Skip to main content
HonestMOS
●InvestigationsHow EUCOM shelved a tax break for 9,000 troops in Poland — for five years.→
←Back to CTT Cryptologic Technician (Technical) — overview, pay, training, civilian translation, reviews
CTTE1-E3

Cryptologic Technician (Technical)

E-1 to E-3 (Junior Enlisted) · Navy

E1–E3E-4E-5E-6E-7E8–E9
HEADS UP

The clearance investigation owns your timeline — not the schoolhouse, not your orders, not your detailer. A single undisclosed foreign contact or financial inconsistency on the SF-86 can delay adjudication by six months or more, and the CTT community has no workaround for an unadjudicated clearance. Get your paperwork right before any of the technical content matters.

The Honest MOS Read
CTT is a SIGINT technical intelligence rating. The full title is Cryptologic Technician Technical, and the word that matters is technical — you are being trained to characterize electronic emissions, analyze signals parameters, apply ELINT and SIGINT analytic tradecraft, and produce intelligence products that go directly into the IC customer chain. This is not a generalist IT or network job. The mission is signals: identifying emitter types, characterizing their parametric behavior, and contributing to intelligence that shapes fleet and joint decisions. That sentence sounds prestigious in a recruiting brief. What it actually means as a CTTSN is that you spend a significant stretch of your first 18 months in training, in a SCIF, and in the clearance investigation process before you touch anything operational. You arrive at A-School through the Center for Information Warfare Training (CIVT) at Corry Station, NAS Pensacola. The curriculum covers foundational SIGINT concepts, electronic warfare theory, signal characterization, and the IC analytic-standards framework — ICD 203 (Analytic Standards), ICD 206 (Sourcing), ICD 208 (Reporting) — that every finished product in the community is produced against. The schoolhouse moves fast and assumes you retained what you scored on the ASVAB to get here. It does not re-teach foundational signals theory mid-course because you coasted through the first two weeks. The technical content accelerates; the students who build the foundation early are the ones who get meaningful work-role assignments at their first operational billet. Parallel to the classroom, the TS/SCI investigation with CI polygraph is running. This investigation will be the first genuinely consequential document-review process of your life. Every foreign contact, every financial account, every piece of your digital footprint, every social media post — all of it is subject to review, and the investigators are thorough. The standard is not perfection; it is honesty and consistency. Undisclosed issues discovered mid-investigation are worse than disclosed ones up front. If your SF-86 says one thing and your social media says another, the adjudicator notices. Clean up the record before you submit — not after. Follow-on training after A-School leads to your first operational billet: a NAVSECGRU command, a Fleet Cyber Command / NAVIFOR element, a joint SIGINT site, or an NSA-affiliated command, depending on NEC assignment and community priority at the time of your orders. The deckplate-at-sea picture does not apply here — CTT is overwhelmingly a shore and SCIF-based rating with joint-duty assignments interspersed. The rhythm is SCIF, workstation, watch rotation, study schedule. The work is mentally demanding and often invisible to the outside Navy. The trade-off is that a CTT with a clean TS/SCI record and a demonstrated analytic capability is one of the most hireable people the enlisted Navy produces — at retirement, and often well before it. As a CTTSN your job is simple to state and hard to execute: build the technical foundation the A-School plants, keep your security posture clean, earn the clearance without drama, and check into your first operational billet with no administrative flags waiting in your file. The senior CTT who receives you will know within two watch cycles whether the schoolhouse prepared you or whether you coasted. Your first six months will establish the reputation you carry in a community small enough that it travels.
Career Arc
  • 01RTC Great Lakes complete; CTT A-School check-in at CIVT, Corry Station NAS Pensacola — TS/SCI investigation with CI polygraph initiated simultaneously.
  • 02A-School academic performance tracked; foundational signals theory, EW concepts, IC tradecraft framework (ICD 203/206/208), signal characterization — the baseline you will operate against for the rest of the career.
  • 03Clearance adjudication window — timeline varies by investigation complexity; the CTTSN who undisclosed anything waits longer than the one who disclosed everything cleanly.
  • 04Follow-on pipeline training (verify current course structure and location with CIVT before quoting); NEC assignment determined by schoolhouse performance and community needs.
  • 05First operational billet orders: NAVSECGRU command, Fleet Cyber Command / NAVIFOR element, NSA-affiliated site, or joint SIGINT assignment — the specific assignment shapes the first three years significantly.
  • 06Check-in at first operational command: PQS initiation, section work-role qualification, NWAE BIB pull for CTT2 — the clock toward CTT3 advancement starts here.
Common Screwups
  • ×SF-86 inconsistency or omission. The investigators find undisclosed foreign contacts and financial irregularities. The lie is always worse than the underlying fact — disclose everything, even if it is uncomfortable, and let the adjudicator make the call.
  • ×OPSEC breach on personal devices or social media. One sentence about the pipeline, the assignment track, or what you are studying is a reportable incident. The OPSEC officer reads the sweep reports and the community is small enough that the story travels.
  • ×Unauthorized media on a school or training system. The incident-response ticket is on the instructor's desk that afternoon, the report goes up the chain the same day, and the investigation is opened before dinner.
  • ×Academic performance failure requiring recycle or disenrollment. In a small community, a student who recycled is known. The LPO at the first operational command will ask why without asking.

A Day in the Life

  • 0530PT formation at school or command. A-School runs its own PT schedule at Corry Station — runs, circuits, or unit PT depending on the week and the cadre. Clearance investigators are running in parallel with every school day; keep the phone away from anything classified.
  • 0630–0700Shower, chow, morning admin if needed — security paperwork, foreign-contact reports, anything the security officer is waiting on gets handled before class, not after.
  • 0730A-School classroom block. Signals theory, EW fundamentals, modulation and frequency concepts, IC tradecraft framework. The cadre takes attendance and the pace is real from day one.
  • 0730–1130Academic instruction block. Lab time on signal characterization equipment and analysis tools rotates in as the curriculum progresses. The CTTSN who asks questions during lab is the one the instructor remembers; the one who sits quietly confused is the one who struggles at the practical evaluation.
  • 1130–1230Lunch — Corry Station DFAC or local if the schedule allows. Study material over lunch in the early weeks when the conceptual load is highest.
  • 1230–1600Afternoon instruction or lab. Practical applications, equipment familiarization, written evaluations at scheduled intervals. The follow-on pipeline builds on this foundation; students who are shaky on the A-School material arrive at follow-on at a disadvantage.
  • 1600School day ends. Admin time for PCS paperwork, housing coordination, car registration — the administrative backlog of a new duty station does not pause because school is demanding.
  • 1600–1800Personal study. The serious CTTSN reviews the day's material before dinner, not during the morning rush before evaluation. The signals theory and analytic-standards framework compound — the student who builds the habit early has a significant advantage by week four.
  • 1800Chow, personal time. Corry Station is close enough to Pensacola Beach that off-duty life is not austere — the CTTSN who uses that proximity poorly is the one whose financial disclosure form gets complicated.
  • 2000Focused study block. ICD 203 and ICD 206 are available in public versions from ODNI; reading them in study time before they appear on a practical evaluation is the competitive advantage. Note that classified materials are accessed only in designated spaces.
  • 2200Lights out — recovery is real. The academic pace is sustained; a CTTSN who runs on four hours of sleep for two weeks develops the kind of errors that surface on practical evaluations.

Weekly Cadence

The A-School week at Corry Station runs Monday through Friday on a structured academic schedule with PT on the school's rotation. The weight of the week falls in the middle — Tuesday and Wednesday are typically when the more demanding academic blocks and practical lab evaluations land. Monday is for orienting to the week's new material; Thursday and Friday are consolidation and written evaluation cycles. The background track running parallel to every academic week is the clearance investigation. The investigative process is largely invisible to the CTTSN — it is running without your active participation — but events in your personal life during the investigation window require immediate reporting to the security officer. A foreign contact, a new financial account, a significant financial event, a change of address — all of these are reportable and the reporting timeline is short. The CTTSN who treats the clearance investigation as something that happened in the past and is now on autopilot is the CTTSN who accumulates unreported events and discovers them as problems at the periodic-reinvestigation. When the A-School and follow-on pipeline phases give way to the first operational assignment, the cadence shifts completely. Shore SCIF billets run a watch rotation — 12-on / 24-off, or similar — depending on the command's mission tempo and manning. The transition from a structured school day to a watch rotation is a significant adjustment. The CTTSN who has not internalized the OPSEC discipline as habit by the end of the pipeline discovers, quickly, that the operational watch floor enforces it without a reminder.

Key Skills — How to Drill Each

  1. 01
    Maintain clearance hygiene from day one — proper handling of classified spaces, materials, and conversations; nothing outside the SCIF; foreign contacts reported on the timeline the security officer sets.
    Pull the command's security SOPs in the first week and read them completely, not as a box-check but as the technical manual for the most consequential system you operate. Build the habit of treating every foreign contact — casual, social, professional — as a reportable event by default, and let the security officer tell you it does not need a report, rather than the other way around. The CTTSN who over-reports to the security officer is never the one in the commander's office explaining an omission.
  2. 02
    Absorb foundational signals theory — frequency, modulation, waveform characteristics, EW spectrum basics — at the depth the A-School curriculum assumes you retained.
    Before you arrive at Corry Station, run through the foundational RF and EW theory in the ARRL Handbook or equivalent — frequency bands, modulation types, propagation fundamentals. The A-School faculty does not re-teach the pre-requisite; they assume it. Students who arrive with the baseline already loaded progress faster and get better work-role assignments. If the theory felt abstract in the classroom, find a senior CTT on the floor who will explain what it looks like in practice — the connection between theory and operational application is the core of the technical tradecraft.
  3. 03
    Study the IC analytic standards framework — ICD 203 (Analytic Standards), ICD 206 (Sourcing), ICD 208 (Reporting) — because your analysis will be measured against all three from your first day at the operational billet.
    Download the current public versions of ICD 203 and 206 from the ODNI website and read them as operating procedures, not as background reading. ICD 203's analytic standards — proper uncertainty characterization, sourcing transparency, the prohibition on politicized analysis — are the professional standard you will be held to on every finished product. Understanding the framework before you touch a keyboard at the operational billet means the senior CTT is teaching you to apply it rather than explaining what it is.
  4. 04
    Knock out PQS and foundational work-role qualifications on the LPO's timeline at the first operational billet.
    Pull the section's PQS the first day you check in and read it from front to back before asking the LPO for the first signature. Map each PQS line item to something you learned in the A-School curriculum and identify what you do not recognize — those are the items to get answered in week one, not week six. The CTTSN who arrives at quarters with the PQS nearly complete at the 90-day mark is the one the LPO puts on the harder watch position earlier.
  5. 05
    Earn the baseline DoD 8140 cyber/intelligence-workforce certification your billet requires before the operational position demands you be qualified.
    Navy COOL funds the voucher for baseline certifications in the DoD 8140 framework (verify current eligibility and covered certs at my.navy.mil / COOL). Pull the current work-role qualification requirement for CTT billets at your command, identify the baseline cert on the sheet, and schedule the voucher application in the first 30 days. The CTTSN who leaves the COOL voucher on the table for six months is the CTTSN who needs an extension to sit the position.

Manuals & References — What Chapters Matter

  • CIVT / NETC — Center for Information Warfare Training catalog (netc.navy.mil)
    The authoritative source on current CTT A-School curriculum, follow-on course structure, and pipeline modifications. Verify current course names, lengths, and locations here before quoting them — the pipeline has been restructured periodically and what a senior CTT told you about their training path may not match the current schedule.
  • ICD 203 — Analytic Standards (ODNI)
    The IC tradecraft standard every CTT analysis product is evaluated against. Key sections: the proper characterization of uncertainty (the most common gap in junior analysis), the sourcing transparency requirements, and the prohibition on analytical distortion. Read this as a technical manual, not background context — you will produce against it from your first operational watch.
  • ICD 206 — Sourcing Requirements for Disseminated Analytic Products
    Governs how sources are characterized and cited in finished intelligence. As a CTTSN-turned-CTT3, your technical analysis will need to meet sourcing standards even before the product reaches dissemination controls. Understanding the framework early prevents the pattern of source attribution that gets corrected at every review.
  • ICD 208 — Intelligence Community Reporting
    Covers the structure, format, and dissemination controls for IC reporting. The SIGINT technical report you produce at your first operational billet will be graded against this standard. Familiarity with the report structure before you write your first product saves the senior CTT the formatting correction conversation.
  • OPNAVINST 2201.3 — Navy Signals Intelligence / Electronic Warfare (SIGINT/EW) Coordination
    The Navy-level instruction governing SIGINT and EW operations coordination. Foundational for understanding the command relationships, reporting chains, and authorization framework your operational billet operates inside. The CTT who does not understand the coordination structure is the CTT who does not understand why certain products go certain places.

Standards — How to Hit Each

  • TS/SCI clearance adjudicated with CI polygraph completed before the first operational position.
    The only lever you control is submitting a clean, complete, internally consistent SF-86 and staying ahead of the continuous-evaluation framework throughout the investigation. Disclose everything even if it is uncomfortable. Update the security officer immediately when foreign contacts, financial changes, or reportable events occur. Every day the investigation waits on a clarification from you is a day your operational value is zero.
  • A-School completion and follow-on pipeline qualification on the timeline CIVT and your command set.
    The student who recycles is visible in the community. Build the study habit before you need it — signals theory, ICD framework, SCIF procedures, EW fundamentals — so the schoolhouse progression feels like reinforcement, not remediation. The CTTSN who finishes the pipeline on the first attempt without drama is the one the receiving command is ready to put to work.
  • Baseline DoD 8140 cyber/intelligence-workforce certification earned before the billet requires position qualification.
    Identify the specific work-role designation your first operational billet requires (verify with the command's IT/security office or check the OPNAV N2/N6 workforce guidance). Schedule the certification exam through COOL in the first 60 days. Do not let the voucher expire unused — it is real money the Navy is offering to spend on your career qualification.
  • Annual security awareness and cybersecurity training completed before every deadline.
    In a TS/SCI community, a missed training deadline is not a paperwork miss — it is a reportable gap in your security profile. Build the calendar reminder 30 days before every deadline. The CTTSN who never misses a training deadline is indistinguishable from every other CTTSN — the one who misses one is visible in a community where the security officer and the LPO compare notes.

Technical Mistakes — Concrete Consequences

  • Treating the A-School schedule as relaxed because the classroom is air-conditioned and the PT is lighter than boot camp.
    The technical content in CTT A-School accelerates from week two onward. The student who coasts through the foundational signals theory arrives at the operational billet unable to perform the parametric analysis the senior CTT expects from a fresh CTT3, and the first month of the fleet assignment becomes remediation on material the schoolhouse already taught.
  • Letting the clearance investigation develop surprises — undisclosed foreign contacts, undisclosed financial accounts, social media that contradicts the SF-86.
    The investigators find the inconsistency during the investigation; the adjudicator treats an undisclosed item discovered mid-investigation significantly worse than a disclosed item that was reviewed at submission. A clearance denial or lengthy adjudication delay sideliens the entire career path, because CTT has no operational billet that does not require a TS/SCI.
  • Discussing the pipeline content, NEC assignment track, or anything signals-related on personal devices or social media.
    OPSEC is the product in this community. One sentence posted to a public platform or sent in a personal message channel about what the community does or where you are assigned triggers an OPSEC incident investigation. The community is small and the investigation is visible to every senior CTT in the chain.
  • Plugging unauthorized media — USB drives, personal storage, phones in unauthorized modes — into a training or school system.
    The incident-response ticket is on the instructor's desk that afternoon. The report goes up the command chain the same day. A formal investigation is opened and the name at the top of the report is yours. Even if the content on the media was benign, the unauthorized connection is a security incident, not a policy misunderstanding.

Career Decisions at This Rank

  • Disclose now vs. hope it does not come up during the clearance investigation.
    This is not a career decision in the traditional sense — it is the foundational integrity choice of the CTT career. The investigators are thorough and experienced. A foreign contact, financial irregularity, or social media inconsistency that was not disclosed in the SF-86 but is discovered during the investigation is treated as a deliberate omission, not an oversight. The adjudicator's assessment of an undisclosed item discovered mid-investigation is systematically worse than the same item disclosed at submission. If something makes you want to not disclose it, that is the most reliable signal that it must be disclosed. The CTT career has no alternative route around the TS/SCI. There is no fallback MOS that keeps you in the community. Disclose everything and let the adjudicator decide.
  • Stay in the follow-on pipeline track vs. request a community crossover if the SIGINT technical work is not the right fit.
    The A-School phase is the right time to recognize if the CTT technical track is genuinely not the right fit — before the investment deepens on both sides. The signals technical work is intellectually demanding, heavily classification-governed, overwhelmingly SCIF-based, and not visible to most of the Navy. If you arrived expecting the signals-intercept maritime picture from the recruiter and are finding the parametric analysis and IC-report-writing reality significantly different, the conversation with the LPO and the career counselor about a crossover should happen during the schoolhouse phase, not after two operational billets. The Navy can route a cleared, technically capable Sailor in several directions; a Sailor who completes the pipeline and then spends three years in a seat that is wrong for them is a cost to both sides.
  • NEC specialization track — beginning to understand the paths available and which senior CTTs to learn from.
    The CTTSN stage is too early to make binding NEC specialization decisions, but not too early to start learning the landscape. CTT NEC codes reflect technical specialization within the community — different emitter families, different analytical disciplines, different collection environments. The Sailors who get the most out of the early career are the ones who arrive at the first operational command already asking senior CTTs what the different paths actually look like day-to-day. Pull the current NAVPERS 18068 NEC catalog (Vol II) and the current CTT source-rating NAVADMIN and read the NEC descriptions as a research exercise. You will not fully understand what they mean until you have been at the operational billet for six months — but having the framework before you arrive means the first deployment cycle is a deliberate technical investment rather than an accidental one.

How the Seat Varies by Unit Type

  • NAVSECGRU Command / Naval Information Warfare Activity
    The traditional SIGINT collection and analysis command structure. The work is signals technical analysis against the mission set the command is assigned. Watch-rotation driven, SCIF-based, production-quota focused. The CTTSN arriving here encounters the full range of CTT senior leadership — LPOs, LCPO chiefs, and Master Chiefs who have been in the technical community for 15-20 years. The mentorship depth is significant; the pace is unforgiving of shortcuts.
  • Fleet Cyber Command / NAVIFOR Element
    Broader cyber and information operations context. The CTT billet here may sit adjacent to CWT and CT-I and CT-R personnel, and the mission integration with the broader cyber enterprise is more visible. The CTTSN who checks in here encounters a different flavor of the community than the traditional NAVSECGRU structure — more joint-duty context, more interoperability with DoD cyber components, potentially more DoD 8140 work-role emphasis in how billets are structured.
  • Joint SIGINT Site / NSA-Affiliated Command
    The most joint-force-intensive assignment path for a junior CTT. Personnel from multiple services and multiple IC components work in the same spaces. The CTT arriving here is a Navy enlisted Sailor in a workforce where GS civilians, Army signals specialists, Air Force intel analysts, and contract personnel are all doing adjacent work. The IC analytic standards become the common language rather than Navy-specific procedures. Broader exposure, more complex classification and access management, significant professional development opportunity if you are self-directed.
  • Deployed SIGINT Support Element
    A forward-deployed billet supporting fleet or joint operations. The CTTSN landing here early in the career is in a high-tempo, operationally consequential environment before the formal qualifications are fully established. The pace accelerates everything — PQS completion, position qualification, production standards. The CTTSN who has not built the clearance hygiene and OPSEC discipline as genuine habits before deploying discovers the consequences fast. The upsides are real: operational relevance, accelerated qualification, and a professional credibility that CONUS billets take longer to build.

What Good Looks Like at This Rank

The good CTTSN is the student whose security officer knows their name for exactly one reason: foreign-contact reports arrived on time, not because of a problem. Every other interaction with the security office is zero-drama administrative processing. The A-School academic record is not necessarily the top of the class — it is solid, built-on-foundation work that shows the student actually internalized the material rather than memorized it for the test. When the PQS appears on the LPO's desk at day 45 of the first operational assignment, it is mostly filled. When the first position qualification is granted, the senior CTT's comment is that the new CTT3 was already running at the standard before the formal qual was signed. The CTTSN who finishes the first 18 months without administrative flags — no clearance delays from omissions, no security incidents, no recycled pipeline courses — is invisible in exactly the right way. In a community where the investigation, the pipeline, and the clearance posture are the first thing every senior checks, invisibility at the CTTSN level is the high-performer signal. The senior CTT who receives this Sailor says two things to the LCPO: the clearance is clean and the technical foundation is there. That is enough to build on.

Preview — The Next Rank

CTT3 is the rank where the classroom ends and the SCIF watch begins. The parametric analysis you practiced in A-School labs now runs against real collection, and the senior CTT reviewing your work products will tell you within the first two weeks whether the schoolhouse actually prepared you or whether you need remediation on material you should already own. The intellectual gap between A-School and the operational billet is real and normal — the CTT3 who expects it and prepares accordingly covers it in weeks rather than months. The NWAE for CTT2 advancement becomes the primary professional development task alongside the work-role qualification. Pull the current BIB from MyNavyHR / NETC in the first week at the operational billet and build a study schedule that treats the exam as a 12-month preparation project, not a 60-day cram. The CTT2 slate is competitive in a small community — every senior CTT knows who is on the study schedule and who is not, and that knowledge feeds the eEVAL ranking that determines whether you make the slate when the window opens. The broader shift at CTT3 is from student to analyst. The production quota, the analytic review, the watch turnover, the section's clearance posture — these are now your responsibilities, not your LPO's. The CTTSN who understood this shift was coming and built toward it during the schoolhouse phase is the CTT3 who earns the harder watch position before the 12-month mark.
FAQ

CTT E1-E3 — Frequently Asked Questions

Q01What does a E1-E3 CTT (Cryptologic Technician (Technical)) actually do?
After RTC Great Lakes you head to CTT A-School at the Center for Information Warfare Training (CIVT), Corry Station NAS Pensacola.
Q02What's the most important thing to know as a E1-E3 CTT?
The clearance investigation owns your timeline — not the schoolhouse, not your orders, not your detailer.
Q03What does a typical day look like for a E1-E3 CTT?
Time-blocked day at the E1-E3 CTT rank tier: 0530 PT formation at school or command. A-School runs its own PT schedule at Corry Station — runs, circuits, or unit PT depending on the week and the cadre. Clearance investigators are running in parallel with every school day; keep the phone away from anything classified, 0630–0700 Shower, chow, morning admin if needed — security paperwork, foreign-contact reports, anything the security officer is waiting on gets handled before class, not after, 0730 A-School classroom block. Signals theory, EW fundamentals, modulation and frequency concepts,…
Q04What mistakes get E1-E3 CTT soldiers fired or relieved?
SF-86 inconsistency or omission. The investigators find undisclosed foreign contacts and financial irregularities. The lie is always worse than the underlying fact — disclose everything, even if it is uncomfortable, and let the adjudicator make the call; OPSEC breach on personal devices or social media. One sentence about the pipeline, the assignment track, or what you are studying is a reportable incident.…
Q05What career decisions matter most at the E1-E3 CTT rank tier?
Disclose now vs. hope it does not come up during the clearance investigation — This is not a career decision in the traditional sense — it is the foundational integrity choice of the CTT career. The investigators are thorough and experienced. A foreign contact, financial irregularity, or social media inconsistency that was not disclosed in the SF-86 but is discovered during the investigation is treated as a deliberate omission, not an oversight. The adjudicator's assessment of an undisclosed item discovered mid-investigation is systematically worse than the same item disclosed at submission.…
Q06What's next after E1-E3 for a CTT (Cryptologic Technician (Technical)) in the Navy?
CTT3 is the rank where the classroom ends and the SCIF watch begins.
Q07What manuals and regulations does a E1-E3 CTT need to know cold?
CIVT / NETC — Center for Information Warfare Training catalog (netc.navy.mil); verify the current CTT A-School and follow-on course structures before quoting them.; ICD 203 — Analytic Standards (ODNI) — the IC tradecraft standard your analysis will be measured against.; ICD 206 — Sourcing Requirements for Disseminated Analytic Products.

Based on 14 tips from 0 contributors

Published by the Honest MOS Editorial DeskVerified against DoD/.gov sourcesUpdated May 2026Editorial standards