 2015, Administrative Update, 16 November 2015

(g) NGAI 8040.2, “Records and Information Lifecycle Management, Appendix 10: 1000 

Series–Training Files,” 30 March 2016

(h) NGA Information Assurance Requirements Catalog (IARC), Current Version

(b)(3) 10 USC 424
UNCLASSIFIED

NGAI 8010.2

6

UNCLASSIFIED

ENCLOSURE 2

RESPONSIBILITIES

1. Chief Information Officer.

a. Ensures required cybersecurity awareness training is provided to personnel IAW 

References (b) and (c).

b. Delegates responsibility and authority to the Chief Information Security Officer 

(CISO) to develop, administer, document, and manage the CWMP IAW References (b) 

and (e).

2. CISO.

a. Develops, administers, documents, and manages the CWMP.

b. Develops and implements a cybersecurity workforce framework IAW References 

(a), (b), and (c).

c. Establishes the cybersecurity work role training program. 

d. Identifies civilian positions that perform cybersecurity functions IAW References

(a) and (b).

e. Collaborates with the Director, Human Development (D/HD), to develop and 

implement a workforce occupational structure supporting the cybersecurity workforce 

framework IAW References (a), (b), and (d). 

f. Establishes requirements for cybersecurity awareness training IAW References (a) 

and (h).

g. Ensures compliance with cybersecurity awareness training. 

h. Ensures retention of cybersecurity awareness training records IAW Reference (g).

i. Identifies and acquires training for cybersecurity work roles.

j. Provides cybersecurity workforce qualification requirements to the Director, Office 

of Contract Services (D/OCS), for incorporation into contracts that include the 

acquisition of personnel and services performing cybersecurity work roles IAW 

Reference (b).

3. D/HD collaborates with CISO to develop and implement a workforce occupational 

structure supporting the cybersecurity workforce framework IAW References (a), (b), 

and (d).
UNCLASSIFIED

NGAI 8010.2

7

UNCLASSIFIED

4. D/OCS ensures that contracts that include the acquisition of personnel and services 

to perform cybersecurity work roles include qualification requirements provided by the 

CISO IAW Reference (b).

5. Information System Owners and Program Managers verify that their personnel 

performing cybersecurity work roles complete training and certification requirements 

before they are allowed access to information systems IAW References (b) and (c).
UNCLASSIFIED

NGAI 8010.2

8

UNCLASSIFIED

GLOSSARY

Cybersecurity

Awareness 

Training

Initial and annual refresher cybersecurity training provided by the 

CISO through computer-based training. (Definition created by 

NGA for NGA purposes only)

Cybersecurity 

Workforce

A workforce with work roles that have an impact on an 

organization’s ability to protect data, systems, and operations. 

(Reference (a))

Information 

System (IS)

A discrete set of information resources organized for the 

collection, processing, maintenance, use, sharing, dissemination, 

or disposition of information. NOTE: Information systems also 

include specialized systems such as industrial/process systems, 

telephone switching and private branch exchange systems, and 

environmental control systems. (Reference (f))