Skip to main content
HonestMOS
InvestigationsCongress made VA disability claims free to file. An entire industry charges veterans anyway — and nobody can stop them.
Back to 255S Cyberspace Defense Warrant Officer — overview, pay, training, civilian translation, reviews
255SCW3-CW5

Cyberspace Defense Warrant Officer

CW3 to CW5 (Senior Warrant) · Army

HEADS UP

At CW4/CW5 your credibility is no longer built on what tools you can run — it's built on whether the CDR trusts your risk assessment enough to act on it. The senior warrant who cannot translate a vulnerability into a decision for a general officer is not competitive at CW5. Build the advisory muscle before you need it.

The Honest MOS Read
The 255-series community is small. You are not competing with thousands — you are in a community where the CW4/CW5 warrants are known by name at ARCYBER, NETCOM, and JFHQ-DODIN, and the senior billets are filled by people the community has been watching since CW2. The typical CW3 billet is senior defensive cyber warrant at a corps or theater G-6, team chief or deputy at a CPT, or resident instructor at the Cyber Center of Excellence. CW4/CW5 widens: CPT commander-level technical authority, ARCYBER staff, JFHQ-DODIN task-force senior warrant, USCYBERCOM component advisor, or the 255S Proponent role at Fort Eisenhower. The work shifts at CW3 in a way that surprises warrants who built their reputation on individual technical depth. You are reviewing other people's vulnerability assessment packages and finding the gaps — not running the scan yourself. You are advising the G-6 on which CAT-I findings represent actual exploitation risk and which are compliance theater. You are writing OERs on WO1/CW2 warrants that a DA board will read. The hands-on-keyboard work does not disappear — the senior 255S who can't run an ACAS scan or read SIEM output after twelve months on staff has surrendered the only thing that makes warrant officer authority irreplaceable. But the ratio shifts: more advising, more mentoring, more institutional-knowledge building. The joint environment is the senior 255S's natural habitat. FM 3-12 and JP 3-12 converge at this level. JFHQ-DODIN authorities, NSA-CSS relationships, USCYBERCOM integration — these are the frameworks you operate inside at CW4/CW5, not read about. Clearance is typically TS/SCI with appropriate compartments. The post-service market is excellent. Booz Allen, Leidos, CACI, Parsons compete aggressively for senior Army cyberspace warrants with CPT records and TS/SCI. The federal civilian GS-13/14 ISSO/ISSM track is similarly open. Start positioning at CW4, not at retirement eligibility.
Career Arc
  • 01CW3 promotion board: DA board reads OER profile, certification record, and operational experience. Pull the current HRC board release for actual selection-rate data — the numbers shift and the published board statistics are the only honest source.
  • 02CW3 billet: corps or theater G-6 senior warrant, CPT team chief or deputy, NETCOM regional node senior warrant, Fort Eisenhower instructor. The advisory authority — not just technical depth — is the credential being built here.
  • 03Joint-duty assignment at JFHQ-DODIN, USCYBERCOM, NSA-CSS liaison, or COCOM J-39 / J-6 before the CW4 board. The 255S community at CW4/CW5 values joint exposure, and the billets that come after the CW4 board increasingly assume it.
  • 04CW4 promotion board: small community, well-known names, OER narrative matters more than it does in a larger MOS. The board reads the full career arc — operational experience, joint exposure, mentorship record visible in junior-warrant OER comments.
  • 05CW4 / CW5 billet: CPT technical authority, ARCYBER staff, JFHQ-DODIN task-force senior warrant, USCYBERCOM component advisor, 255S Proponent at Fort Eisenhower.
  • 06CW5 is the technical pinnacle: appointment, not board-competitive promotion in the traditional sense. CW5 255S warrants are the senior practitioner voice for the 255S community at the DA level — T&R standards, WOBC curriculum, qualification criteria, and doctrine input.
Common Screwups
  • ×Security clearance revocation at the senior level. The financial mismanagement, foreign contact, or judgment failure that costs a CW4/CW5 their clearance ends a career that cannot be rebuilt at this paygrade. The stakes at senior warrant are higher because the clearance level is higher and the adjudication standard is stricter.
  • ×Tolerating a subordinate unit's non-compliant ACAS posture because the unit is a peer command or a command you came from. The senior warrant who audits the formation, sees the CAT-I gaps, and signs off on the rollup anyway is signing in their own name. The CCRI inspector will not make the distinction.
  • ×Advising the CDR on a risk acceptance without documenting the technical justification in full. The risk acceptance that is verbal, or that says only 'operationally necessary,' is a liability document with no defense. If the vulnerability is exploited after the CDR accepted the risk on your advice, the adequacy of your technical justification is on the record.
  • ×Article 15 or substantiated IG complaint at the senior warrant level. The community is too small for informal recovery; the OER impact is immediate and the DA board reads the adverse documentation in full.
  • ×OPSEC breach at the senior level — the classified operational details, system architectures, or mission specifics a CW4/CW5 touches are at a level where an OPSEC failure has real operational consequences, not just a counseling statement.

A Day in the Life

  • 0530PT with the section or individual training plan. The senior warrant does not get a pass on the physical standard.
  • 0700Review overnight SIEM flags, NETCOM NOSC situational awareness messages, and anything the junior warrants flagged for decision before the morning brief. The senior warrant reads before the standup, not during it.
  • 0800Section standup. Senior warrant provides top-down priorities for the day — what the G-6 or J-6 needs by close of business, what the junior warrants should be working, and what needs a decision before the morning staff brief.
  • 0830Morning staff brief with the G-6 / J-6 officer. Cyber readiness slide covers ACAS posture, open IAVM findings, HBSS coverage status, and any active anomalies from the overnight SIEM. Two minutes if nothing is on fire; twenty if something is.
  • 0900Primary technical review block — review junior warrant findings packages, POA&M status, or ongoing CPT mission reporting. Correct and annotate rather than redo; the junior warrant learns more from a red-lined package than a replacement.
  • 1000Coordination calls — ARCYBER task element, NETCOM NOSC, peer 255S warrants at adjacent commands on shared findings or mutual support for an ongoing scan cycle or incident response.
  • 1100CDR advisory work — drafting or reviewing risk acceptance memo language, preparing the G-6 for the CDR brief on a specific finding, or writing the technical annex for the CCRI preparation package.
  • 1200Lunch. Out of the building. The senior warrant who eats at the workstation does not think clearly by 1600.
  • 1300Afternoon technical or administrative block — RMF package review, OER drafting for junior warrants, doctrine feedback to the 255S Proponent, or CPT mission planning if in a supported-command rotation.
  • 1500Junior warrant check-in — 15 minutes each, by rotation. Not a status brief; a mentorship conversation. What did you see today, what do you not understand, what decision do you need help making.
  • 1600End-of-day brief to the G-6 / J-6. What changed since this morning, what is the overnight posture, what decision needs to be made before tomorrow's morning brief.
  • 1700Depart, unless an active incident response is in progress. DCO-IDM incidents run until they are resolved, not until the duty day ends.

Weekly Cadence

Monday sets the week: what did the weekend SIEM produce, what IAVM bulletins dropped, what is the G-6 focused on. The senior 255S warrant sets priorities at Monday standup and does not revisit them unless something changes — the junior warrants should know what Monday looks like without asking. Midweek is advisory and review: G-6 staff brief, CDR risk conversation, junior warrant findings-package review, POA&M status to the ISSM chain. If CCRI prep is active, midweek is where findings either close or get escalated before the 30-day IAVM window expires. Friday is documentation: status reports to NETCOM, OER drafting, doctrine feedback to ARCYBER or the 255S Proponent. The Friday posture brief should have no surprises — everything that changed this week was briefed the day it changed. The cadence breaks during CPT missions and incident responses; in those windows the senior warrant is operational and documentation follows the 72-hour after-action window.

Key Skills — How to Drill Each

  1. 01
    Lead a CPT hunt-team or DCO-IDM mission from planning through execution and out-brief.
    The mission hypothesis is the most important document in the hunt — it sets the collection plan, the tool configuration, and the analysis framework before you touch the network. Spend two to three times as long on the hypothesis as you think you need to. The hunt that starts with a sharp hypothesis finds what it's looking for in the first 48 hours. The hunt that starts with 'let's see what's there' runs for two weeks and produces a findings package that the supported CDR cannot act on.
  2. 02
    Advise the G-6 / J-6 officer and CDR on RMF authorization decisions and risk acceptance.
    Frame every risk acceptance conversation in terms of the specific threat scenario, not the control family. 'This CAT-I finding means an adversary who achieves initial access via a phishing email can move laterally to SIPR in two steps' is a decision. 'We have a CAT-I STIG deviation' is a metric. Practice the threat-scenario framing with your G-6 officer before you use it with the CDR — the framing takes time to calibrate to the audience.
  3. 03
    Review and validate junior warrant vulnerability assessment packages.
    Review against three criteria in order: coverage (did the scan reach every asset in scope), accuracy (are the findings correctly categorized), and actionability (can the sysadmin actually remediate from this package without calling you). The third criterion is where most junior warrants' packages fail — technically correct findings in language that only makes sense to the 255S, not to the IAO who has to fix it.
  4. 04
    Lead the unit's CCRI / CORA preparation cycle at the corps or theater level.
    The CCRI preparation starts nine months before the inspection, not three. By month six you should have a full gap analysis against the last inspection's findings. By month three you should have every CAT-I finding either closed or in a POA&M with a risk acceptance signed by the ISSM. The senior 255S who starts serious CCRI prep at the 60-day mark is the senior 255S who inherits the previous warrant's open findings.
  5. 05
    Provide DCO-IDM doctrine input at the ARCYBER / NETCOM level.
    Write from operational experience, not from the current publication. The best T&R task revisions come from warrants who can say 'here is what the current standard does not capture about how managed hunt missions actually run in a contested-network environment.' Bring the gap, the evidence from your missions, and a proposed standard — not just a complaint that the current task is outdated.
  6. 06
    Mentor WO1/CW2 warrants through the first RMF package and first DCO-IDM mission.
    The mentorship value is in the questions you ask, not the answers you give. 'Why did you categorize that as CAT-II rather than CAT-I' is more useful than telling them the right answer, because the next novel finding will not come with a senior warrant in the room. The junior warrant who learns to reason through the categorization is more durable than the one who learned the right answer for the last ten findings.

Manuals & References — What Chapters Matter

  • FM 3-12 — Cyberspace and Electronic Warfare Operations
    The senior 255S operates at the level where DCO integrates with EW, IO, and the broader information-warfare framework. FM 3-12 Chapter 3 covers the command and control of cyberspace operations in a way that maps directly to the supported CDR's decision authority — which is the frame you need to give advice that gets acted on.
  • JP 3-12 — Cyberspace Operations
    The joint-doctrine authority for DCO at the JFHQ-DODIN and USCYBERCOM level. At CW4/CW5 your operating environment increasingly crosses joint and interagency lines. Understanding how the joint force frames DCO — authorities, coordination requirements, integration with offensive cyberspace operations — is the foundation for advising in a joint billet without getting lost.
  • DoDM 8140.03 — Cyberspace Workforce Qualification and Management Program
    At the senior level you are advising on workforce qualification program design, not just maintaining your own credentials. Understanding the full work-role taxonomy — how 255S maps to NICE Framework categories, what the residual qualification requirements are for senior billets, how the program is evolving — makes you more useful to the G-6 when they are building the cyber section's training and certification plan.
  • CNSSI 1253 — Security Categorization and Control Selection for National Security Systems
    The control baseline framework for high-side systems. If your billet touches SIPR-equivalent or above — JFHQ-DODIN, USCYBERCOM, NSA-CSS adjacent — CNSSI 1253 is where the control selections come from, not NIST 800-53. Know both and know when each applies.
  • AR 25-2 — Army Cybersecurity
    At the senior level you are interpreting the regulation for the supported CDR, not just complying with it. The regulation gives the CDR the authority to accept risk on specific findings with proper documentation; the senior 255S warrant who knows the chapter and paragraph has the conversation the CDR needs instead of the conversation that ends with 'let me check the reg.'
  • NIST SP 800-137 — Information Security Continuous Monitoring (ISCM)
    The continuous-monitoring program framework that underlies ACAS / HBSS / SIEM posture management. Senior warrants who understand the ISCM program logic — not just the individual tools — can advise the G-6 on building a sustainable defensive posture rather than a compliance snapshot.

Standards — How to Hit Each

  • IASAE or IAM-III credentials — CISSP with concentration (ISSEP or ISSMP) at the senior billet level.
    CISSP alone is the floor. The CISSP-ISSEP concentration validates systems-security engineering depth; the CISSP-ISSMP validates management and governance depth. The billet you are advising from at CW4/CW5 typically requires one or the other depending on whether your primary role is technical design authority or program governance. Identify which track your billet requires and pursue it before the CW4 board, not after.
  • CPT mission qualification or equivalent DCO-IDM operational experience.
    If you have not run a managed hunt under ARCYBER authorities, advocate for a TDY attachment to a CPT before the CW4 board. The one-to-two week mission observer / analyst role gives you the technical exposure and the OER bullet that says 'operational, not just garrison.' The 255S community is small enough that the board members know which warrants have CPT operational records and which do not.
  • Joint-duty or CYBERCOM-adjacent assignment on the record.
    The joint-duty assignment requires JDAL-coded billet documentation. Work with your S-1 or G-1 to confirm the billet coding before you go. A joint-duty assignment that is not properly coded does not produce the JDAL credit that matters to the CW5 board. The coding is administrative but it is the administrative step that most warrants miss.
  • OER profile at senior rater 'best qualified' across consecutive periods.
    The 255S warrant community at CW4/CW5 is small enough that the DA promotion board reads the OER narrative, not just the block check. 'Best qualified' with bullets that name specific missions, specific outcomes, and specific units improved is the record that gets the senior assignment. 'Best qualified' with generic bullets that could describe any technical warrant is competitive but not distinctive.
  • Active participation in 255S Proponent / ARCYBER / NETCOM warrant community deliberations.
    Show up to the warrant officer community forums. Submit written comments on T&R task revisions. Respond when the WOBC director at Fort Eisenhower asks for practitioner feedback on curriculum. The CW5 appointment is not a promotion board — it is a community recognition of technical authority, and that authority is built over a career of visible engagement with the community's institutional development.

Technical Mistakes — Concrete Consequences

  • Tolerating a subordinate unit's ACAS posture that looks compliant on the rollup but has never been validated against the actual asset inventory.
    The inspector pulls the manual asset list and finds fifty hosts that never got a sensor. The findings sheet attributes the gap to the formation under your oversight. The CDR reads the out-brief and learns that the compliance dashboard was measuring the scanned universe, not the actual network — and that the gap was visible to anyone who compared the two lists.
  • Accepting risk on a CAT-I finding in writing without a detailed technical justification.
    The vulnerability is exploited after the CDR signed the risk acceptance on your advice. The incident investigation finds the memo. A memo that says 'operationally necessary' with no technical rationale is not a risk acceptance — it is a document that will be read aloud in the after-action review by someone who is not you.
  • Advising the CDR on defensive posture without disclosing tool-coverage gaps the team already knows about.
    The intrusion uses exactly the gap you knew existed. The CDR's post-incident question — 'why didn't you tell me' — has only one answer that is worse than the gap itself: 'I didn't want to brief a problem I didn't have a solution to yet.' The supported commander's risk decision requires complete information.
  • Stopping deckplate presence because the assignment is at corps or theater staff.
    The CW4 who cannot run a vulnerability scan or read a SIEM output after twelve months on staff has given up the technical credibility that makes a warrant officer's advisory role irreplaceable. The one-star who stops trusting the technical advice usually stops trusting it because the warrant officer started giving advice that was accurate at the doctrine level but not at the current-network level.
  • Failing to document institutional lessons from a significant intrusion or CCRI failure in a format that survives the rotation.
    The knowledge leaves with the warrant. The next intrusion at the same formation exploits the same gap the previous warrant understood but never wrote down. The debrief at the second incident includes a question about whether the previous warrant documented the lessons — and the answer is on the record.

Career Decisions at This Rank

  • Pursue a CW5 appointment versus separating at CW4 for the defense-contractor market.
    CW5 is an appointment, not a board in the traditional sense, and it carries the expectation of continued service as the community's practitioner voice for doctrine, T&R standards, and WOBC curriculum. The contractor market for a CW4 with TS/SCI, CISSP, and a CPT operational record is excellent and does not require waiting. The honest decision: do you want the institutional shaping role, or are you ready to translate the career into a second act? Both are legitimate.
  • Accept a JFHQ-DODIN or USCYBERCOM billet versus staying in a conventional-force or ARCYBER role.
    Joint-duty billets expose you to DODIN-A defense at the enterprise level — the interagency relationships, joint authorities, and strategic visibility are career multipliers conventional-force billets don't provide. Practical consideration: JFHQ-DODIN and USCYBERCOM billets at Fort Meade are geographically concentrated and the operational tempo is different from a corps G-6. Weigh the career value against your family's geographic flexibility honestly.
  • Pursue the 255S Proponent / Fort Eisenhower instructor billet versus the operational or staff track.
    The schoolhouse is how the senior 255S community shapes the next warrant cohort. The warrants who teach at the Cyber Center build foundational habits — what to look for in a SIEM, how to frame risk for a CDR, what the first RMF package should look like. If you have high standards and the patience to hold them in a classroom rather than a mission cell, the force-multiplier effect is real. The downside: OER visibility from the schoolhouse is lower than from a named operational billet at ARCYBER or JFHQ-DODIN.
  • Post-service positioning: federal civilian versus defense contractor versus commercial cybersecurity.
    Start positioning at CW3/CW4, not at retirement eligibility. The GS-13/14 ISSO/ISSM track values the Army record and DoDM 8140 credentials but the hiring process is slow — budget months, not weeks. Defense contractors (Booz Allen, Leidos, CACI, Parsons) move faster and pay more; the TS/SCI is the primary currency. Commercial cybersecurity is large but requires translating Army experience into CISO-facing language, which takes six to twelve months to do well. Start early.

How the Seat Varies by Unit Type

  • ARCYBER / CPT at Fort Eisenhower
    The operational center of gravity for the 255S senior warrant community. CPT team chiefs and deputies here are running the managed hunt missions that generate the institutional knowledge the rest of the community learns from. The clearance level is high, the mission visibility is real, and the CW4/CW5 warrants here are known by name at USCYBERCOM. The downside: geographic stability is lower than a conventional-force billet.
  • NETCOM / 9th Signal Command
    Infrastructure defense at scale. The senior 255S warrant at NETCOM is defending the fixed DODIN-A infrastructure that every Army network runs through — the stakes are higher than a single BCT and the CCRI posture is correspondingly more demanding. The work is systematic and less kinetic than CPT, but the scale of the defended terrain and the relationship with NSA-CSS and JFHQ-DODIN make the senior billet relevant at the strategic level.
  • JFHQ-DODIN / USCYBERCOM Component
    Strategic-level operations. The 255S senior warrant here is advising on enterprise DODIN-A defense alongside joint-force partners and interagency elements. The work is more policy and advisory than hands-on technical, but the technical credibility you arrive with is what earns the advisory standing. The interagency exposure — NSA-CSS, CISA, FBI Cyber Division — is unlike anything available in the Army component.
  • Fort Eisenhower Cyber Center / 255S Proponent
    Institutional shaping. The senior warrant at the schoolhouse is writing the T&R standards, reviewing the WOBC curriculum, and sitting in the accession-criteria deliberations that determine who enters the 255S community and what they can do when they graduate. The force-multiplier effect is significant; the OER visibility is lower than at ARCYBER or JFHQ-DODIN. Warrants who go to the schoolhouse should do it because they want to shape the community, not because it is the most visible assignment.
  • Corps or Theater Army G-6
    The conventional-force senior advisory seat. The CW4/CW5 at a corps G-6 is the senior technical authority for defensive cyber across a formation that may include multiple divisions and specialized commands. The CDR relationship is the primary product — the ability to advise a three-star on network risk in terms the three-star acts on is what makes the corps G-6 billet a meaningful credential for the senior warrant.

What Good Looks Like at This Rank

The good CW3–CW5 255S is the warrant the NETCOM NOSC night shift calls at 0300 when the SIEM rule fires on a pattern that doesn't match any baseline — because this warrant reads the raw log data, identifies the TTP without the framework naming it, and has a recommendation to the J-6 before sunrise. The finding is not 'anomalous activity consistent with possible intrusion' — it is 'initial access via spear-phish, lateral movement via domain admin token, staged at the SIPR boundary, here is the firewall change we need now and here is the CDR package.' The advisory record is what the DA board reads at CW4/CW5. The OER that reads 'led CPT hunt mission that identified and remediated persistent threat actor access across three BCT enclaves' beats the OER that reads 'maintained ACAS compliance and supported CCRI preparation.' Both may be technically accurate. The one whose work changed the network gets the senior billet. The mentorship record is visible in the OERs the senior warrant signs. The CW4/CW5 who pushes WO1/CW2s into operational assignments before they think they're ready, reviews their packages with a red pen, and writes OERs with observable outcomes — not generic praise — is the warrant whose junior cohort the community manager calls on next. The 255S community is small enough that this is not abstract.

Preview — The Next Rank

CW5 is the endpoint of the warrant track, not a retirement billet. The CW5 255S is the Army's recognized practitioner authority for DCO-IDM — the warrant the ARCYBER CG names when the Joint Chiefs want to know who understands the mission. The work is institutional: T&R standards, WOBC curriculum, doctrine input to FM 3-12 and ATP 6-02.71 revisions, and the informal community mentorship that shapes what the 255S cohort looks like for the next decade. The second career starts here whether you're ready or not. The defense-contractor market (Booz Allen, Leidos, CACI), the GS-14/15 cyber-operations track, and senior consultant roles are all actively recruiting CW4/CW5 warrants with CPT records and TS/SCI. The warrants who navigate this well start the positioning at CW3/CW4 — building the external network, translating the OER into a resume a CISO can read, getting the CISSP concentration current. The Army record is an asset in every room. The translation is the work.
FAQ

255S CW3-CW5 — Frequently Asked Questions

Q01What does a CW3-CW5 255S (Cyberspace Defense Warrant Officer) actually do?
At CW3 and above you are typically serving as the senior defensive cyber warrant at a Corps or Theater Army G-6, a team chief or deputy in a Cyber Protection Team (CPT) under ARCYBER or NETCOM / 9th Signal Command, a JFHQ-DODIN hunt-team lead, a Cyber Center of Excellence senior instructor or doctrine writer at Fort Eisenhower, or a technical authority in a joint-duty billet at USCYBERCOM or one of the service component commands.
Q02What's the most important thing to know as a CW3-CW5 255S?
At CW4/CW5 your credibility is no longer built on what tools you can run — it's built on whether the CDR trusts your risk assessment enough to act on it.
Q03What does a typical day look like for a CW3-CW5 255S?
Time-blocked day at the CW3-CW5 255S rank tier: 0530 PT with the section or individual training plan. The senior warrant does not get a pass on the physical standard, 0700 Review overnight SIEM flags, NETCOM NOSC situational awareness messages, and anything the junior warrants flagged for decision before the morning brief. The senior warrant reads before the standup, not during it, 0800 Section standup. Senior warrant provides top-down priorities for the day — what the G-6 or J-6 needs by close of business, what the junior warrants should be working,…
Q04What mistakes get CW3-CW5 255S soldiers fired or relieved?
Security clearance revocation at the senior level. The financial mismanagement, foreign contact, or judgment failure that costs a CW4/CW5 their clearance ends a career that cannot be rebuilt at this paygrade. The stakes at senior warrant are higher because the clearance level is higher and the adjudication standard is stricter; Tolerating a subordinate unit's non-compliant ACAS posture because the unit is a peer command or a command you came from. The senior warrant who audits the formation,…
Q05What career decisions matter most at the CW3-CW5 255S rank tier?
Pursue a CW5 appointment versus separating at CW4 for the defense-contractor market — CW5 is an appointment, not a board in the traditional sense, and it carries the expectation of continued service as the community's practitioner voice for doctrine, T&R standards, and WOBC curriculum. The contractor market for a CW4 with TS/SCI, CISSP, and a CPT operational record is excellent and does not require waiting. The honest decision: do you want the institutional shaping role, or are you ready to translate the career into a second act? Both are legitimate;…
Q06What's next after CW3-CW5 for a 255S (Cyberspace Defense Warrant Officer) in the Army?
CW5 is the endpoint of the warrant track, not a retirement billet.
Q07What manuals and regulations does a CW3-CW5 255S need to know cold?
FM 3-12 — Cyberspace and Electronic Warfare Operations: the doctrinal authority senior 255S warrants cite when advising CDRs on DCO-IDM mission integration with the broader information-warfare framework.; DoDM 8140.03 — Cyberspace Workforce Qualification and Management Program: at the senior level you are advising on workforce coding and certification program design, not just complying with it.;…

This playbook has no tips yet. Be the first to share what you know.

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards