Identifies collection authorities and environment; incorporates priority information requirements into collection management; develops concepts to meet leadership’s intent. Determines capabilities of available collection assets, identifies new collection capabilities; and constructs and disseminates collection plans. Monitors execution of tasked collection to ensure effective execution of the collection plan.
*Certification Declaration
Certification Declaration
Each certification is mapped to the NICE Framework, which organizes cybersecurity into seven high-level Categories, each comprised of several specialty areas, work roles, knowledge, skills, abilities, and tasks. These seven high-level Categories are aligned directly to the CCE® Program’s certification Concentration Areas. Candidates often prepare for an exam by using a variety of resources that familiarize them with the authoritative sources and the exam’s concentration area.
Third-party products and services, including course instructors have helped many candidates to close knowledge and skill gaps. The CCE® Program does not endorse any particular provider and encourages candidates to use a variety of tools and resources that will enhance their understanding of relevant principles and the exam’s concentration area.
NICE Framework Category
CCE® Concentration Area:
Collect and Operate (CO)
NICE Specialty Area:
Collection Operations (CLO)
NICE Work Role ID:
CO-CLO-001
OPM Code | DCWF Code:
311
All Source-Collection Requirements Manager (CO203-RBT)
Cybersecurity Hunt (CO280)
KSA-T
Below are the Knowledge, Skills, Abilities and Tasks (KSA-T) identified as being required to perform this work role.
ID & Description
- K0001 - Knowledge of computer networking concepts and protocols, and network security methodologies.
- K0002 - Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
- K0003 - Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
- K0004 - Knowledge of cybersecurity and privacy principles.
- K0005 - Knowledge of cyber threats and vulnerabilities.
- K0006 - Knowledge of specific operational impacts of cybersecurity lapses.
- K0036 - Knowledge of human-computer interaction principles.
- K0058 - Knowledge of network traffic analysis methods.
- K0109 - Knowledge of physical computer components and architectures, including the functions of various components and peripherals (e.g., CPUs, Network Interface Cards, data storage).
- K0177 - Knowledge of cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
- K0353 - Knowledge of possible circumstances that would result in changing collection management authorities.
- K0361- Knowledge of asset availability, capabilities and limitations.
- K0364 - Knowledge of available databases and tools necessary to assess appropriate collection tasking.
- K0380 - Knowledge of collaborative tools and environments.
- K0382 - Knowledge of collection capabilities and limitations.
- K0383 - Knowledge of collection capabilities, accesses, performance specifications, and constraints utilized to satisfy collection plan.
- K0386 - Knowledge of collection management tools.
- K0387 - Knowledge of collection planning process and collection plan.
- K0390 - Knowledge of collection strategies.
- K0392 - Knowledge of common computer/network infections (virus, Trojan, etc.) and methods of infection (ports, attachments, etc.).
- K0395 - Knowledge of computer networking fundamentals (i.e., basic computer components of a network, types of networks, etc.).
- K0401 - Knowledge of criteria for evaluating collection products.
- K0404 - Knowledge of current collection requirements.
- K0405 - Knowledge of current computer-based intrusion sets.
- K0412 - Knowledge of cyber lexicon/terminology
- K0417 - Knowledge of data communications terminology (e.g., networking protocols, Ethernet, IP, encryption, optical devices, removable media).
- K0419 - Knowledge of database administration and maintenance.
- K0425 - Knowledge of different organization objectives at all levels, including subordinate, lateral and higher.
- K0427 - Knowledge of encryption algorithms and cyber capabilities/tools (e.g., SSL, PGP).
- K0431 - Knowledge of evolving/emerging communications technologies.
- K0435 - Knowledge of fundamental cyber concepts, principles, limitations, and effects.
- K0440 - Knowledge of host-based security products and how those products affect exploitation and reduce vulnerability.
- K0444 - Knowledge of how Internet applications work (SMTP email, web-based email, chat clients, VOIP).
- K0445 - Knowledge of how modern digital and telephony networks impact cyber operations.
- K0446 - Knowledge of how modern wireless communications systems impact cyber operations.
- K0448 - Knowledge of how to establish priorities for resources.
- K0449 - Knowledge of how to extract, analyze, and use metadata.
- K0453 - Knowledge of indications and warning.
- K0454 - Knowledge of information needs.
- K0467 - Knowledge of internal and external partner organization capabilities and limitations (those with tasking, collection, processing, exploitation and dissemination responsibilities).
- K0471 - Knowledge of Internet network addressing (IP addresses, classless inter-domain routing, TCP/UDP port numbering).
- K0474 - Knowledge of key cyber threat actors and their equities.
- K0475 - Knowledge of key factors of the operational environment and threat.
- K0477 - Knowledge of leadership’s Intent and objectives.
- K0480 - Knowledge of malware.
- K0482 - Knowledge of methods for ascertaining collection asset posture and availability.
- K0492 - Knowledge of non-traditional collection methodologies.
- K0495 - Knowledge of ongoing and future operations.
- K0496 - Knowledge of operational asset constraints.
- K0498 - Knowledge of operational planning processes.
- K0503 - Knowledge of organization formats of resource and asset readiness reporting, its operational relevance and intelligence collection impact.
- K0505 - Knowledge of organization objectives and associated demand on collection management.
- K0513 - Knowledge of organizational priorities, legal authorities and requirements submission processes.
- K0516 - Knowledge of physical and logical network devices and infrastructure to include hubs, switches, routers, firewalls, etc.
- K0521 - Knowledge of priority information, how it is derived, where it is published, how to access, etc.
- K0522 - Knowledge of production exploitation and dissemination needs and architectures.
- K0526 - Knowledge of research strategies and knowledge management.
- K0527 - Knowledge of risk management and mitigation strategies.
- K0552 - Knowledge of tasking mechanisms.
- K0553 - Knowledge of tasking processes for organic and subordinate collection assets.
- K0554 - Knowledge of tasking, collection, processing, exploitation and dissemination.
- K0558 - Knowledge of the available tools and applications associated with collection requirements and collection management.
- K0560 - Knowledge of the basic structure, architecture, and design of modern communication networks.
- K0561 - Knowledge of the basics of network security (e.g., encryption, firewalls, authentication, honey pots, perimeter protection).
- K0562 - Knowledge of the capabilities and limitations of new and emerging collection capabilities, accesses and/or processes.
- K0563 - Knowledge of the capabilities, limitations and tasking methodologies of internal and external collections as they apply to planned cyber activities.
- K0565 - Knowledge of the common networking and routing protocols (e.g. TCP/IP), services (e.g., web, mail, DNS), and how they interact to provide network communications.
- K0569 - Knowledge of the existent tasking, collection, processing, exploitation and dissemination architecture.
- K0570 - Knowledge of the factors of threat that could impact collection operations.
- K0579 - Knowledge of the organization, roles and responsibilities of higher, lower and adjacent sub-elements.
- K0580 - Knowledge of the organization’s established format for collection plan.
- K0581 - Knowledge of the organization’s planning, operations and targeting cycles.
- K0583 - Knowledge of the organizational plans/directives/guidance that describe objectives.
- K0584 - Knowledge of the organizational policies/procedures for temporary transfer of collection authority.
- K0587 - Knowledge of the POC’s, databases, tools and applications necessary to establish environment preparation and surveillance products.
- K0588 - Knowledge of the priority information requirements from subordinate, lateral and higher levels of the organization.
- K0596 - Knowledge of the request for information process.
- K0601 - Knowledge of the systems/architecture/communications used for coordination.
- K0605 - Knowledge of tipping, cueing, mixing, and redundancy.
- K0610 - Knowledge of virtualization products (VMware, Virtual PC).
- K0612 - Knowledge of what constitutes a “threat” to a network.
- K0613 - Knowledge of who the organization’s operational planners are, how and where they can be contacted, and what are their expectations.