Cyber Mission Specialist

You are the newest person in one of the Coast Guard's newest ratings. The rating is still building its own playbook, and the non-rate who figures that out early and runs toward it — rather than waiting for someone to hand them a checklist — is the one the CMS2 wants working next to them.

You came out of TRACEN Cape May after eight weeks and reported to CGCYBER (Coast Guard Cyber Command) or a District cyber protection team as a non-rated Coastie striking for CMS. The CMS rating is young — established around 2023 — which means the A-school pipeline, the PQS, and the standard watchstander progression are still being codified as you walk into them. Your day-to-day at this stage is the groundwork: learning the unit's network architecture, assisting CMS3s and CMS2s on vulnerability scanning runs, sitting in on cyber incident logs and cyber protection team (CPT) missions under close supervision, and completing whatever DoD 8140/8570-aligned coursework your chain of command puts in front of you as prerequisite to formal designation. You also stand the duty section watches the unit assigns — unlike shore-based technical ratings, CGCYBER and its subordinate teams have their own watch rotation and the non-rate fills the gaps. In garrison you are the striker who shows up early, keeps the workspace squared, reads the unit's current operational directives, and asks the right questions in the debrief instead of the wrong ones during the mission.

• 01Complete required DoD 8570.01-M / DoD 8140.01 baseline certification coursework at the IAT Level I baseline — CompTIA Security+ or equivalent — per your unit's direction and the current ALCGPSC advancement message for CMS.
• 02Assist on basic network monitoring tasks under direct supervision — reading a SIEM alert queue, identifying anomalous traffic signatures on a packet capture, and escalating correctly to the CMS2 without improvising.
• 03Maintain information security hygiene on every system you are authorized to touch — password management, CAC authentication, classified system handling under the unit's OPSEC plan, and the physical security rules for classified spaces.
• 04Complete the CMS Rating Performance Qualification Standard (PQS) task items available at your paygrade — verify the current PQS against the Coast Guard Institute; the rating's qual book is one of the newer ones and it is worth reading end to end on day one.
• 05Write legible, accurate log entries for every watchstanding shift — time, event, action taken, disposition — because the CMS chain of command and CGCYBER leadership read incident logs and the non-rate whose entries are unreadable is the non-rate who does not get designation.
• 06Demonstrate physical workspace and device security habits: locking workstations when unattended, not discussing operational details outside of authorized spaces, and treating every removable media item as a potential security event until proven otherwise.

• —DoDD 8140.01 — Cyberspace Workforce Management (the DoD directive governing the credentialing and qualification framework the CMS rating trains inside; verify the current edition on the DoD Issuances website).
• —DoD 8570.01-M — Information Assurance Workforce Improvement Program (the implementing manual for baseline certifications by IA role category; verify the current edition — DoD 8140 supersedes portions but 8570.01-M baseline cert tables remain operationally referenced).
• —COMDTINST M1000-series — Coast Guard Personnel Manual (the umbrella for leave, liberty, advancement, conduct, and everything on you as a member).
• —COMDTINST M1020.8 (current revision) — Coast Guard Weight and Body Fat Standards.
• —NIST SP 800-53 (Security and Privacy Controls for Information Systems) — the control framework your unit's network defense operations reference; read the overview before you ever touch a system scan.
• —Unit Standard Operating Procedures and Classified Systems Security Guides — read the unit's OPSEC plan, the communications security brief, and the watch standing instructions the first week. Ask for them; they exist.

• —CMS A-school designation and a class date (verify current course location, length, and prerequisites via the Coast Guard Institute and the most recent ALCGPSC advancement message for the CMS rating).
• —DoD 8570.01-M / DoD 8140.01 IAT Level I baseline certification (CompTIA Security+ or equivalent) completed or in progress per your unit's direction — this is the floor credential for the rating.
• —Coast Guard physical fitness assessment passed every cycle per the current personnel manual standards; weight and body composition compliant with COMDTINST M1020.8.
• —CMS PQS lines signed consistently — the supervisors who write your EER blocks check the qual book first, and the rating is small enough that a thin qual book is visible to CGCYBER leadership.
• —Zero security violations — classified handling, workstation lockout, removable media, physical access — because one incident report at this paygrade is a designation denial and a conversation with the CGCYBER command.

• —Treating a SIEM alert as low-priority because it looks like the same alert you saw dismissed yesterday. False positive fatigue is real in cyber; the day you stop reading the alert is the day the alert is not a false positive.
• —Sharing anything about the unit's operational posture, network configuration, or active missions outside of authorized channels — including to family or in private messages. CGCYBER OPSEC is not a suggestion and the classification review is not a formality.
• —Letting your baseline certification lapse or not starting it at all because nobody handed you a study plan. The DoD 8570/8140 baseline cert is on you to pursue; the CMS2 who passed you for designation was not waiting for someone to schedule their exam.
• —Logging a watch event from memory at end of shift instead of in real time. Cyber incident logs are not a diary — they are operational records, and the time-of-detection gap the CGCYBER commander asks about in the post-incident review starts with the entry you did not make when the alert fired.
• —Plugging a personally owned device or uncleared media into any government system in the unit, even to charge a phone. The classified lab is not a phone charging station, and the security violation report is generated automatically.

The good CMS striker is the non-rate the CMS2 invites into the working session even when there is no PQS credit to sign because the kid asks the right question after the event, not during it, and their log entries are clean the first time. By the time the A-school designation posts, the Security+ is done or scheduled, the PQS is ahead of the class date, and the CGCYBER watch supervisor has already written the EER block.

You are a rated cyber petty officer in a rating young enough that you will help write the norms the next generation trains on. The crow says you completed the schoolhouse — the job is figuring out what that means for a rating that is still becoming.

You came back from the CMS A-school pipeline with the rating badge sewn on and reported to CGCYBER or a subordinate cyber protection team as a working CMS3. You stand network watch, assist on vulnerability assessments and penetration testing events under CMS2 or CMS1 supervision, support incident response actions, and write up your portion of the cyber event logs the watch chain reviews. Because the CMS rating is young, the CMS3 at many units is doing work that in older ratings would sit a paygrade higher — and the flip side is that the standards, advancement messages, and career norms you are operating under are being refined in real time. The Servicewide Exam for CMS2 is now a real calendar item. Your DoD 8140/8570 baseline certification is current or ahead; intermediate certifications — CompTIA CySA+, CEH, or equivalent at the IAT Level II baseline — are the next credential tier and they have a direct line to your SWE score and your EER block. You also supervise non-rates and strikers on watch-floor tasks and you sign the first round of training records on the personnel below you.

• 01Stand a network defense watch at a CGCYBER-subordinate facility — monitor SIEM dashboards, work the alert queue to disposition, escalate confirmed indicators of compromise (IOCs) to the watch supervisor in the correct format and at the correct priority without delay.
• 02Conduct a basic vulnerability scan on a target system using unit-authorized tooling under CMS1 or CMS2 supervision — run the scan, parse the output, document findings in the report format the watch supervisor specifies, and not improvise on scope or authority.
• 03Write a defensible cyber incident log entry — event time (UTC), system affected, indicator description, action taken, and disposition — that the CGCYBER incident response team can use as a primary source record.
• 04Apply the NIST SP 800-53 control framework at the conceptual level — explain to a non-rate why a specific control applies to an event you just worked, and name the control family correctly.
• 05Complete DoD 8140.01 intermediate certification coursework at IAT Level II (CompTIA CySA+, CEH, or equivalent) per the current ALCGPSC advancement message and your chain of command's direction.
• 06Train the non-rates and strikers below you on watch-floor procedures, classification handling, and the PQS items the CMS2 wants signed.

• —DoDD 8140.01 and DoD 8570.01-M — the credentialing framework the rating trains inside; the CMS3 working toward IAT Level II baseline certs is working against these standards.
• —NIST SP 800-53 (current revision) — Security and Privacy Controls; the control families (AC, AU, SI, IR, etc.) are the vocabulary the watch floor operates in and the CGCYBER leadership tests you on.
• —NIST SP 800-61 (Computer Security Incident Handling Guide) — the federal incident response framework CGCYBER's procedures reference; read it cover to cover before you stand your first unescorted incident response watch.
• —COMDTINST M1000-series — Personnel Manual sections on advancement, EER, and the Servicewide Exam process for CMS2.
• —Coast Guard Rating Knowledge for CMS (the rating-specific bibliography for the Servicewide Exam) — pull the current list from the Coast Guard Institute; the bibliography is one of the newer ones and worth reading completely rather than skimming.
• —CGCYBER Standing Operating Procedures (SOP) and classification guides for assigned watch positions — your chain of command is the source; read and ask questions until the procedures make sense before you stand the watch unsupervised.

• —DoD 8570.01-M IAT Level II baseline certification (CompTIA CySA+, CEH, or equivalent) complete or in progress per the current ALCGPSC advancement message and unit direction.
• —Qualified watch stander on at least the primary network defense or incident monitoring watch position at your unit; secondary qualifications in motion.
• —Coast Guard PFT passed every cycle; weight and body composition compliant with COMDTINST M1020.8.
• —Servicewide Exam preparation in motion — bibliography pulled, study schedule built, rate training manual chapters worked. Pull the current ALCGENL for the CMS SWE schedule; the rating is new enough that the SWE cycle may be updated more often than legacy ratings.
• —EER blocks clean and trending up; zero security violations since designation.

• —Closing a SIEM alert as false positive without documenting your analysis. The incident review that happens after the confirmed intrusion everyone missed asks why Alert #4,712 was closed with no notes — and your name is on the disposition.
• —Running a vulnerability scan outside the authorized scope on the assumption that "more is better." Unauthorized scanning of systems outside the tasking order is a reportable event and a security violation, not a demonstration of initiative.
• —Skipping the SWE study cycle because "the rating is new and the cutoff is probably low." The CMS community is small enough that a missed advancement cycle is immediately visible to CGCYBER leadership and to the chain of command that writes your EER.
• —Treating incident log entries as housekeeping after the fact. In cyber operations, time-of-detection accuracy is a primary metric that commands and DHS oversight both measure — log in real time or do not log at all.
• —Discussing specific CGCYBER operations, target network details, or assessment findings with anyone not explicitly read-in and authorized. The classification level on that briefing slide is not a suggestion.

The good CMS3 is the petty officer the watch supervisor leaves on the console during an active incident because the alert queue is being worked in order, the log entries have enough detail that an analyst coming on watch at the next shift can pick up without a five-minute verbal brief, and the CMS3 knows exactly when to escalate and exactly when to work the problem. His non-rates are ahead on PQS, his IAT Level II cert is done or scheduled, and the SWE bibliography is on the desk, not on a list of things to deal with later.

You are the working cyber tech and the watch-floor backbone. The CMS3s learn this job by watching you run it — and in a young rating, the standard you set now is the standard the rating carries.

You are typically the senior cyber watchstander or the lead analyst on a cyber protection team (CPT) mission at CGCYBER or a subordinate unit. You stand watch as a senior incident monitor or as a CPT mission operator under a CMS1 or officer supervisor, and you own a slice of the watch section's technical training program — running tabletops, signing PQS items for CMS3s and non-rates, and writing the first round of EER inputs on the personnel below you. Your DoD 8140/8570 certifications are current at IAT Level II and you are moving toward IAT Level III (CASP+, CISSP, or equivalent) or toward a compute-based specialty certification (GPEN, CEH-Master, or equivalent) depending on your unit's mission focus. You run vulnerability assessments, support penetration testing operations, and execute incident response under the CMS1 or watch officer's authority. You also start the Servicewide Exam for CMS1 in earnest — and you have a genuine conversation with your chain of command about which C-school assignments, cross-tours to DHS CISA or NSA-adjacent billets, or joint cyber assignments put your record in front of the chief board competitively.

• 01Lead a network defense watch section as the senior petty officer — manage the alert queue, direct CMS3s on first-level dispositions, escalate confirmed IOCs and incidents to the watch officer in the correct format, and produce the end-of-watch summary the incoming section needs to take over without a verbal debrief.
• 02Execute a CPT assessment mission task — host-based forensics, network traffic analysis, or vulnerability identification — under the team lead's direction, document findings to CGCYBER report standards, and brief results to a non-technical watch officer without losing accuracy.
• 03Apply NIST SP 800-61 incident response phases operationally — preparation, detection/analysis, containment, eradication, recovery, post-incident activity — and identify where the current event sits in the cycle without the CMS1 having to narrate it.
• 04Write defensible EER inputs on the CMS3s below you — observable behavior, measurable output, no inflation — because the standard you set on CMS3 EERs is the standard the CMS1 applies to yours.
• 05Study the DoD 8140 IAT Level III certification baseline (CASP+, CISSP, or equivalent) — verify which cert your chain of command and the current ALCGPSC advancement message specify as competitive for CMS1 SWE.
• 06Run a section-level tabletop exercise — scenario development, facilitation, hot wash — and write the after-action with findings specific enough that the watch officer can brief them to the CGCYBER command.

• —DoDD 8140.01 and DoD 8570.01-M — you are working toward IAT Level III or a specialty-area credential; verify the current cert tables and approved cert lists against the DoD CIO published updates.
• —NIST SP 800-61 (Computer Security Incident Handling Guide) — the framework your incident response watch operations are built from; at CMS2 you apply it, not just recognize it.
• —NIST SP 800-115 (Technical Guide to Information Security Testing and Assessment) — the federal reference for vulnerability assessment and penetration testing methodology your CPT work builds on.
• —COMDTINST M1000-series — Personnel Manual sections on advancement, EER, and the Servicewide Exam process for CMS1.
• —CIM 1610-series — Enlisted Employee Review (EER). You write inputs now; understand how the mark and the supervisor narrative drive the SWE final multiple.
• —DHS CISA published advisories and the current CGCYBER threat intelligence briefs — the operational context that makes the NIST framework a real-world tool rather than a checklist.

• —DoD 8570.01-M IAT Level II baseline current; IAT Level III or specialty cert (CISSP, CASP+, GPEN, or equivalent) in progress per the current ALCGPSC advancement message — verify what the rating specifies as competitive, not what looks impressive on a LinkedIn profile.
• —Qualified watch supervisor on at least the primary network defense or CPT support watch position; ability to manage the watch section without a CMS1 in the room on routine shifts.
• —EER marks at or near the unit average; SWE preparation in motion with a bibliography-driven study plan. Pull the current ALCGENL / CGPSC promotion message for the CMS SWE cutoff.
• —PFT passed; body composition compliant; zero security violations on your watch — in a small, young rating, one incident at this paygrade defines the record.
• —ICS-200 (Basic ICS) certificate current — cyber incident response at the Sector and DHS level runs on ICS frameworks, and the CMS2 who cannot speak ICS is a liability at a multi-agency incident.

• —Treating a CPT assessment finding as preliminary and not documenting it fully because "we'll write it up in the final report." The final report is built from your contemporaneous notes; the details you did not write down the day of the assessment are the details that are wrong in the final brief.
• —Making a containment or eradication call during an active incident without notifying the watch officer. In cyber operations, uncoordinated containment can destroy forensic evidence, alert the adversary, and create a system availability incident on top of the security incident. The watch officer holds the authority.
• —Letting EER inputs for the CMS3s below you slip to generic. The rating is young and the chief board will look hard at the enlisted evaluation record to determine whether the CMS community produces real leaders or just cert-holders. Your EER bullets are part of the answer.
• —Running the SWE study cycle from a certification prep book rather than the actual CMS rating bibliography from the Coast Guard Institute. They overlap but they are not the same; the SWE pulls from the rating knowledge, not from the certification knowledge.
• —Assuming that because CGCYBER's mission is classified, the normal community-manager and advancement processes are somehow different or more flexible. The SWE, the EER, and the chief board process run the same way they do for OS and BM.

The good CMS2 is the watch petty officer the watch officer leaves running the incident during the handoff brief because the case log is current, the CMS3s are working the queue without being micromanaged, and the section-level summary at end of watch is clear enough that the incoming supervisor does not have to ask follow-up questions. His IAT Level III cert is done or scheduled, his SWE bibliography is not a list but a plan, and the CMS1 is already talking to the CGCYBER personnel shop about which cross-tour or broadening assignment sets him up for the chief board.

You are the senior technical leader on the watch floor and the de-facto keeper of the rating's professional standards. In a rating this new, what you tolerate and what you enforce is what CMS becomes.

You are typically the watch section lead, the senior analyst on a CPT mission element, or the cyber protection team mission lead at CGCYBER or a subordinate unit. You hold watch authority over CMS2s and CMS3s during active incidents, you sign watch supervisor qualification recommendations to the CMSC, and you write the bulk of the EER inputs for the CMS2s and CMS3s below you. Your DoD 8140 certifications are at or above IAT Level III (CISSP, CASP+, or equivalent); you may also hold a compute-based specialty cert (GPEN, GCIH, or equivalent) depending on your mission focus. You run the section's training program — tabletops, CPT mission rehearsals, technical skill sustainment — and you are the CMSC's primary agent for building the qual program the rating is still institutionalizing. The chief board conversation is real: the EER profile, the awards stack, the leadership C-school, the broadening-assignment plan (DHS CISA liaison, NSA-adjacent cyber joint tour, CGCYBER staff, District cyber advisor), and the CMSC sponsorship conversation are in motion. The CMS rating is small enough that a competitive CMS1 record is visible to the entire CGCYBER command by the time the chief board cycle drops.

• 01Lead a watch section through an active cyber incident — manage the CMS2s and CMS3s on the console, hold the incident timeline, coordinate with the watch officer and CGCYBER leadership in real time, and produce a post-incident timeline that the District and Area staffs can use as a primary source.
• 02Run a CPT mission as mission lead or senior operator — pre-mission planning, task execution, findings documentation, and the technical debrief to the gaining unit and the CGCYBER command without requiring the watch officer to translate.
• 03Build and run the section's cyber skills sustainment program — monthly tabletops, annual CPT rehearsals, certification renewal tracking, and the training-gap brief to the CMSC that names the gap before the operational tempo exposes it.
• 04Mentor two-to-three CMS2s into CMS1-SWE-ready candidates — study plans, EER trajectories, cert roadmaps, and the broadening assignment recommendation that fills the gap on their record.
• 05Sit in the CMSC's and watch officer's planning conversations and push back honestly when a watch staffing plan, a mission tasking, or a classification decision creates risk the chain of command does not see — the CMS1 is the last working-level filter before an operational error becomes an incident.
• 06Run the section's DoD 8140 certification tracking — who is current, who is expiring, who needs to test — and brief the CMSC before the CGCYBER Inspector General or the CGCYBER J3 calls to ask.

• —DoDD 8140.01 and the DoD CIO published approved cert tables — at CMS1 you own the section's certification posture, not just your own.
• —NIST SP 800-61 and NIST SP 800-115 — incident response and penetration testing methodology at the operational authority level; you teach these, you do not just apply them.
• —COMDTINST M1000-series — Personnel Manual sections on advancement, the Servicewide Exam, and the Service-Wide Personnel Board process for E-7 selection.
• —CIM 1610-series — Enlisted Employee Review (EER). You write the bulk of inputs and you read the CMSC's draft of your own EER.
• —DHS CISA Cybersecurity Advisory (CSA) archive and the current CGCYBER threat intelligence products — the operational context that drives your section's detection priorities and your tabletop scenarios.
• —ICS-400 (Advanced ICS for Command and General Staff) — the DHS/FEMA framework that a multi-agency cyber incident at Sector, District, or Area level runs on; a CMS1 who cannot speak ICS at this level is a liability in the incident management structure.

• —DoD 8570.01-M IAT Level III (CISSP, CASP+, or equivalent) current; specialty-area or compute-based cert (GPEN, GCIH, or equivalent) if your mission assignment supports it — verify the current ALCGPSC advancement message for what the rating treats as competitive.
• —Watch supervisor or mission lead qualified on the section's primary watch positions; signed qualification recommendations to the CMSC auditable.
• —CMS1 EER profile at the top of the unit's CMS1 cohort — the chief board reads the trend across multiple commands, not just the most recent period.
• —Service-Wide Personnel Board / CMSC selection competitive — pull the current CGPSC ALCGENL for the CMSC slate cycle. The CMS community is small enough that the slate size and the cycle cadence are unique; verify against the most recent message, not the last BM or OS message you heard about.
• —ICS-400 and NIMS IS-800 current; broadening assignment (DHS CISA liaison, joint cyber tour, CGCYBER staff, District cyber advisor) on the record or planned.

• —Signing a watch supervisor qualification recommendation because the CMS2 knows the right answers in a tabletop but has never managed a real incident under pressure. The first live incident the newly qualified CMS2 handles alone is the one that tests the recommendation you signed.
• —Letting the section's DoD 8140 certification renewals drift because the operational tempo is high. Certification lapses create personnel qualification gaps that appear on the CGCYBER command inspection, and the CMS1 whose section has three expired certs is having a very specific conversation with the CMSC the day it surfaces.
• —Keeping an active incident's worst details from the watch officer because you think you can resolve it before the watch officer needs to know. Cyber incidents at CGCYBER have reporting chains to DHS CISA and the Commandant's cyber staff; the watch officer's brief authority is not optional.
• —Confusing technical seniority with watch authority. The watch officer holds command authority during an active incident; the CMS1 holds technical expertise. Getting those confused during an incident is how a technical recommendation becomes an unauthorized operational decision.
• —Skipping the leadership C-school because "the watch schedule is heavy and cyber work is the real skill." The CMSC slate is composed of records, and the leadership development block is one of them — the same as in OS, BM, and AET.

The good CMS1 is the senior watch leader the watch officer trusts to manage the active incident until the officer's debrief with CGCYBER leadership is done — because the case log is clean, the CMS2s are working without needing direction on every step, and the post-incident timeline will require no rewrite. His CMS2s pin CMS1, his section's certs are current, and the CMSC is already identifying the broadening assignment that makes the chief board case before the next cycle drops.

You are an anchor in a rating that does not yet have many. The CMS community is small, young, and being watched by the rest of the Coast Guard — and the standard you hold on the watch floor and in the Chiefs Mess is the standard the rating either earns or fails to earn.

You are typically the Chief in Charge of a watch section or a CPT at CGCYBER, the senior CMS chief at a subordinate cyber unit, or the senior cyber enlisted presence at a District or Area staff. You went through the Chief Petty Officer Academy (CPOA) at TRACEN Petaluma, CA when your initiation cycle pinned you — the same CPOA as every other chief in the service, and that matters in a rating that is new and technically specialized, because the chiefs' mess is where you become a Coast Guard leader, not just a cyber technician. You write EERs on the CMS1s and CMS2s below you, you advise the CGCYBER or District operations officer and commanding officer on every enlisted cyber-workforce decision, and you sit in the CGCYBER senior enlisted network — currently small enough that every CMSC in the rating knows every other CMSC, and the CGCYBER command master chief knows your name by reputation. You also start senior chief preparation in earnest: the Senior Enlisted Leadership Course (SELC), the broader command-track decisions about which billet sets up the CMSCS slate competitively, and the 36-48 month post-Coast Guard credential conversation — the CMS senior enlisted who plan the transition in advance are the ones who land in DHS/CISA civilian cyber roles, NSA/CYBERCOM contractor support billets, or federal law enforcement cyber programs.

• 01Run the watch section or CPT program as the senior CMS — watch supervisor qual program, DoD 8140 certification currency, incident log integrity, operational security posture, and the senior-enlisted interface with the CGCYBER command on every enlisted readiness decision.
• 02Mentor three-to-four CMS1s into CMSC-board-competitive candidates — EER trajectory, certification roadmap, broadening assignments, leadership C-school, and the chiefs' mess sponsorship conversation.
• 03Brief the CGCYBER commanding officer, the District operations officer, or the Area cyber staff on watch-floor readiness, certification posture, and retention honestly — the bad news that does not reach leadership before an inspection is worse than the news delivered at the CMSC's morning brief.
• 04Sit in the Chiefs Mess on the unit's discipline cases, the climate sensing reports, and the Sector/CGCYBER EO and sexual assault prevention posture, and translate those into actions the command will fund and the unit will execute.
• 05Walk the CGCYBER watch floor during an active incident and identify the process gap — the missed escalation step, the log entry that is 45 minutes stale, the CMS2 who is inside a task and not watching the queue — before the watch officer sees it first.
• 06Represent the CMS rating to the broader Coast Guard chiefs' network honestly — what the rating does, how it is maturing, what the watch floor actually looks like, and where the standards still need to be built. A small technical rating earns credibility in the Mess or it does not.

• —DoDD 8140.01 and the DoD CIO approved cert tables — you own the unit's certification compliance posture at the senior enlisted level; the command inspection reads it under your name.
• —COMDTINST M1000-series — Personnel Manual (you and the commanding officer or operations officer own this together for the enlisted cyber workforce).
• —CIM 1610-series — Enlisted Employee Review (EER). Your bullets pick the next CMSC slate.
• —COMDTINST M5350-series and the equivalent CG civil rights and harassment-prevention publications — you sit in the unit's climate posture as the senior enlisted.
• —The Chief Petty Officer Academy and Senior Enlisted Leadership Course reading lists from TRACEN Petaluma, CA — your continuing professional development as a Coast Guard senior enlisted member, not as a cyber technician.
• —DHS CISA Strategic Plan and the current CGCYBER Command Guidance — the strategic framing that puts your unit's watch floor inside the larger DHS and DoD cyber defense mission.

• —Chief Petty Officer Academy (CPOA) at TRACEN Petaluma, CA completed; Senior Enlisted Leadership Course (SELC) on the calendar if competitive for senior chief.
• —DoD 8140 certifications current at IAT Level III or above; unit certification compliance posture defensible to the CGCYBER Inspector General review.
• —Unit watch-floor EER profile clean — CMS1s and CMS2s under you advancing on schedule; your bullets are consistent with what the CGCYBER command master chief network knows about the unit.
• —Zero senior-enlisted integrity incidents — financial, fraternization, classification, OPSEC. The CMS community is small and one event ends the career.
• —Unit incident log discipline and certification tracking posture clean — no CGCYBER Inspector General findings attributable to your tenure; documented corrective action when process gaps surface.

• —Treating the Chiefs Mess as secondary work because the technical mission is what the CGCYBER command actually values. The watch floor respects the anchor only as long as the anchor is present in both the technical mission and the leadership forum — dropping one for the other is how a CMSC gets bypassed on the slate.
• —Confusing CGCYBER's specialized mission with exemption from standard Coast Guard senior enlisted norms. The SELC, the EER discipline, the Mess engagement, and the community-manager relationship are the same requirements that apply at BM and OS units. Being a cyber chief does not mean being only a cyber chief.
• —Going public or going sideways with disagreement with the CGCYBER commanding officer or the District cyber staff. You take it in the office, make the case clearly, and walk out aligned — the watch floor and the rating read alignment from the anchor.
• —Letting a CMS1's documentation or certification lapse accumulate because the operational tempo is high. The CGCYBER Inspector General finds it on the inspection timeline, not yours, and the CMSC is the one explaining the gap.
• —Inflating EER blocks on a technically strong CMS1 whose leadership development is thin. The chief board for a young rating reads those evaluations critically — inflated bullets on a single-dimension record are identified and discounted.

The good CMSC is the chief the CGCYBER commanding officer calls before the command-level cyber incident brief because the watch floor is running right, the senior CMS1 has the incident timeline cold, and the post-incident report will not need rewrites before it goes to the District. His CMS1s pin CMSC, his unit's certification posture is clean, and the CGCYBER command master chief is already flagging this chief for the billet that puts the senior chief packet in front of a competitive slate.

You are the most senior enlisted standard-setter in a rating that is still young enough that you are writing part of what it means to be CMS. Every CMSC knows your name; every junior CMS is deciding whether the rating is worth staying in based on the career arc you demonstrate.

As CMSCS you are typically the senior enlisted advisor at CGCYBER, a senior CMS chief at a District or Area cyber staff, or the senior CMS enlisted presence in a joint or DHS/CISA coordination role. As CMSCM you are on the Command Master Chief track — at CGCYBER, a major Sector, a District headquarters, or at Atlantic or Pacific Area Command — and your name is on the slate the service reads at the senior enlisted council. You advise the CGCYBER commanding officer, the District commander, or the Area commander on every enlisted cyber-workforce decision. You sit in the CGCYBER J-staff senior enlisted network, the Senior Enlisted Council, and the slate-board preparation cycle that picks the next CMSCS and CMSCM cohort. Because the CMS rating is young, you are also doing something the OS and BM senior chiefs do not have to do: you are actively building the career-track norms, the evaluation benchmarks, and the community identity that the rating will carry for the next generation — and the credibility you earn with the broader chief's mess determines whether CMS is treated as a core Coast Guard rating or as a technical annex. You are also planning the post-Coast Guard market explicitly, because the CMS community produces one of the most credentialed enlisted pipelines in the entire DHS enterprise: CISSP plus operational CPT experience plus a TS/SCI is a competitive profile at NSA, CYBERCOM, DHS CISA, FBI Cyber Division, and federal contractor senior cyber roles.

• 01Run the CMS enlisted workforce program at CGCYBER or a major command — certification compliance, watch qualification standards, incident log discipline, personnel readiness reporting, and the senior-enlisted interface with the commanding officer and the CGCYBER J3/J6 staff on every workforce decision.
• 02Mentor four-to-six CMSCs into CMSCS-board-competitive candidates — EER trajectory, cert roadmaps, broadening assignments, family stability, and the honest conversation about which billets put the senior chief packet in front of the right slate.
• 03Sit on a CMS rating community-manager board or advise the CGPSC community manager on CMS-specific workforce issues — billet distribution, certification throughput, retention incentives, school pipeline throughput — and translate community needs into slate and assignment decisions the rating lives with for years.
• 04Brief the CGCYBER commanding officer, the District commander, or the Area commander on cyber workforce readiness, certification posture, and retention in language that lands at the next echelon up — not just technical language that stops at the cyber staff.
• 05Walk the CGCYBER watch floor or a subordinate unit's operations center during a significant incident and identify the process gap, the organizational seam, or the doctrine hole before the post-incident review does — then brief the CMSCS recommendation to the command on corrective action.
• 06Sit in the senior-enlisted and community-manager conversation about the post-service credential pipeline honestly: the TS/SCI path, the CISSP combination, the DHS CISA civilian career track, and the federal contractor market — because the CMS rating retains the CMSCs who can answer those questions and loses the ones who cannot.

• —DoDD 8140.01 and the DoD CIO Cyberspace Workforce Management policy series — at this level you are a workforce policy stakeholder, not just a policy compliance officer.
• —COMDTINST M1000-series — Personnel Manual (you sign as the senior enlisted on its compliance posture at your command).
• —CIM 1610-series — Enlisted Employee Review (EER). Your bullets pick the next CMSC and CMSCS slate at your command.
• —CGPSC ALCGENL and ALSPO messages — pull the current CMS slate composition and community manager guidance; the community is small enough that the messages reflect the entire senior-enlisted picture.
• —DHS CISA Strategic Plan, the CGCYBER Command Guidance, and the DoD Cyber Strategy — the strategic context that frames every workforce and billet decision you make at this level.
• —The Senior Enlisted Leadership Course (SELC) reading list and the Command Master Chief professional development curriculum from TRACEN Petaluma, CA — continuing development as a senior Coast Guard leader, not as a cyber practitioner.

• —Senior Enlisted Leadership Course (SELC) graduate; Command Master Chief at CGCYBER, a major Sector, or a District — the visible senior-enlisted track for the rating.
• —DoD 8140 certifications current at IAT Level III or above; unit certification compliance posture reported accurately and corrected proactively at the command level.
• —Command EER profile clean; CMSCs and CMS1s advancing on schedule; bullets consistent across multiple rating periods.
• —Zero senior-enlisted integrity incidents — classification, financial, fraternization, OPSEC. The CMS community is too small and too closely watched within DHS and CYBERCOM to absorb a senior-enlisted integrity failure.
• —Command cyber incident documentation and certification posture clean — CGCYBER Inspector General and DHS oversight findings effectively zero during your tenure; documented corrective action where process gaps surface.

• —Treating technical credentialing as the senior enlisted identity at this paygrade. The CMSCS and CMSCM are Coast Guard senior enlisted leaders who happen to own a cyber mission — not cyber technicians who happen to be in the Mess. The rating loses credibility in the broader service when its most senior chiefs can only be understood by other cyber chiefs.
• —Stopping active engagement with the CGCYBER watch floor because "I'm at the staff level now." The senior enlisted at District and Area still know what the watch floor looks like and what the alert queue feels like at 0200 on a holiday weekend — the ones who don't lose the ability to identify the broken process before the inspection finds it.
• —Going public or sideways with disagreement with the CGCYBER commanding officer, the District commander, or the Area operations staff. At this paygrade you take the disagreement into the office, make the case clearly, document the recommendation, and walk out aligned. The rating reads what the senior chief tolerates.
• —Letting a subordinate CMSC run an underdeveloped CMS1 development program at their unit because "they have it handled." The CGCYBER J3 asks about workforce readiness at every command-level review, and the answer starts with the unit the CMSCS is responsible for.
• —Treating the post-service career plan as something to figure out after separation. The CMS senior enlisted who plans the TS/SCI-plus-CISSP transition 24-36 months out lands in a DHS/federal role; the one who waits until the retirement briefing scrambles. The rating retains the chiefs who see the transition clearly, and you are the one who models it.

The good CMSCS and CMSCM is the senior enlisted every CMS in the service knows by face and by reputation — not just because of the cert stack but because of the standard on the watch floor, the EER discipline, and the honest career mentoring that tells a CMS3 what the next ten years actually look like. The CGCYBER commanding officer, the District commander, or the Area operations officer trusts this senior chief with the hardest cyber workforce conversation at 0800 and the most sensitive post-incident debrief at 1700. When the CMSCM walks out of formation for the last time, the watch floor still runs to the standard that was set — and the CMS2 who handles the next significant incident does it right because someone built the section that way.