This is not an official U.S. federal government website. The Federal Modernization Workbook is independent technical analysis. It does not represent the position of, and has not been reviewed or endorsed by, any federal agency.

Federal Modernization Workbook · Book 16 · Appendix

Appendix A — The Curriculum Map: Role, Book and Track

A role-by-role map of the workbook: for each role named in Books 00, 01, 13, 14 and 15, the books and chapters it must read, its track, how it is assessed and how often it is refreshed.

Every role the workbook assigns a decision or a task to has a reading list, a track, an assessment and a refresh date; this appendix puts them on one page.

In this appendix

One table per role family, mapping each role from the role models of Book 00, Chapter 07, Book 01, Chapter 09, Book 13, Chapter 09, Book 14, Chapter 10 and Book 15, Chapter 10 to the chapters it must read, its track, its assessment and its refresh cadence. The reading lists, assessments and cadences are the program’s design. The agency should adjust them to its own role definitions and record the result in the learning management system as the assignment rules described in Chapter 09.

How to read the map

Must read lists chapters by book and chapter number, linked. Every role also reads Book 16, Chapter 01 and takes the orientation in Chapter 09 before anything else; those aren’t repeated in the rows. A chapter in the list is required reading for the role. Other chapters in the same book are useful but not assigned.

Track is one of four values:

Orientation — orientation and the listed reading only, for roles that decide on evidence other people produce.
Compliance — the compliance track, which reads the books as evidence for controls.
Implementation — the implementation track, which reads them as build instructions, with the labs in Chapter 06.
Both — the role holds decisions on both sides and takes the core of each track.

Assessment names the kind of check that shows the role is ready, using the readiness measures of Chapter 10. Roles marked assessed count as ready only with a passing result, not a completion.

Refresh is the program’s suggested cadence. Every role is also retrained on assignment to the role, on a significant change to the systems or procedures it uses, and when a chapter on its list changes in a way its module owner judges material, as 5 CFR 930.301(d), AT-2 and AT-3 require training on change (Chapter 09). Those triggers apply to every row and aren’t repeated.¹

Program leadership and decision makers

Role	Defined in	Must read	Track	Assessment	Refresh (design)
Executive sponsor and CIO	B00 Ch07; B01 Ch09	B00 01, 05, 07, 10; B01 01, 09, 12; B14 01, 02; B16 10	Orientation	Can state what each gate means and how it is evaluated, without document numbers	On appointment; before each gate the role decides (G2, G3, G5)
Steering committee members	B00 Ch07	B00 05, 07, 09; B01 12; B13 02; B16 10	Orientation	Same as the sponsor	On appointment; annually
Authorizing official and designated representative	B14 Ch10; B13 Ch09	B10 01, 11; B11 10; B13 07, 09, 11; B14 01, 04, 10, 11	Compliance (Modules 0 and 9, per Chapter 03)	A reviewed capstone from their own system, and the 45-minute assessor briefing	Annually; at each authorization or reauthorization
CISO and the CISO’s staff	B14 Ch10; B01 Ch09	B04 01, 06; B11 03, 07; B12 10, 12; B13 09; B14 03, 09, 10; B15 04	Compliance	Assessed for the staff: the compliance-track capstone; orientation check for the CISO	Annually
Senior agency official for privacy and the privacy office	B14 Ch10; B01 Ch09	B03 07, App B; B13 09; B14 08, 09	Compliance	The capstone’s training area (area 8), for the privacy office’s staff	Annually
Steward and the program office	B00 Ch07; B13 Ch09	All of B00; B01 11, 12; B13 03 to 07, 09; B16 09, 10	Both	Assessed: the compliance-track capstone and one gate evaluated from data	Annually; before each gate
Project manager	B00 Ch07	B00 05 to 10, App A; B01 12; B16 09	Orientation	Orientation check	On appointment; annually
Governance board members	B13 Ch09	B13 02 to 05, 09, 10	Both (core modules)	Orientation check; the CISO’s and privacy representatives take their own rows	On appointment; annually
Head of agency and the senior accountable official for risk management	B14 Ch10	B00 01, 07; B14 01, 02, 10; B16 08, 10	Orientation	Orientation check	On appointment; annually
Zero Trust program lead (the posture owner)	B11 Ch07	B11 01 to 03, 07 to 10; B12 12; B13 07	Both	Assessed: one assessment cycle read as evidence, from the score definition to the plan of action entries	Annually; before each assessment cycle
Records officer and staff	B13 Ch09; B01 Ch09	B00 10; B01 09; B13 04, 09; B14 09	Orientation	Orientation check	Annually; before Phase 4 retirements

Authorization and compliance roles

Role	Defined in	Must read	Track	Assessment	Refresh (design)
System owner	B14 Ch10; B15 Ch10	B12 10; B13 09; B14 04, 06, 10, 11; B15 02, 10	Compliance	A reviewed capstone for the owner’s own system	Annually
ISSO and ISSM	B14 Ch10	B12 02, 12; B13 07; B14 03, 04, 09 to 12, App A; B15 11	Compliance (all modules)	Assessed: the compliance-track capstone, scored in Chapter 05	Annually; when the control baseline or FedRAMP rules change
Control assessor	B14 Ch10	B11 10; B13 07; B14 04, 11, App A	Compliance (all modules)	The 45-minute assessor briefing; the capstone is assessed, not written (Chapter 03)	Before each assessment
Common control providers	B14 Ch10	B13 11; B14 03, 04, 10	Compliance	The capstone, for the inherited controls	Annually
Contingency planning coordinator and recovery staff	B14 Ch10	B14 06, 09	Compliance (coordinator); role training (staff)	Assessed: contingency role training and the annual exercise	On appointment, then annually (CP-3, per B14 Ch09)
Supply chain risk lead	B14 Ch10	B14 07; B15 06	Compliance	The capstone’s configuration, change and supply chain area	Annually
Information owners	B14 Ch10	B12 09; B14 08, 10, App F	Orientation	Orientation check	On appointment; annually
Contracting officer’s representatives	B14 Ch09	B03 07; B14 07, 09	Orientation	Orientation check	Annually

Platform and engineering roles

Role	Defined in	Must read	Track	Assessment	Refresh (design)
Identity engineering (identity workstream)	B01 Ch09; B15 Ch10	B01 04; B02 03 to 10; B03 04, 05, 08, 12; B04 03 to 10	Implementation	Assessed: lab build and rollback	Annually; before Phase 1
Endpoint engineering (policy and compute workstreams)	B01 Ch09; B05 Ch06	B01 05, 07; B05 02, 04 to 10, App A	Implementation	Assessed: lab build and rollback	Annually; before the pilot
Server infrastructure	B01 Ch09; B05 Ch06	B01 03, 07; B05 03, 09	Implementation	Assessed: lab build and rollback	Annually
Data platform team	B06 Ch13	B06 01, 07, 09 to 21, and the runbooks R01 to R10	Implementation	Assessed: lab build and rollback	Annually
PKI and CA administrators	B07 Ch05	B07 01 to 08, App A, App B	Implementation	Assessed: lab build and rollback	Annually
DNS and DDI team	B08 Ch09	B01 06; B08 02, 04, 08 to 11; B15 07	Implementation	Assessed: lab build and rollback	Annually
Network engineering	B09 Ch09	B09 02 to 13	Implementation	Assessed: lab build and rollback	Annually
Cloud platform and landing zone team	B10 Ch08	B10 02 to 09; B15 08, 09	Implementation	Assessed: lab build and rollback	Annually
AD administrators	B01 Ch09	B01 02; B02 04, 07, 08; B05 07; B00 10	Implementation	Assessed in the cloud role they move to, before G4	Until AD retires; then the new role’s row
Pillar owners	B11 Ch07	Their own team’s row, plus B11 07, 08, 10	Implementation (their team’s modules)	Assessed in their own team’s row, plus one finding traced from triage to re-test	Annually; before each assessment cycle
Field-office facilities and on-site staff	B09 Ch09	B09 07, 09, 11	Orientation	Orientation check	Before their site’s wave
Security operations	B12 Ch10; B15 Ch10	B12 02 to 11; B11 09; B14 09	Implementation	Assessed: lab, plus the playbook drills and tabletops of B14 Ch09	Semiannual walkthroughs and quarterly drills, per B14 Ch09’s cadence
Developers and pipeline owners	B14 Ch09	B04 05, 10; B13 04; B14 07	Implementation	Assessed: the implementation track’s access lab (module 4), with the cloud platform lab (module 8) for pipeline owners	Annually
Application owners	B01 Ch09	B01 07, 09; B04 05; B06 18, 19	Orientation; application teams take implementation modules for their platform	Orientation check; application teams lab-assessed	Before their application’s cutover

Identity, HR and day-two operations roles

Role	Defined in	Must read	Track	Assessment	Refresh (design)
HR and contractor-source owners	B01 Ch09; B03 Ch07	B03 02, 03, 04, 07, 08, App A	Orientation	Orientation check	Annually; before the HR feed goes live (Phase 1)
Identity governance officer	B04 Ch06; B15 Ch10	B04 06, 08, 09; B15 03, 04, 06, 10	Both (core modules)	Assessed: one access review traced from decision to record	Annually
Service desk technicians (first line)	B15 Ch10	B15 01, 03, 04, 12, App A; B04 06	Implementation (help desk modules)	Assessed: observed identity-verification scenario, including a social engineering attempt, before role eligibility	Before each wave; annually; on any procedure change
Service desk supervisor	B15 Ch10	The technicians’ list, plus B15 10 and B16 10	Implementation (help desk modules)	Assessed: the technicians’ scenario, plus a review of returned tickets	Before each wave; annually
Cloud services (second line)	B15 Ch10	B04 06, 08; B15 03, 04, 08, 12	Implementation	Assessed: the verification scenario and the escalation runbooks	Before each wave; annually
ITSM platform team and CMDB owner	B15 Ch10	B13 10; B15 05, 07, 11	Implementation	Assessed: lab build of one catalog item with its approval and evidence	Annually
Change advisory board members	B15 Ch10	B13 04, 10; B15 10	Orientation	Orientation check	On appointment; annually
Training lead and module owners	B16 Ch08	B14 09; B16 03 to 10	Both	Instructors: the module’s own assessment and an observed teach-back	Annually; after each wave’s instructor and content feedback
Department champions	B16 Ch09	B16 07	Orientation	Observed teach-back	Before their division’s wave
Every system user, including contractors	B14 Ch09	B16 07 (the modules, not the chapter)	Orientation (end-user modules)	The end-of-module check	Annual awareness, before access for new users, and the wave module before each wave

Keeping the map current

The map is a derived artifact. Its source is the set of role chapters it cites. When a role chapter adds, renames or removes a role, or a book adds chapters, the map changes with it through the same currency review that Chapter 09 describes for modules. Book 17, AI Identity Governance, adds the people who own and approve AI agent identities (Book 17, Chapter 08); the program adds their rows at the next currency review, and Book 17’s chapters join the reading lists of identity engineering, the identity governance officer and the CISO’s staff. Book 18, Application Modernization, adds the architecture review board and its gates (Book 18, Chapter 07), and Book 19, Building the Attribute-Driven Migration, is written for the engineers who build the identity, endpoint and pipeline code; their rows and readings are added at the same currency review.

Continue the book

← Previous: Chapter 10 — Measuring Readiness and Evidencing It · Book index

5 CFR § 930.301(d), eCFR text as of October 1, 2026, https://www.ecfr.gov/api/versioner/v1/full/2026-10-01/title-5.xml?part=930&section=930.301; National Institute of Standards and Technology, SP 800-53 Rev. 5, controls AT-2 (item a.2) and AT-3 (item a.2), checked against the release 5.2.0 OSCAL catalog, https://github.com/usnistgov/oscal-content/blob/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json (both accessed Oct 21, 2026).↩︎