| | |
|---|---|
| **Document ID** | CERG-GOV-JD-EXEC-002 |
| **Version** | 1.0 |
| **Status** | Approved |
| **Classification** | Public |
| **Owner** | CISO |
| **Parent Policy** | [`CERG-POL-001`](../../governance/CERG-POL-001_Cybersecurity_Policy.md) - Cybersecurity Policy |
| **Review Cycle** | Annual |
| **Frameworks** | NIST SP 800-181r1 (NICE) |
| **Regulations** | Cross-cutting |
| **Environments** | All CERG-managed workforce |

---

# Executive Sponsor

**Job Family:** JF-EXEC — Executive Leadership
**Job Level Range:** L1-L4 (CERG Grade Executive)
**CERG Canonical Role:** Executive Sponsor ([CERG-GOV-OM-001](../../governance/CERG-GOV-OM-001_CERG_Operating_Model.md) §6.1)

---

## 1. Role Summary

The Executive Sponsor is the business voice in the cybersecurity program. They are a senior business or operational leader who provides concurrence for Critical risk acceptance, sits on the Cyber Oversight Group, and endorses the Cybersecurity Policy on behalf of the business. The Executive Sponsor is not a cybersecurity professional; they are the bridge that ensures cybersecurity risk decisions are made with business context.

## 2. NICE Workforce Framework Mapping

| Mapping Level | NICE Work Role | NICE Work Role ID | NICE Work Role Category |
|---------------|----------------|-------------------|-------------------------|
| Primary | Business role; not mapped to NICE | N/A | N/A |

**NICE Work Role Definition:** See [JF-002](../CERG-GOV-JF-002_NICE_Workforce_Framework_Crosswalk.md) for the official NICE Work Role definition and complete CERG-to-NICE mapping. The NICE TKS database is available at https://www.nist.gov/nice/framework/.

## 3. Job Family & Level Placement

| Family | JF-EXEC — Executive Leadership |
|--------|---------------------------|
| Level Range | L1 through L4 |
| CERG Grade Range | Executive |
| Terminal Grade | Executive — see [JA-001 §7](../../governance/CERG-GOV-JA-001_Job_Architecture_and_Grade_Framework.md) for details |
| Track | Executive |

## 4. Key Responsibilities

### 4.1 Core Responsibilities (All Grades)

- Concur on Critical risk acceptance decisions, providing the independent business view required by the Risk Management Framework - Serve on the Cyber Oversight Group as the business representative - Endorse the Cybersecurity Policy on behalf of the business - Escalate business concerns about cybersecurity controls, friction, or risk posture to the CISO - Ensure that cybersecurity risk decisions account for operational, financial, and strategic business impact - Advocate for cybersecurity investment with business-unit peers

### 4.2 Grade-Level Responsibility Differentiation

Grade-level responsibility differentiation for this role is defined in [JA-001 §7](../../governance/CERG-GOV-JA-001_Job_Architecture_and_Grade_Framework.md) (Role-to-Grade Mapping). The grade definitions (S1-S4 SME Track, M1-M4 Management Track) and leveling dimensions are in [CERG-GOV-JA-001](../../governance/CERG-GOV-JA-001_Job_Architecture_and_Grade_Framework.md) §4-5. Behavioral anchors at each grade are in [CMP-001](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md).

## 5. Required Knowledge, Skills, and Abilities (KSAs)

### 5.1 Domain Expertise

- Deep understanding of the organization's business model, operations, and risk tolerance - Senior leadership credibility within the organization - Ability to evaluate risk in business terms: revenue impact, operational disruption, regulatory exposure, reputational harm - No cybersecurity expertise required; this is a business role, not a technical one

### 5.2 Technical Skills

Technical skills for this role are documented in the original JD-001 content extracted into this file (see §5.1 Domain Expertise). Additional technical skill definitions aligned to NICE Skill Statements are maintained in [JF-002](../CERG-GOV-JF-002_NICE_Workforce_Framework_Crosswalk.md).

### 5.3 CERG-Specific Knowledge

CERG-specific knowledge requirements for this role are defined in [OM-001 §6](../../governance/CERG-GOV-OM-001_CERG_Operating_Model.md) (Canonical Role Roster) and [RAC-001 §7](../../governance/CERG-GOV-RAC-001_Consolidated_Roles_and_RACI_Instrument.md) (Role Descriptions). See §12 (Related CERG Documents) for the complete list of standards and procedures relevant to this role.

## 6. NICE TKS Statement References

The following Task, Knowledge, and Skill statements are extracted from the NIST NICE Framework v2.2.0 Work Role [OG-WRL-007 — Executive Sponsor primary mapping] and filtered by relevance to this CERG role. The full TKS database is maintained at https://www.nist.gov/nice/framework/.

| NICE TKS Type | Statement ID | Statement Summary | Relevance to This Role |
|---------------|-------------|-------------------|------------------------|
| Task | T1056 | Acquire resources to support cybersecurity program goals and objectives | Core work activity for this NICE Work Role |
| Task | T0006 | Advocate organization's official position in legal and legislative proceedings | Core work activity for this NICE Work Role |
| Task | T1055 | Determine if priority information requirements are satisfied | Core work activity for this NICE Work Role |
| Task | T1057 | Conduct an effective enterprise continuity of operations program | Core work activity for this NICE Work Role |
| Task | T1059 | Perform cost/benefit analyses of cybersecurity programs, policies, processes, systems, and elements | Core work activity for this NICE Work Role |
| Knowledge | K1025 | Knowledge of decision-making policies and procedures | Foundational knowledge for this role |
| Knowledge | K0644 | Knowledge of cybersecurity operation policies and procedures | Foundational knowledge for this role |
| Knowledge | K0674 | Knowledge of computer networking protocols | Foundational knowledge for this role |
| Knowledge | K0675 | Knowledge of risk management processes | Foundational knowledge for this role |
| Knowledge | K0676 | Knowledge of cybersecurity laws and regulations | Foundational knowledge for this role |
| Skill | S0707 | Skill in developing comprehensive cyber operations assessment programs | Core capability for this role |
| Skill | S0708 | Skill in executing comprehensive cyber operations assessment programs | Core capability for this role |
| Skill | S0111 | Skill in interfacing with customers | Core capability for this role |
| Skill | S0406 | Skill in developing policy plans | Core capability for this role |
| Skill | S0414 | Skill in evaluating laws | Core capability for this role |

> **Full TKS Reference:** The complete TKS statement set for the primary NICE Work Role (OG-WRL-001 → OG-WRL-007) is in the NICE Framework Components v2.2.0 dataset ([download](https://csrc.nist.gov/csrc/media/Projects/cprt/documents/nice/v2-2-0_nf_components.json)). JF-002 contains the complete CERG-to-NICE crosswalk with secondary role mappings.

## 7. Typical Qualifications

### 7.1 Education

- Senior business or operational leader (VP, SVP, or equivalent) - Accountable for business outcomes that depend on the systems and data CERG protects - Appointed by the CEO or COO in consultation with the CISO

### 7.2 Certifications

Certifications for this role are defined in [TRN-001 §3](../../governance/CERG-GOV-TRN-001_Training_Development_and_Certification_Framework.md) (Certification Matrix). The matrix specifies Required, Recommended, and Aspirational certifications per role and grade.

### 7.3 Experience

Typical experience ranges by grade are defined in [JA-001 §4-5](../../governance/CERG-GOV-JA-001_Job_Architecture_and_Grade_Framework.md). See §7.1 (Education) above for education requirements.

## 8. Key Performance Indicators (KPIs)

KPIs for this role are defined in [MTR-001](../../governance/CERG-GOV-MTR-001_Metrics_Dashboard_and_Reporting.md) (Metrics, Dashboard, and CISO/Board Reporting). KPI allocation by job family and grade-level thresholds are documented in [PERF-001](../../governance/CERG-GOV-PERF-001_Performance_Management_and_Promotion_Framework.md). Each role's evaluation criteria are embedded in the per-role JD document structure defined by [JF-001](../CERG-GOV-JF-001_Job_Families_Overview.md).

## 9. Competency Expectations by Grade

Competency expectations for this role follow the Management Track Competency Addendum ([CERG-GOV-CMP-001](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md) §7). The five management-specific domains are: People Leadership, Strategic Thinking, Resource and Budget Management, Stakeholder Management, and Organizational Development. Grade-level expectations (M1-M4) for each domain are in [CERG-GOV-CMP-001](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md) §7. This role is also expected to demonstrate SME competencies in the relevant home pillar at or above S2 level, as defined in [CERG-GOV-CMP-001](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md) §1.

| [CERG-GOV-CMP-001](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md) §7 Domain | M1 Expectation | M2 Expectation | M3 Expectation | M4 Expectation |
|-------------------|----------------|----------------|----------------|----------------|
| People Leadership | Conducts regular, meaningful 1:1s. Sets clear expectations. Delivers honest performance feedback promptly. | Develops the Managers reporting to them. Ensures consistent people-management practices. | Builds a leadership bench. Shapes the people strategy. | Accountable for the entire pillar's talent health. Develops next generation of leaders. |
| Strategic Thinking | Translates pillar goals into actionable team tasks. Prioritizes team work against organizational objectives. | Defines a function strategy and roadmap. Anticipates changes affecting priorities. | Shapes pillar strategy. Identifies emerging organizational needs. | Sets multi-year strategic direction. Aligns pillar with org strategy. |
| Resource and Budget Management | Manages team resources effectively. Identifies resource gaps. | Owns the function's budget input. Manages vendor relationships. | Owns significant budget lines. Builds multi-year resource plans. | Owns the pillar's budget. Makes investment cases to leadership. |
| Stakeholder Management | Represents the team effectively. Manages stakeholder expectations honestly. | Manages complex stakeholder relationships across functions. | Manages executive stakeholder relationships. Represents CERG externally. | Manages the organization's most critical stakeholder relationships. |
| Organizational Development | Contributes to team culture and morale. Recognizes contributions publicly. | Builds a positive, high-performance culture within the function. | Shapes organizational culture across the pillar. Leads change initiatives. | Shapes organizational culture across CERG. Designs org model. |

> **Full Reference:** See [CERG-GOV-CMP-001](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md) §7 for the complete Management Track Competency Addendum. Grade definitions (M1-M4) are in [CERG-GOV-JA-001](../../governance/CERG-GOV-JA-001_Job_Architecture_and_Grade_Framework.md) §5. The role-specific SME competency matrix from the home pillar is available in [CERG-GOV-CMP-001](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md) §4-6 as applicable.

## 10. Success Profile

An Executive Sponsor is successful when cybersecurity is resourced and governed as a business priority, not a technical cost center. Key indicators: the sponsor ensures that cybersecurity has a seat at the leadership table; budget requests are evaluated against risk, not against last year's spend; the sponsor champions security culture from the top; the CISO has direct access to the sponsor without going through intermediaries. The sponsor's success is measured by whether the organization's security posture improves during their tenure, not by whether an incident occurred.

## 11. Career Path

### 11.1 Within-Family Progression

The Executive Sponsor is a business-side accountability, not a CERG employee progression path. Selection is based on executive authority over the affected business risk, ability to commit resources, and accountability for accepted risk. The role may rotate among senior business leaders as business scope, regulatory exposure, or transformation priorities change. No CERG grade promotion is attached to this role.

---

### 11.2 Cross-Family Movement

Cross-family movement options are defined in the [Family-to-Family Career Lattice (JF-001 §4)](../CERG-GOV-JF-001_Job_Families_Overview.md#4-family-to-family-career-lattice). The Left-Right Knowledge Model ([FRM-001 §9.2](../../governance/CERG-GOV-FRM-001_CERG_Framework.md)) and cross-training expectations ([OM-001 §10.4](../../governance/CERG-GOV-OM-001_CERG_Operating_Model.md)) operationalize cross-family career movement.

### 11.3 Management Track Option

The Executive Sponsor is a business leadership role outside the CERG grade structure. See [CERG-GOV-OM-001](../../governance/CERG-GOV-OM-001_CERG_Operating_Model.md) §5 for the Executive Sponsor's role definition. CERG's Management track for internal roles is documented in [CERG-GOV-JA-001](../../governance/CERG-GOV-JA-001_Job_Architecture_and_Grade_Framework.md) §5 and [CERG-GOV-CMP-001](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md) §7.

## 12. Related CERG Documents

| Document | ID | Relevance |
|----------|-----|-----------|
| Operating Model | [`CERG-GOV-OM-001`](../../governance/CERG-GOV-OM-001_CERG_Operating_Model.md) | Canonical role name; pillar structure |
| RACI Instrument | [`CERG-GOV-RAC-001`](../../governance/CERG-GOV-RAC-001_Consolidated_Roles_and_RACI_Instrument.md) | This role's accountability assignments |
| Job Architecture | [`CERG-GOV-JA-001`](../../governance/CERG-GOV-JA-001_Job_Architecture_and_Grade_Framework.md) | Grade definitions; progression criteria |
| Competency Model | [`CERG-GOV-CMP-001`](../../governance/CERG-GOV-CMP-001_Competency_Model_and_Behavioral_Anchors.md) | Full behavioral anchors |
| Performance Framework | [`CERG-GOV-PERF-001`](../../governance/CERG-GOV-PERF-001_Performance_Management_and_Promotion_Framework.md) | Performance review cadence and calibration |
| Training Framework | [`CERG-GOV-TRN-001`](../../governance/CERG-GOV-TRN-001_Training_Development_and_Certification_Framework.md) | Certification matrix |
| Job Families Overview | [`CERG-GOV-JF-001`](../CERG-GOV-JF-001_Job_Families_Overview.md) | Family structure and level definitions |
| NICE Crosswalk | [`CERG-GOV-JF-002`](../CERG-GOV-JF-002_NICE_Workforce_Framework_Crosswalk.md) | NICE Work Role mapping |

---

## 13. Document Control

| Field | Value |
|---|---|
| **Document ID** | CERG-GOV-JD-EXEC-002 |
| **Version** | 1.0 |
| **Status** | Approved |
| **Effective Date** | 2026-06-11 |
| **Classification** | Public |
| **Owner** | CISO |
| **Approved By** | CISO |
| **Parent Policy** | [`CERG-POL-001`](../../governance/CERG-POL-001_Cybersecurity_Policy.md) - Cybersecurity Policy |
| **Review Cycle** | Annual |
| **Next Scheduled Review** | 2027-06-11 |
| **Frameworks** | NIST SP 800-181r1 (NICE) |
| **Regulations** | Cross-cutting |
| **Environments** | All CERG-managed workforce |

### Revision History

| **Version** | **Date** | **Author** | **Change Summary** |
|---|---|---|---|
| 1.0 | 2026-06-11 | Governance Pillar Leader | Initial release. Extracted from monolithic JD-001 into enhanced per-role format with NICE mapping, KPI sections, and competency anchor sections. |

### Review Triggers

- Change to this role's definition in [CERG-GOV-OM-001](../../governance/CERG-GOV-OM-001_CERG_Operating_Model.md) §6.1
- Change to this role's NICE Work Role mapping in JF-002
- Change to this role's grade range in [CERG-GOV-JA-001](../../governance/CERG-GOV-JA-001_Job_Architecture_and_Grade_Framework.md) §7
- Direction from the CISO

Governance owns this document. The Governance Pillar Leader (Policy & Standards) is responsible for initiating reviews, managing the revision cycle, and obtaining approval for all changes.

### Related Documents

| **Document** | **ID** | **Relationship** |
|---|---|---|
| Cybersecurity Policy | [`CERG-POL-001`](../../governance/CERG-POL-001_Cybersecurity_Policy.md) | Parent policy |
| Job Families Overview | [`CERG-GOV-JF-001`](../CERG-GOV-JF-001_Job_Families_Overview.md) | Family structure and level definitions |
| NICE Crosswalk | [`CERG-GOV-JF-002`](../CERG-GOV-JF-002_NICE_Workforce_Framework_Crosswalk.md) | NICE Work Role mapping |
