RMFInsider

Twelve months is realistic if you spend them on paperwork fluency rather than technology. You already know how the systems work, which is the part career changers spend two years failing to fake. What you do not know yet is how to write a control implementation statement an assessor accepts, how a POA&M item is structured, or what the authorization boundary on your own network actually is. Four quarters: a baseline certification and a declared work role in Q1, the package artifacts in Q2, your name on a real system in writing in Q3, the move in Q4, internal first. Q3 is the hinge and the quarter people skip.

The gap is paperwork, not technology

You have spent years doing the work half the control catalog describes. You configure the access control mechanisms in AC-2 and AC-6. You patch, which is SI-2. You own the baseline configurations in CM-6 and the change process in CM-3. You rotate credentials, which is IA-5. You read logs, which is AU-6. An ISSO’s job is largely to document that this happens, prove it to an assessor, and track what does not.

So your skill deficit is narrow: you cannot yet produce the paper. The hardest part of my own transition was learning to write a sentence an assessor accepts, after a decade of fixing things with a command instead. A network admin’s instinct, asked how a control is met, is to open a terminal and show the running config. The assessor wants a narrative, a reference to the implementing document, and a dated screenshot. None of those is the terminal.

That gap is worth more to you than it sounds, because it closes in twelve months while a bootcamp graduate’s does not. The admin can learn to write the narrative. The person who has never run a domain cannot learn what the running config should say. If you are choosing which security role to point at, my breakdown of ISSO versus ISSM versus ISSE, including which one pays more, covers that comparison in full. Read it first, pick a lane, then come back.

Quarter 1: the baseline cert and a declared work role

The certification

Security+ is the baseline that opens doors in this lane, exam code SY0-701. CompTIA’s listed retail price was roughly $439 as of 2026, with voucher resellers lower, near $373 at one training vendor I checked. If you have a GI Bill, tuition assistance or an employer training budget, use it. Out of pocket, the voucher plus a study resource is the whole cost, and for a working admin the content overlaps heavily with what you already do.

Do not stack certifications this quarter. One baseline cert, passed, beats three in progress. The temptation to collect is strong, and giving in to it is the quickest way to turn a twelve-month plan into a thirty-month one.

The work role

DoDM 8140.03 replaced the 8570 manual, and with it the IAT and IAM level structure you may have grown up with. Qualification now runs against a specific DoD Cyber Workforce Framework work role at a proficiency level of Basic, Intermediate or Advanced, with the Foundational Qualification Matrix as the source of record. The version I found cited was v2.1, effective 19 September 2025, so check cyber.mil for the current one as published rather than trusting a blog, this one included.

Three things to know before you plan around it:

• A certification approved at a higher proficiency level also covers the lower levels within the same work role. It does not carry across roles, so a Network Operations Specialist qualification will not transfer sideways.
• Contractors must meet the foundational requirement when they begin cyberspace work. DoD civilians and Service members get 12 months from assignment for the residential qualification, which contractors do not need unless the contract requires it and says how.
• A position’s work role code comes from your component’s manpower system, not the job posting, so the title and the coded role can disagree. Ask which code the billet carries.

Your Q1 job is to learn which work role your target position is coded to and what the matrix requires at that proficiency level. That one question, asked of your ISSM, saves you from studying for the wrong thing.

Quarter 2: learn the four artifacts, using systems you already run

This is the quarter you stop being an admin interested in security and become someone who can be handed a package. Four artifacts, learned by writing each one about a system you already administer, even if nobody asked:

1. The system security plan. Start with the authorization boundary and draw it: what is inside, what is outside, where connections cross, and which of those has an agreement behind it. You are the person in the building who actually knows this.
2. The control implementation narrative. Pick ten controls you personally implement and write the statement for each: the mechanism, how it is configured, where the implementing policy lives, and what evidence proves it. Then have someone who has written a package tear up your first three.
3. Test results and the SAR. Run a STIG checklist against a system you own. Learn the CCI mapping, what a CAT I finding does to a package, and the difference between a finding and a non-applicable determination.
4. The POA&M. Take your own open findings and build real items: weakness description, source, scheduled completion date, milestones, resources required, and an owner who is a person rather than a team. A POA&M item with no owner and no milestone is a wish.

Do this for your own systems and you arrive at an interview with artifacts you wrote, which beats a certificate. My walkthrough of where the sysadmin’s responsibilities end and the ISSO’s begin is the map for this quarter, because that line is blurrier than either job description admits.

Quarter 3: get named on a real system, in writing

This is the hinge, and people skip it because it is the only quarter that requires somebody else to say yes. Q1 and Q2 you can do alone. Q3 you cannot. What you want is documentary evidence that you performed security duties on an authorized system, in rough order of weight:

• An ISSO appointment letter, even as an alternate or deputy. The strongest artifact here, and it costs your ISSM a signature.
• A role assignment in eMASS on a real package, your account provisioned against a system. Read-only is still your name.
• Named ownership of POA&M milestones, so there is a record of you closing findings rather than just fixing things.
• Your signature on a security impact analysis for a change you made. You already make the changes. Signing the analysis turns it into RMF experience.
• A documented role in an assessment, even if that role is gathering evidence and sitting in the daily sync.

How to get it: ask your ISSM for the unglamorous work. The annual review for one low-impact system. The control narratives nobody has touched since the last authorization. The STIG checklists. An ISSM behind on narratives hands them to a competent volunteer faster than you expect, and I have never met one with a surplus of hours.

Get the yes in email and keep it. Twelve months later, when a hiring manager asks what RMF experience you have, “I was the alternate ISSO on a Moderate system and closed eleven POA&M items” is an answer. “I helped with security” is not.

Quarter 4: make the move, internally first

Apply internally before you apply out, for three reasons that have nothing to do with loyalty. Your clearance is in place and does not need to transfer. Your reputation does work a resume cannot. And the hiring manager can verify your Q3 evidence by walking down the hall, which removes the biggest risk they price into an external candidate.

Rewrite the resume around the package, not the infrastructure. The bullets that get you screened in name artifacts and controls: authorization boundary, control implementation statements, POA&M milestones closed, STIG checklists executed, eMASS, assessment support. VLANs, switch stacks and uptime percentages go to the bottom. Keep them, because they are why you are credible, but they are not what the keyword screen reads for.

Expect a lateral or near-lateral on money for the first move. The pay improvement shows up at the second step, once an authorization cycle is behind you, and the number depends on the posting, the component and the contract. Anyone quoting a figure without those three is guessing.

If your employer will not let you near the ATO work

Some shops will not. The ISSM is territorial, the contract scopes you tightly, or there is no package in your building at all. Then Q3 has to be simulated, and a simulated Q3 is weaker than a real one and a great deal stronger than nothing.

Build a package for a system you stand up yourself: categorize it, select a baseline, write the SSP, run the STIG checklists, document findings, build the POA&M, write the assessment plan. My GRC home lab and RMF portfolio walkthrough covers how without a government system. It will not substitute for an appointment letter. It will get you past the screen that stops at the absence of RMF keywords. And start applying externally in Q3 rather than Q4, because you need a quarter of search time an internal candidate does not.

What twelve months does not fix

Three honest limits, because a plan that promises everything is a sales page.

• Clearance timing is not on your schedule. If you need one and do not have it, the investigation and adjudication run on their own clock and preparation does not compress them.
• A year of adjacent experience is not a year of ISSO experience, and a qualification matrix or posting may say so explicitly. The Q3 appointment letter is what closes that argument, which is why Q3 matters more than Q1.
• Judgment takes longer than a year. Knowing whether a change is significant enough to trigger reauthorization, or when to push back on an assessor, comes from watching several authorization cycles. Twelve months gets you hired, not seasoned.

None of that argues for stretching the plan to twenty-four months. It argues for spending the twelve on the right things and being straight with an interviewer. “I have run the infrastructure for six years, written narratives and closed POA&M items as an alternate ISSO, and not yet owned a full authorization cycle” beats an inflated answer, because the inflated kind falls apart on the third follow-up question.

If you are starting further back, with no clearance and no security duties yet, my guide to landing a first ISSO job from a standing start is the earlier version of this plan, and the help desk transition path covers the step before that.

For the resume rewrite, the interview answers and the quarter-by-quarter sequencing in a form you can work through, Zero to Hired is the system I built for this move, and admin-to-ISSO is the route it handles best, because you start with the hard part already done.