Federal Modernization Workbook · Book 16
Book 16 — People: Training & Education
People, Not Tools, Close the Gap
Why people, not tools, close the gap: what federal workforce rules require, the compliance and implementation tracks, assessment and certification, vendor training and labs, end-user training, who owns readiness, and how to run and measure the curriculum
This book is part of Release 2.0, the workbook’s baseline edition: it is complete, checked against every other book and approved by the workbook’s editor, and later changes are tracked against Release 2.0. Baseline is not a claim of independent peer review (Status labels). This book replaces the workbook’s training and education pages, the end-user training guide, and the Federal Compliance series’ training and certification volume (its overview, compliance track, implementation track, assessment and certification, and vendor training and lab environments). Every external claim was checked against a primary source, starting October 21, 2026, and carries a note with its date. The replaced pages are kept in the repository’s archive/b16-people/ folder, and their old addresses forward to the chapters that replaced them.
b16-people-bundle.docx: the whole book as one Word document, regenerated on every site deploy.
15-minute presentation (about 13 minutes narrated): the Why / What / Who / How deck is on the Presentations page.
Executive briefing (about 30 minutes live, 15 narrated): for the CIO, HR leadership, CISO and training leads: who now decides what, training before cutover, the federal workforce rules, role tracks and certification, help desk readiness, waves that move on readiness and keeping knowledge when contracts change, with each decision’s owner and timing, on the Presentations page.
Every book before this one changes what people do. The help desk verifies before it resets. Owners approve access instead of inheriting it. Stewards keep the record, ISSOs assemble evidence, engineers build to a baseline, and users sign in with a PIV card, a passkey or Windows Hello instead of a password and a push prompt. Tools enforce the new model, but people run it, and a program that trains last pays twice: once for the training and once for the rework, the tickets and the exceptions that untrained staff create. Book 16 treats training as part of the program, not an afterthought. It sets out what federal rules actually require: FISMA’s duty to have trained staff, OPM’s 5 CFR 930.301 and the training evaluation rules in Part 410, the NICE Framework’s work roles and federal cybersecurity workforce coding. It then lays out two tracks, compliance and implementation, mapped module by module to the books that teach them, and assessments that test whether people can do the work, not just whether they finished a course. Vendor training and safe labs come next, along with end-user training timed to each migration wave and the people who own readiness. Readiness is measured and evidenced at each of the program’s gates.
Why, what, who, how
| Question | Chapters | |
|---|---|---|
| Why | Why do people, not tools, close the gap, and what do federal workforce rules require? | 01, 02 |
| What | The compliance and implementation tracks, assessment and certification, vendor training and labs, and end-user training | 03, 04, 05, 06, 07 |
| Who | Who owns workforce readiness | 08 |
| How | Build and run the curriculum with the program’s phases and gates, and measure readiness | 09, 10 |
Reading paths
- Executives and sponsors (20 minutes): Chapters 01, 08 and 10, or the 15-minute presentation.
- Training and workforce leads: Chapters 02, 09 and 10, with Appendix A.
- ISSOs, assessors and compliance staff: Chapters 03 and 05.
- Engineers and administrators: Chapters 04 and 06.
- Communications and service desk leads: Chapter 07.
Where this book sits in the workbook
This is Book 16 of the Federal Modernization Workbook. The training controls and their evidence (AT-2, AT-3, AT-4, IR-2, CP-3) are in Book 14, Chapter 09; the roles people are trained for are in Book 00, Book 01, Book 13, Book 14 and Book 15; and the phases and gates training aligns to are in Book 01, Chapter 12. Book 17, AI Identity Governance, applies the same discipline to AI agents and their owners.
New and revised procedures in this book follow the workbook’s implementation conventions (control states, the How-section template, authority labels, the evidence checklist, change safety and the Zero Trust mapping block), defined once in Book 00, Appendix D.
Chapters
| Title | Description |
|---|---|
| Chapter 01 — People, Not Tools, Close the Gap | Why the modernized estate is run by people rather than by its tools: what each earlier book changes in someone’s daily work, why education comes before training, why training scheduled last is paid for twice, and how training becomes part of each program gate’s readiness. |
| Chapter 02 — What Federal Workforce Rules Require | The federal workforce requirements behind training: FISMA’s duties to train and staff, OPM’s training rule at 5 CFR 930.301, OMB Circular A-130’s workforce and training provisions, the NICE Workforce Framework for Cybersecurity and its current components, and the position coding the Federal Cybersecurity Workforce Assessment Act requires, with DoD 8140 as a contrast. |
| Chapter 03 — The Compliance Track | The curriculum for ISSOs, compliance staff, control assessors and authorizing officials: the Risk Management Framework and who owes which proof, the Moderate baseline and FedRAMP’s certification classes as separate facts, eight modules that trace each area of the estate from the mechanism that closes a control to the record that proves it, the authorization package, the plan of action and milestones and continuous monitoring, and a capstone, each module mapped to the book that teaches it. |
| Chapter 04 — The Implementation Track | The curriculum for the engineers and administrators who build and run the modernized estate: a foundations module, ten build modules for DDI, identity, PKI, access, devices and servers, network, the data platform, the cloud platform, security operations and day-two operations, each with its prerequisites, a hands-on lab and the evidence it has to land, mapped to Books 01 to 09, 10, 12 and 15; the order the modules run in, their pairing with the compliance track, a capstone, and example certifications checked against Microsoft Learn. |
| Chapter 05 — Assessment and Certification | How the program assesses that people can do the work: a four-level rubric scored the way an assessor would score it, the two track capstones, a closure reconstruction exam, two program credentials with recertification, and how they relate to industry certifications and the NICE Framework’s work roles. |
| Chapter 06 — Vendor Training and Lab Environments | Where product skill comes from and where people practice it safely: choosing vendor training, the vendors whose products the books configure, the federal sources, lab tenants and sandboxes and their eligibility, the government-cloud differences, the safety and data-handling rules every lab follows, and labs mapped to the books’ procedures. |
| Chapter 07 — End-User Training for the Modernized Estate | What every user has to learn when the estate changes: phishing-resistant sign-in with PIV, Windows Hello for Business and passkeys, self-service password reset and account recovery, device enrollment and compliance, the new collaboration tools with sensitivity labels, encrypted mail and data loss prevention tips, reporting suspicious messages and prompts, and what the help desk will and won’t ask; then when to tell people around each migration wave, how to prove the training worked, and how to make the training accessible under Section 508. |
| Chapter 08 — Who Owns Workforce Readiness | Who owns the workforce’s readiness for the modernized estate: the sponsor and CIO, the CISO, the Chief Human Capital Officer and workforce office, the training lead, managers and supervisors, the ISSO and system owner, the program office and its readiness gates, the help desk and the communications office; where each duty comes from in FISMA, the CHCO Act, OPM’s rules at 5 CFR 410 and 930.301, OPM’s cybersecurity coding guidance and NIST SP 800-37 and SP 800-50 Rev. 1; and a responsibility matrix consistent with the program’s other Who chapters. |
| Chapter 09 — Building and Running the Curriculum | How the program schedules training against Book 01’s phases and gates, trains each wave just before it moves, builds its own instructors, keeps the curriculum current as the books change, makes every module, assessment and video accessible, and records every completion in the learning management system. |
| Chapter 10 — Measuring Readiness and Evidencing It | How the program measures whether people are ready for each role and each gate: completion set against demonstrated competence, training records as evidence, surveys and help desk ticket trends as signals, and what to report to the steering committee. |
| Appendix A — The Curriculum Map: Role, Book and Track | A role-by-role map of the workbook: for each role named in Books 00, 01, 13, 14 and 15, the books and chapters it must read, its track, how it is assessed and how often it is refreshed. |
Version and revision history
Version 2.0, in edition 2026.11.5 (November 8, 2026). Every edition is kept on the Archive page; every change between editions is in the commit history.
| Version | Edition | Date | Changes |
|---|---|---|---|
| 2.0 | 2026.11.5 | 2026-11-08 | Release 2.0, the baseline: checked against every other book; Draft becomes Baseline; Edition 2026.11.4: record the edition and point deck links at it (#362); Book 16: fix confirmed crosswalk errors (#407); Apply the open-choice decisions: text, plans, training, reference, register (#416); Book 16: fix 24 inconsistency findings (gates, owners, ladder, counts, citations) (#437); Decisions fix pass for Books 13 to 19: Book 18 gates and roles, Db2 spelling, Book 15 approvers, Book 16 criteria, Book 17 roles, Book 13 drift mapping (#456); Decks: match Books 04, 16 and 18 pages after the Nov 7 decisions passes (#460); Re-render five videos after the #460 deck wording changes (#461); and 4 more (all changes) |
| 1.5 | 2026.11.4 | 2026-11-05 | Approve ten pages on Mike’s word, and drop two names from the briefs (#360); Sweep stale wording, and link sources on every deck (#361) |
| 1.4 | 2026.11.3 | 2026-11-05 | Book decks: narration names the book or the original source, and 68 videos re-exported (#344) |
| 1.3 | 2026.11.2 | 2026-11-02 | Section 508: accessibility gates in Books 18 and 16, notes in Books 04 and 15 (#314) |
| 1.2 | 2026.11.1 | 2026-11-01 | Edition 2026.11: record the edition, and publish the four gate-level decks and videos (#282) |
| 1.1 | 2026.11 | 2026-11-01 | Move the decks and narration audio out of git, onto edition 2026.10 (#260); Retire Research: move each page to a home by type (guides, training, reference, evaluations, explainers) (#269) |
| 1.0 | 2026.10 | 2026-10-31 | First edition (14 merged changes since the book began) |