ISSO Mentorship Program

What is the ISSO Mentorship Program?

At the Centers for Medicare & Medicaid Services (CMS), the ISSO Mentorship Program seeks to improve the overall readiness and skill of Information System Security Officers (ISSOs) by creating opportunities for knowledge sharing and support among ISSOs of all experience levels. 

Through structured yet flexible mentor-mentee partnerships, participants gain valuable insights, guidance, and support tailored to their individual growth goals. This collaborative approach ensures that everyone, regardless of where they are in their career, has the opportunity to thrive.

Because the role of an ISSO is critical for ensuring security and privacy compliance for FISMA systems, this program — dedicated to helping ISSOs succeed — improves the overall security posture and culture at CMS.

The program’s intended outcome is to help ISSO mentees:

• Understand and internalize the responsibilities of an ISSO 
• Receive personalized support and feedback from an experienced ISSO mentor 
• Develop and strengthen technical and soft skills 
• Gain insights into career progression in the cybersecurity field

Sign up for mentorship

To request a mentor, fill out the ISSO Mentee Signup Form.

To become a volunteer mentor, fill out the ISSO Mentor Signup Form.

The ISSO Support Team will review your application and get in touch with you to discuss the process of pairing you with a mentorship partner. 

If you have questions about the program, contact the ISSO Support Team: ISSO@cms.hhs.gov with Mentorship in the subject line. Read the rest of this page to get more information about the program.

How does it work?

The mentorship program is flexible and based on the specific needs of mentors and mentees. The ISSO Support Team works with interested individuals to find an appropriate partner for a mentorship engagement based on the goals and desired outcomes of both parties. From there, the two ISSOs decide how they will work together and for how long.

Upon successful completion of the program, mentees receive a Certificate of Completion and become eligible to serve as a mentor in the future.

Who should participate? 

If you are an ISSO at CMS (either federal staff or contractor support), you are eligible for the program. There are many benefits to participating in mentorship as either a mentee or a mentor.

You may want to participate as a mentor if you enjoy helping others and want to expand your leadership skills. Being an ISSO mentor is a significant contribution towards upskilling the ISSO workforce and strengthening security culture at CMS. To learn more about what to expect as a mentor, read the Mentor Guide.

You may want to participate as a mentee if you are new to the ISSO role at CMS, want to expand your skills, or are facing an unfamiliar or challenging task. Your mentor can help you gain confidence in your role, expand your network, and reach beyond your comfort zone. If you’re a cybersecurity professional interested in an ISSO role, you may participate as an ISSO mentee if you meet the prerequisites. To learn more about what to expect as a Mentee, read the Mentee Guide.

Prerequisites for mentors

• Have at least 3-5 years of experience as an ISSO or similar role
• Demonstrate expertise in cybersecurity policies, frameworks, and best practices
• Commit to the mentorship responsibilities outlined in the Mentor Guide
• Have your manager’s approval

Prerequisites for mentees

• Be a current CMS ISSO (federal or contractor)
• Have foundational cybersecurity knowledge (e.g., NIST Risk Management Framework, Incident Response, Security Compliance)
• Have clearly defined areas for growth and learning (mentorship objectives)
• Have your manager’s approval

Time commitment and duration

Mentorship time commitment is flexible. Mentors and mentees decide on a meeting cadence that works for both of them and allows the mentee to achieve agreed-upon goals and milestones. 

The duration of the partnership is also flexible, but it should be clearly defined in advance by both the mentor and mentee.

Mentorship pathway

These are the standard stages of the mentoring relationship through the ISSO Mentorship Program at CMS:

1. Intake / matching

• Mentees apply to the program through the Mentee Signup Form, and mentors apply to volunteer through the Mentor Signup Form.
• Mentees complete the ISSO Scorecard and Cybersecurity Knowledge Assessment (CKA) — or provide already-completed scores during the sign-up process.
• Mentees are matched with a mentor based on respective needs, availability, and experience levels.

2. Introductory meeting

• Introductory meeting is scheduled between the new mentor and mentee (this can be facilitated by the ISSO Mentorship Program Lead if needed).
• The mentor, mentee, and Program Lead discuss:
  • Overall objectives of the ISSO Mentorship Program
  • System portfolio needs of the mentee
  • Skills assessment results and areas for growth

3. Goal-setting and needs analysis

• Everyone works together to determine gaps in mentee capabilities that will be addressed by the mentorship.
• Specific training is recommended as needed based on the mentee’s experience and skill level (this could include ISSO Boot Camp, Advanced Cybersecurity Concepts, CFACTS training, or others).
• Specific and measurable objectives are defined for the mentoring partnership.
• Everyone discusses expectations for the mentoring partnership (see Mentee Guide and Mentor Guide for details).

4. Establishment of regular check-ins

• The mentor and mentee have their first 1:1 working meeting, and establish a cadence for future meetings.
• Together, they decide on a duration for the mentoring relationship and decide on a meeting cadence that works for both parties.
• Consistent 1:1 meetings are held to monitor progress and maintain learning momentum.
• Opportunities for feedback (surveys, discussions, etc.) are available for both mentors and mentees throughout the engagement to ensure continuous improvement for the Mentorship Program.

5. Conclusion and offboarding

• The mentor and mentee review the mentee’s accomplishments and confirm that the goals have been met.
• Mentee receives a certificate of completion, and is officially offboarded from the program.
• Mentor and mentee both complete an exit interview or survey as a feedback mechanism, which is reviewed by program administrators and used to make improvements to the program.

Successful ISSO mentorship at CMS

Mentoring has proven to be a highly beneficial activity for cybersecurity professionals, but not everyone is familiar with how mentorships should work. To be successful in partnership with another ISSO, keep the following in mind:

• Mentoring is a two-way street: Both mentors and mentees will benefit from a healthy mentoring partnership. They can both learn from one another – regardless of age, background, or level of experience.
• Mentees hold the most responsibility: The mentor is not the primary driver of the partnership. Mentees have the greater responsibility to set goals, schedule meetings, and prepare materials and questions in advance to make sure time is spent effectively.
• It's okay to end a mentorship that isn't working: This could be due to various factors such as logistical challenges, a shift in priorities for either party, or personality differences. It’s important to communicate clearly and be willing to amicably end the mentorship if it’s not working well. This is not a negative reflection on the mentor or mentee.
• The mentor is not a manager: They don’t complete work on behalf of mentees or hold any formal responsibility for mentees. Both parties will learn from each other, and the mentee is responsible for their own work.
• Mentorship is not training: Mentorship is a personalized opportunity for growth and learning from a volunteer individual over a period of time. Formal training with a teacher-student dynamic is still important for CMS ISSOs in addition to mentorship.

Need help?

If you have questions about the program, contact the ISSO Support Team: ISSO@cms.hhs.gov with Mentorship in the subject line. You can also ask questions in #cms-isso in CMS Slack.