Military Intelligence (MI) Systems Maintainer/Integrator

You are the junior Military Intelligence Systems Maintainer / Integrator. You have a TS/SCI and a stack of vendor manuals — your job for the next 18 months is to learn the iron the analysts ride, because when DCGS-A goes down at 0200 the SCIF calls you, not the help desk.

You came out of AIT at Fort Huachuca — the U.S. Army Intelligence Center of Excellence, taught by the 111th MI Brigade. The course is long for a reason: roughly six months of networking, server-side administration, COMSEC handling, and MI-specific platform familiarization on the systems you will actually break and fix at your first unit. You showed up to a BCT MICO, an MEB or divisional MI battalion, or one of the named MI brigades — 470th at JBSA-Fort Sam Houston, 500th at Schofield, 501st in Korea, 66th in Wiesbaden, 780th at Fort Eisenhower (renamed from Fort Gordon in 2023), or the 706th MI Group at Fort Meade. The senior 35T on your team handed you a JWICS account, a JQR / OJT signoff book, a vendor reading queue, and a list of IAT-II prerequisites under DoDM 8140 you have 12 months to satisfy. Most of your week is shadowing a certified maintainer, racking and re-cabling gear in the SCIF, running cable through a Prophet vehicle in the motor pool, sitting next to the senior 35T while he troubleshoots a DCGS-A query node, and grinding the unglamorous part — COMSEC inventory under AR 380-40, classified destruction logs, SF 153 / DA 3964 cover sheets, IAVA ticklers, clearance reinvestigation paperwork, and the standing morning SITREP on system uptime nobody told you was on you until 0530.

• 01Operate inside an MI SCIF to AR 380-5 and ICD 705 standards — badge discipline, two-person integrity on classified, escort protocols, classified discussion only inside spaces rated for it.
• 02Trace a CAT-5 / CAT-6 / fiber run from the wall jack through the patch panel to the switch port — and punch down a 568B if the SCIF cable plant breaks at 0300.
• 03Image, patch, and STIG-harden a Windows / Red Hat workstation off the approved baseline image and rejoin it to the domain without breaking the GPO that the next echelon up enforces.
• 04Drive the basic admin console on DCGS-A (Distributed Common Ground System – Army) at the maintainer level — service status, log scrape, restart procedures, escalation to the senior maintainer before you start guessing.
• 05Inventory and handle COMSEC under AR 380-40 — EKMS / KMI workflow, two-person integrity, the LCMS log, the destruction line, every page accounted for.
• 06Pass the IAT-II prerequisites — CompTIA Security+ is the most common entry credential funded by the unit under the DoDM 8140 cyber workforce framework.

• —AR 25-1 — Army Information Technology; AR 25-2 — Army Cybersecurity (read both your first month, even if you only read them once).
• —AR 380-5 — Department of the Army Information Security Program (you sign for material under this reg every day).
• —AR 380-40 — Safeguarding and Controlling Communications Security Material (COMSEC is half your job).
• —AR 381-10 — US Army Intelligence Activities; AR 381-12 — Threat Awareness and Reporting (TARP); DoDD 5240.01 — DoD Intelligence Activities.
• —DoDM 8140 — Cyberspace Workforce Qualification (the chart that gates every IAT-coded position you sit).
• —STP 34-35T — Soldier Training Publication for the 35T military occupational specialty; DISA STIGs at public.cyber.mil for the platforms you actually administer.

• —AIT graduate from the 35T course at Fort Huachuca; JQR / OJT signoff on the first work-role inside the published timeline — most teams expect first-position qualification inside 12-18 months.
• —IAT-II baseline credential on the DoDM 8140 list (Security+ CE is the most common entry credential funded by the unit; A+ and Network+ stack on it).
• —TS/SCI with CI poly where the billet requires it, maintained without a flag — one mishandling incident on a SAP / SCI document and the SSO pulls your access that afternoon.
• —ACFT 500+ floor — the SCIF is sedentary by nature and senior NCOs notice the 35T who skates on PT.
• —Annual SAEDA / TARP / cyber awareness / OPSEC / insider-threat / COMSEC user training complete before the suspense — your name on the brigade non-compliance roll is the wrong way to be noticed.

• —Taking a phone, smartwatch, or any personal electronic into the SCIF. Even once. The Special Security Officer (SSO) pulls your access that afternoon and the CI investigation runs months.
• —Plugging a personal USB or unapproved external media into an MI system. The audit catches it the same day; the brigade S2 is in your 1SG's office by 1500.
• —Sharing a SIPR / JWICS / NSANet credential — even with your own team lead. Two-person integrity is two people with their own credentials, and the audit log finds it.
• —Closing a maintenance ticket without confirming the analyst can actually run the workflow again. The next shift reopens it as "you did nothing," with cc to the warrant.
• —Skipping a destruction log line or signing a buddy's COMSEC inventory you did not personally witness. AR 380-40 violations are the line nobody in this MOS gets to cross twice.

The good cherry 35T is the PFC the senior maintainer brings to the after-hours DCGS-A page because the cabling he ran last week was labeled, the diagram he drew is taped inside the rack door, and the analyst who called the outage knew his name. By month nine the Security+ is on the wall, the JQR book is half done, and the warrant on the team has started asking what vendor cert he wants to chase next.

You are the maintainer the senior NCO sends to the broken rack at 0200 because he knows it will come back up before the morning analyst sits down. The privates copy how you label cable, how you write a maintenance log, how you talk to a warrant about a system you only half understand.

You are signed off on at least one work-role under the joint MI / cyber workforce framework, and you are reading toward the next one. You administer a slice of the MI enclave — a DCGS-A node, the SCIF's domain controllers, the storage array the analysts hate when it gets slow, the COMSEC account, the tactical comms fit on a Prophet Enhanced vehicle, or the cabling and switch fabric for the BCT analytic line. You support the SIGINT analysts (35N), the cryptologic linguists (35P), the signals collectors (35S), and the cyber operators (35Q) on the joint floors at Fort Meade or Fort Eisenhower. You run the IAVA closure cycle inside the published timeline, you push the STIG-compliance patches, and you are the bench when the SSG NCOIC has to leave the shop. You will also draw the Prophet, the Trojan, or the BCT's tactical SIGINT extension package for a field problem and you will sign for hundreds of thousands of dollars of MI gear under AR 710-2 / AR 735-5 property accountability.

• 01Administer the SCIF's Active Directory at the delegated OU level — user, group, GPO, account hygiene — without taking a domain-admin shortcut the audit will catch.
• 02Run a SCCM / Tanium / WSUS patch deployment cycle on the MI enclave on a published schedule with reporting back to the senior maintainer and the brigade S6 / S2 OIC.
• 03Drive DCGS-A at the integrator level — service start / stop, log scrape, query-tier vs ingest-tier troubleshooting, escalation to the vendor field-service rep with a clean repro and timeline.
• 04Stand up the tactical MI fit on a Prophet Enhanced platform or BCT SIGINT extension — antenna, receiver, processor, network bridge to JWICS / NSANet — to the unit's Mission Essential Task List standard.
• 05Drive cross-domain hygiene — NIPR, SIPR, JWICS, NSANet — without spillage. One spillage rolls up to Army CI and the SSO closes terminals for a week.
• 06Run COMSEC at the user / sub-account level — EKMS / KMI key load, the LCMS / DTD workflow, the destruction line — to AR 380-40 standard.

• —AR 25-2 — Army Cybersecurity (own it, do not just refer to it).
• —AR 380-5 — Information Security; AR 380-40 — COMSEC; AR 380-67 — Personnel Security Program.
• —AR 381-10 — US Army Intelligence Activities; AR 381-12 — TARP; DoDD 5240.01 — DoD Intelligence Activities; EO 12333.
• —ICD 503 — IC IT Systems Security Risk Management; ICD 705 — SCIF Accreditation Standards.
• —DoDM 8140 — Cyberspace Workforce Qualification; DoDM 5105.21 — SCI Administrative Security Manual (the day-to-day plumbing inside the SCIF).
• —DISA STIGs you actually administer (Windows, Server, AD, Cisco IOS, Red Hat); NIST SP 800-53 / 800-171 — the controls every Army cyber program inherits.

• —JQR / OJT signoff on at least one work-role current; second work-role under JQR.
• —IAT-II baseline maintained (Security+ CE typical); IAT-III in motion if the billet requires it (CCNP-Security, CASP+, or CISSP on the DoDM 8140 list).
• —BLC graduate; promotion points stacked through vendor certs (Network+, CCNA, AZ-104 / RHCSA depending on the platform mix), Foundry seats, college credit, and correspondence.
• —ACFT 540+ floor — the brigade S2 SGM reads the slide and the MI enclave does not get to skip the test.
• —Zero CAT-1 STIG findings on systems you personally administer during the next CCRI / CORA / cyber inspection.

• —Using a shared admin account on a domain controller or a DCGS-A server. Every action is logged; ownership-by-shared-account ends careers and pulls IAT credentials.
• —Patching outside an approved maintenance window. You will brick the brigade's analytic line in the middle of a live BUB and the warrant will be on the phone with the vendor before you finish the rollback.
• —Letting an IAT-II / IAT-III credential lapse. DoDM 8140 audit pulls you off the position the day it expires; the team is short a maintainer until you re-test.
• —Telling a senior analyst "I cannot do that" without offering the workaround or the escalation. Always have the next step ready — the next echelon up reads the ticket.
• —Bypassing the change-management board because "it is just a quick fix" in the SCIF. The S2 audit catches it; the IG catches what the S2 misses; the SSO closes the loop.

The good Specialist 35T is the maintainer the senior NCO trusts with the DCGS-A node and the brigade CG's SCIF VTC in the same week, because both come back working and the SGM does not have to ask twice. He has CCNA in motion, an IAT-III voucher on the desk, a 35Q reclass packet in his folder if he wants the cyber-operator path, and the contractor sitting across the SCIF has already asked when his ETS window opens.

You are an NCO now and a qualified maintainer with a vote on the floor. The privates do their counselings off your statements; the SSG NCOIC briefs the BN CDR off uptime numbers and inspection deltas you signed for.

You own a 3-5 soldier maintainer section — the DCGS-A administration cell, a tactical SIGINT vehicle team, the SCIF networking and storage line, the COMSEC account, or the Prophet / Trojan maintenance bay. You write the OPORD annex for MI systems on a field problem. You sign for the SCIF's server racks, the COMSEC inventory, and the tactical MI fit under property accountability. You sit at the BUB when the analytic line is broken and the CO needs a system-health read; you go to the brigade S6 / S2 working group when the senior maintainer or the warrant cannot. You will also still be at the keyboard pulling logs — the moment you stop maintaining the iron is the moment the analysts stop trusting your read on it.

• 01Lead a maintainer section through an MI systems site survey, install, validate, and sustain cycle for a tactical SIGINT or DCGS-A package — to the unit MET standard.
• 02Run an IAVA / IAV closure cycle on the MI enclave inside the published timeline — track, patch, validate, report — and defend the residual risk to the warrant and the S2 OIC.
• 03Conduct a real change-management board on an MI network — risk, rollback, validation, sign-off — without the senior maintainer rewriting your package.
• 04Run the COMSEC account at the section level under AR 380-40 — EKMS / KMI key handling, LCMS log discipline, destruction line, semi-annual inventory inspection-ready.
• 05Onboard a new specialist or PFC and have them productive on the maintenance floor in two weeks — STIG familiarity, JQR pipeline, ticket discipline, SCIF discipline.
• 06Write an incident-response report to ARCYBER / brigade S2 standard — timeline, indicators, containment, eradication, recovery, lessons learned — and brief it without flinching.

• —AR 25-1 — Army IT; AR 25-2 — Army Cybersecurity; AR 380-5 — Information Security; AR 380-40 — COMSEC.
• —AR 381-10 — US Army Intelligence Activities; AR 381-12 — TARP; DoDD 5240.01 — DoD Intelligence Activities.
• —ICD 503 — IC IT Risk Management; ICD 705 — SCIF Accreditation; ICD 203 — Analytic Standards (you support the analysts who live by it).
• —DoDM 8140 — Cyberspace Workforce Qualification (the IAT chart you sign your soldiers off against).
• —NIST SP 800-53 / 800-61 — Security Controls and Incident Handling (the IR playbook the Army quietly maps to).
• —AR 623-3 — Evaluation Reporting; AR 600-8-19 — Enlisted Promotions (you write NCOERs now); TC 7-22.7 — NCO Guide.

• —IAT-II maintained, IAT-III in hand or in motion depending on the billet (CCNP-Security, CASP+, or CISSP on the DoDM 8140 list).
• —BLC graduate; ALC slot built and ready when the schedule drops.
• —Section IAVA closure at or above 95% inside the prescribed window; zero CAT-1 unresolved past the deadline.
• —NCOER bullets in action-result-impact format — patch compliance %, ticket throughput, JQR pipeline velocity, no "demonstrated outstanding performance" filler.
• —ACFT 560+ as a floor — the MI guys do not get to skip the test and the SCIF gets a reputation fast.

• —Letting a junior maintainer act as IAT-II / IAT-III when they are not currently certified. The DoDM 8140 audit catches it and the failure is on you.
• —Counseling soldiers verbally. If the SPC's credential lapse or property-accountability slip is not in writing, the senior rater cannot defend you and the SSG NCOIC cannot help you.
• —Bypassing the brigade S2 / SSO on a CI / TARP / insider-threat indicator. AR 381-12 is not optional; the SSO will hear it from someone else first if not from you.
• —Accepting a verbal change request from a senior officer in the SCIF without ticketing it. The change blows up at 0200 and there is no paper.
• —Loaning MI gear without a sub-hand receipt. Property accountability on MI-specific kit is the line the Army does not let any NCO cross twice.

The good SGT 35T runs a section the brigade S2 OIC names without thinking — DCGS-A uptime green, IAVA green, COMSEC clean, no surprises in the BUB, soldiers stacking Sec+, CCNA, and the 35Q / 350F packets if they want them. The senior warrant on the team fights for him on the slate; the contractor on rotation already has a phone call lined up for the day he files for ETS.

You are the senior MI systems NCO in your shop. The S2 captain runs the staff and the warrant runs the technical lane; you run the maintainers and the daily ground truth of the iron.

You manage a 10-15 soldier MI systems shop — a DCGS-A administration platoon, a BCT MICO maintenance section, a Prophet / Trojan maintenance bay, or a SCIF infrastructure cell at a named MI brigade (780th at Fort Eisenhower, 706th MI Group at Fort Meade, 470th at JBSA-Fort Sam Houston, 500th at Schofield, 501st in Korea, 66th at Wiesbaden, INSCOM HQ at Fort Belvoir). You write the brigade MI-systems input to the QTB. You sit on the brigade IA governance board with the S2 and S6 OICs. You build the next two section sergeants into the SSG slate. You will brief brigade-level cyber and system-readiness posture to an O-6 at least once a quarter, and you will defend the residual-risk line to a colonel who wants the analytic line up tonight regardless of what the patch cycle says. The contractor on rotation is now asking for your card.

• 01Run a brigade-level MI network architecture conversation — VLAN scheme, IP plan, redundancy, growth roadmap across NIPR / SIPR / JWICS / NSANet — without hiding behind the warrant or the S6 OIC.
• 02Defend a cybersecurity finding at the brigade CCRI / CORA / IG inspection — own the gap, present the closure plan, hit the milestone, document the residual risk for the warrant to sign.
• 03Build a six-month training plan that produces one CCNP-grade or CISSP-grade NCO and two Security+ / CCNA-grade specialists on the MI enclave.
• 04Operate as the senior MI systems NCO on a CTC rotation — JRTC, NTC, JMRC — through the entire force-on-force without losing the analytic line, the COMSEC, or the SIGINT collection picture.
• 05Translate MI-system risk to a non-technical CO / CSM in language they will repeat without rewording — "the analytic line is up but the redundancy is down" instead of vendor jargon.
• 06Mentor your section sergeants on NCOER writing, ALC / SLC board prep, and the warrant officer (255A / 255N / 255S / 352-series) and 35Z senior-MI-NCO conversation honestly.

• —NIST SP 800-53 / 800-171 — the controls every Army cyber and MI program inherits.
• —DoD CIO RMF — Risk Management Framework workflow (every ATO you support runs through it).
• —ICD 503 — IC IT Risk Management; ICD 705 — SCIF Accreditation; ICD 203 — Analytic Standards.
• —AR 25-1 — Army IT; AR 25-2 — Cybersecurity; AR 380-5 — Information Security; AR 380-40 — COMSEC; AR 380-67 — Personnel Security.
• —AR 381-10 — US Army Intelligence Activities; AR 381-12 — TARP; DoDD 5240.01 — DoD Intelligence Activities; DoDM 5105.21 — SCI Admin Security Manual.
• —DoDM 8140 — Cyberspace Workforce Qualification; IT Service Management — ITIL 4 Managing Professional track for the command-track NCO.

• —SLC graduate; MLC packet built; consider the Cyber Center of Excellence senior-NCO offerings at Fort Eisenhower as the differentiator.
• —CCNP-Security or CCNP-Enterprise; CISSP if you are tracking toward warrant officer space or the contractor / GS-civilian market.
• —Section IAVA compliance over the last 4 quarters at or above 98%; zero CAT-1 unresolved past the window; SCIF ICD 705 accreditation defensible.
• —NCOER profile defensible at brigade — Top Block / Most Qualified rate matching the actual delta in soldiers selected.
• —ACFT 540+ minimum at this rank; brigade MI senior NCO's fitness is on the brigade slide and the BCT CO reads it.

• —Confusing tactical-network expertise with garrison-enclave expertise. The brigade needs both; the warrant needs you to be honest about which one you currently are.
• —Skipping the RMF / ATO / cATO conversation because "that is the GS-13 ISSM's job." Your soldiers fail the next inspection if you do not own the bridge.
• —Treating the SHARP / EO / climate piece as someone else's problem. Senior MI NCOs lose careers over command-climate findings as fast as any other MOS — closed-access workforces are not exempt.
• —Letting one section sergeant carry the shop because he is "your guy." The other two SGTs notice, brigade S2 SGM notices, and the NCOER profile shows it.
• —Bypassing the warrant officer track conversation if the talent is there. The 255A / 352-series MI technician path is one of the highest-impact technical careers in the Army; mentor it like it is.

The good SSG 35T runs the shop the BCT CO names in the slide as "MI systems is solid." He turns out two CCNA / Sec+ NCOs per cycle, his cyber-inspection findings are closed before the brigade IG asks, the COMSEC inventory clears without a finding, and he has a 255A or 352-series MI warrant packet on the table when the company senior signal / MI officer asks if he is interested.

You are the senior MI systems NCO in a battalion or the SNCO on a brigade S2 / MI BDE staff. The captain and major above you brief; the warrant runs the deep technical lane; you make sure the slide is true and the iron behind the slide actually works.

You sit at battalion or brigade staff inside an MI brigade, a BCT MICO, or a theater intel brigade — 780th MI BDE at Fort Eisenhower, 706th MI Group at Fort Meade alongside NSA / CSS infrastructure, 470th at JBSA-Fort Sam Houston, 500th at Schofield, 501st in Korea, 66th at Wiesbaden, or INSCOM HQ at Fort Belvoir. You build the unit's MI-system readiness picture for the CCRI / CORA / IG cycle. You write four-to-five NCOERs per period that will pick the next batch of SSGs and SFCs across the brigade. At this rank the 35-series 35Z (Career Management Field 35 senior NCO) conversion conversation is live — verify the current HRC eligibility rules with your career manager, but it is the path many senior 35Ts take into broader MI senior-NCO leadership. You mentor warrant officer candidates (255-series and 352-series MI technicians) and run the brigade's 35Q reclass screening conversation. You walk the line during exercises and you are at the BCT-level MI stand-up briefing every week.

• 01Defend a Command Cyber Readiness Inspection (CCRI / CORA) at the brigade level for the MI enclave — months of preparation, zero CAT-1, defensible CAT-2/3, and a closure plan the next inspector will accept.
• 02Own a brigade tactical / garrison hybrid MI network end-to-end — NIPR, SIPR, JWICS, NSANet extensions — with a 6-month roadmap and a vendor lifecycle plan.
• 03Mentor a warrant officer (255A / 255N / 255S / 352-series) candidate through their packet and selection board.
• 04Operate as the senior MI systems NCO on a JTF / division staff or a forward-deployed brigade MI element supporting collection and analysis.
• 05Build a unit-level cyber and MI-systems training program that produces certified IAT-II/III soldiers at a rate matching brigade demand.
• 06Run brigade-level incident response when the MI enclave is contested — alongside ARCYBER teams and the brigade SSO if it escalates.

• —DoDI 8500.01 — Cybersecurity; DoDI 8510.01 — RMF for DoD IT.
• —NIST SP 800-37 — Risk Management Framework; 800-53 — Controls; 800-171 — CUI in Nonfederal Systems.
• —ICD 503 — IC IT Risk Management; ICD 705 — SCIF Accreditation; ICD 203 — Analytic Standards.
• —DoDM 8140 — Cyberspace Workforce Qualification (you are auditing the brigade against it); DoDM 5105.21 — SCI Admin Security Manual.
• —AR 25-1 / AR 25-2; AR 380-5 / AR 380-40 / AR 380-67; AR 381-10 / AR 381-12; DoDD 5240.01; EO 12333.
• —INSCOM, ARCYBER, and CIO/G-6 published FRAGOs and ALARACTs; Cyber Center of Excellence and U.S. Army Intelligence Center of Excellence senior-leader publications.

• —MLC graduate; consider the U.S. Army Sergeants Major Academy fellowship if SGM-track.
• —IAT-III (CCNP-Security, CASP+, or CISSP) maintained, with vendor or platform credentials where they apply.
• —Brigade-level CCRI / CORA inspection passed with no CAT-1 findings during your tenure as senior MI systems NCO; SCIF ICD 705 accreditation defensible at the next echelon up.
• —Warrant officer (255 / 352-series) packet pipeline producing at least one selected candidate per year out of your unit.
• —ACFT pass at this rank; brigade senior staff fitness is on the slide and the BCT CO reads it.
• —Pull the current HRC SELCONT message and the latest 35Z / 35-series MILPER before committing a soldier to the conversion path — eligibility windows and PME prerequisites move.

• —Hiding a CAT-1 finding from the brigade S2 / S6 OIC or the warrant to "fix it before the report." It will surface and the relief is at brigade level.
• —Letting your subordinate SSGs run the IAVA / ATO cycle without your sign-off. You sign the unit status; you own the failure.
• —Confusing operational MI-system maintenance with cyber-defense expertise. The brigade needs both; senior NCOs who fake the second are exposed the first time ARCYBER walks in.
• —Skipping the SHARP / EO / climate piece. Senior MI NCOs are not exempt from command-climate accountability — closed-access workforces draw harder scrutiny, not less.
• —Talking the warrant officer track up to soldiers without warning them honestly that the 255-series and 352-series school selection rate runs competitively — pull the current HRC SELCONT before you promise outcomes.

The good SFC 35T is the senior MI systems NCO the brigade S2 OIC, the senior MI warrant, and the BCT CO trust to walk into a contested-network exercise and come out with DCGS-A up, the patches done, the COMSEC clean, and the senior soldiers trained. He runs the warrant officer pipeline for the brigade; his NCOERs pick the next SSG-board slate; he is on the short list for First Sergeant of an MI company or HHC, and he has the 35Z conversion conversation with his career manager already on the calendar.

You are the senior enlisted MI-systems voice on a brigade, theater intel brigade, INSCOM, or higher staff — or the 1SG of an MI company. The BCT CDR or the INSCOM CG names you in the slide.

As 1SG you run an MI company or HHC — 90-130 maintainers, analysts, collectors, and signals soldiers, a complex MI equipment footprint (DCGS-A nodes, Trojan, Prophet Enhanced, tactical SIGINT vehicles, the SCIF infrastructure), the orderly room, the supply room, the property accountability, and the readiness reporting. As SGM/CSM on a brigade, theater intel brigade, INSCOM, 706th MI Group at Fort Meade alongside NSA / CSS infrastructure, or 780th MI BDE at Fort Eisenhower (renamed from Fort Gordon in 2023), you set the standard for the enlisted MI-systems workforce at scale — credentialing, accession pipelines into 255-series and 352-series warrant officer tracks, the 35Z conversion conversation for the senior 35-series NCO bench, retention, and the command climate inside a closed-access workforce. You sit in the MI / cyber strategy conversation alongside O-5s and O-6s; you advise on enlisted talent slate at echelons above brigade.

• 01Run a senior-enlisted command climate in an MI company / brigade signal cell that produces certified IAT-II/III soldiers and warrant officer accessions at rates above the MI force average.
• 02Mentor a warrant officer slate (255A / 255N / 255S / 352-series / 170A as applicable) at the brigade or higher staff level.
• 03Brief the BCT / Division / INSCOM CG on enlisted MI-systems readiness in language the CG can defend at the next higher echelon.
• 04Run a SCIF accreditation cycle (ICD 705) and an IC IT compliance cycle (ICD 503) end-to-end without senior-NCO-attributable CAT-1 findings.
• 05Translate the Army Intelligence Enterprise / INSCOM / ARCYBER strategy into enlisted-talent decisions at the unit — slots, schools, assignments, retention bonuses, the 35Z conversion bench.
• 06Walk the line during a brigade or MI-brigade inspection and identify the broken systems before the surveyor does (IG, ARCYBER, INSCOM cyber inspection team, vendor field engineer).

• —AR 600-20 — Army Command Policy; AR 27-10 — Military Justice (you are in the room).
• —AR 381-10 — US Army Intelligence Activities; AR 381-12 — TARP; AR 380-5 — Information Security; AR 380-40 — COMSEC; AR 380-67 — Personnel Security; AR 25-2 — Cybersecurity.
• —ICD 503 — IC IT Risk Management; ICD 705 — SCIF Accreditation; ICD 203 — Analytic Standards (you teach these now).
• —DoDM 8140 — Cyberspace Workforce Qualification (you are accountable at the unit-roll-up level); DoDM 5105.21 — SCI Administrative Security Manual; DoDD 5240.01 — DoD Intelligence Activities; EO 12333.
• —The 1SG Course / USASMA / SGM-A reading list — you are now expected to teach doctrine and translate strategy down.
• —INSCOM, ARCYBER, NSA / CSS, and CIO/G-6 published FRAGOs / ALARACTs; CCRI / CORA and DoD CMRS dashboards — the readiness instruments the senior staff watches.

• —USASMA / SGM-A completion before competing for command CSM slate.
• —Brigade-level CCRI / CORA pass without senior-NCO-attributable CAT-1 findings during your tenure; SCIF ICD 705 accreditation defensible at division and INSCOM level.
• —Warrant officer (255-series / 352-series) accession pipeline producing 1+ selected per year from your unit.
• —NCOER profile that the senior rater can defend at brigade, division, and INSCOM-equivalent staff — your rated NCOs are picking up 1SG / SGM chevrons on schedule.
• —Zero senior-NCO-level integrity, financial, fraternization, OPSEC, COMSEC, or CI incidents. One ends the career permanently — and at this rank, in this MOS, also threatens the clearance of everyone you mentored.

• —Pretending to be the senior technical voice on a topic you are out of date on. Senior MI NCOs lose authority by faking depth — the warrants and the GS-13 ISSMs will catch you the first week.
• —Letting a 1SG-led company drift on SCIF accreditation, COMSEC inventory, or DoDM 8140 credentialing because "the SSO or the warrant will catch it." You own it; they are your partners, not your replacements.
• —Treating the 255-series / 352-series / 35Z conversion conversation as transactional. The careers you mentor at this rank build the MI-systems bench for the next decade.
• —Going public with disagreement over a CO's cyber-risk call or a J2's collection decision. Take it in the office. Walk out aligned, or push back in writing through the right echelon.
• —Confusing seniority with current relevance. The MI-systems field moves fast — the SPC sitting at the DCGS-A console today is closer to the truth than the CSM who has not touched a keyboard in three years. Build the bench; do not block it.

The good MI-systems CSM / 1SG / SGM is the senior NCO the brigade, theater intel brigade, INSCOM, or division CG name without thinking. His MI company is the one the BCT pulls forward for the contested rotation. His enlisted talent slate is the one HRC and INSCOM quote in policy memos. His warrant officer accession rate is in the upper third of the MI community; his rated NCOs are picking up first sergeant chevrons on schedule. When ETS comes, the cleared-contractor market — Booz, Leidos, SAIC, CACI, MITRE, Accenture Federal, ManTech — and the NSA / DIA / CIA / FBI / DHS civilian side are competing for him before the DD-214 prints, and he has been honest with his soldiers about that compensation reality the entire way up.