What is the ISSO Mentorship Program?

The CMS ISSO Mentorship Program seeks to improve the overall readiness and skill of Information System Security Officers (ISSOs) at CMS by creating opportunities for knowledge sharing and support among ISSOs of all experience levels. Both mentors and mentees benefit from a partnership that is structured enough to provide growth towards defined goals – yet flexible enough that anyone can participate.

Because the role of an ISSO is critical for ensuring security and privacy compliance for FISMA systems, this program dedicated to helping ISSOs succeed improves the overall security posture and culture at CMS.

Is mentorship right for me?

If you are an ISSO at CMS (either federal staff or contractor support), you are eligible for the program. There are many benefits to participating in mentorship as either a mentee or a mentor.

For mentees

You may want to consider participating as a mentee if:

You are a new ISSO at CMS.

Whether you are brand new to the role of Information System Security Officer or you are onboarding as a Service ISSO, teaming up with an experienced CMS ISSO can smooth your orientation and help you gain confidence in your new role. Your mentor can point you to resources, teach you to use them effectively, and share tips about the CMS “way of doing things”.

You are dealing with an unfamiliar or challenging task.

Even if you’re not a new ISSO, the mentorship program offers an opportunity for bootstrap support on new or challenging projects. You can be paired with an experienced ISSO and benefit from their lessons learned – whether that means getting support towards a long-term goal like Authorization to Operate (ATO) or focused assistance on a specific task.

You want to expand your skills as an ISSO.

Mentorship isn’t just for onboarding or overcoming challenges. It can also be a tool for relationship building and professional development. You may choose to participate in the program to expand your skills and learn about new tools or practices. Having a trusted peer in your field can help you reach beyond your comfort zone and grow your career and network.

You are not an ISSO, but want to learn about the role.

Even non-ISSOs can apply to be mentored, with approval from their supervisor and the ISSO Support Team. If you are thinking of transitioning to an ISSO role, mentorship provides an opportunity to get real-world insight and advice.

For mentors

You may want to consider participating as a mentor if:

You enjoy helping others.

We encourage experienced ISSOs to consider the motto, “Pass it on!” Knowing that much of your current success is the result of others’ investment of time and energy in your life, you may want to pay that investment forward by helping someone else to grow and learn.

You want to expand your leadership skills.

Mentoring offers a way for experienced ISSOs to practice interpersonal skills such as active listening, establishing trust, and teaching by example. These skills are valued by employers and co-workers alike – and are essential for advancing into leadership roles. Serving as a mentor also gives you a practical way to demonstrate your hard-earned expertise.

You care deeply about CMS security culture.

Information security and privacy at CMS are not just for compliance – they are essential for building trust with our beneficiaries, customers, and the American public. Mentoring provides an opportunity to build a more knowledgeable ISSO workforce and advance security awareness at CMS, resulting in a stronger overall security posture for our FISMA systems.

You value self-reflection and continuous improvement.

A growth mindset remains important even for experienced ISSOs. Mentoring a peer can motivate you to learn more about yourself and identify areas where you want to continue learning. In a healthy mentorship, the mentee will often have valuable insights for the mentor as well.

How it works

The mentorship program is flexible and based on the specific needs of mentors and mentees. The ISSO Support Team works with interested individuals to find an appropriate partner for a mentorship engagement (based on the goals and desired outcomes of both parties). From there, the two ISSOs decide how they will work together and for how long.

What mentorship is not

While ISSO mentorship can bring valuable benefits to both of the people involved, it’s important to understand what the program is not meant to address.

• Mentors don’t complete work on behalf of mentees. They can offer support, resources, and lessons learned – but the mentee remains responsible for their own work.
•  Mentorship is not Training. Mentorship focuses on a personalized, long-term relationship with a more experienced individual providing guidance and support based on their experience, while training is a structured process of delivering specific knowledge and skills through a set curriculum, often in a group setting, with a more teacher-student dynamic.
• Mentorship is not a shortcut. While it will help mentees be more effective in their role, the mentorship itself requires an investment of time and energy. It’s not an “easy fix” for challenges, but rather an opportunity for both people to grow their skills.
• The mentor is not a manager. The mentee does not report to the mentor, and the mentor does not evaluate the mentee. Instead, they share and learn together in a structured yet flexible arrangement.
• Mentorship is not a requirement. The ISSO Mentorship Program is a completely voluntary – though highly encouraged – opportunity for growth and professional development.

Successful ISSO mentorship at CMS

Mentoring has proven to be a highly beneficial activity for cybersecurity professionals, but not everyone is familiar with how mentorships should work. To be successful in partnership with another ISSO, keep the following in mind:

Mentoring is a two-way street.

Both mentors and mentees will benefit from a healthy mentoring partnership. They can both learn from one another – regardless of age, background, or level of experience. Successful mentorships are built on mutual trust and willingness to learn. This doesn’t mean the mentor and mentee must become friends, but they should have respect and appreciation for one other.

Mentees hold the most responsibility.

It may surprise you to learn that the mentor is not the primary driver of the partnership. In the ISSO Mentorship Program, mentees have the greater responsibility to set goals, schedule meetings, and prepare materials and questions in advance to make sure time is spent effectively. While both people can share some of these responsibilities, the mentee should consider themselves the main driver.

It's okay to end a mentorship that isn't working.

Not all partnerships are an ideal match. This could be due to various factors such as logistical challenges, a shift in priorities for either party, or personality differences. It’s important to communicate with clarity and empathy – and be willing to amicably end the mentorship if it’s not working well. This is not a negative reflection on the mentor or mentee.

Steps to get started

Whether you want to be a mentor or mentee, these are the steps you can take to begin participation in the ISSO Mentorship Program:

Tips for mentors

You will be most successful as a mentor in the program if you:

• Teach by example. Remember the mentee will take their cues from your actions (not only your words). Model the behaviors and work ethics that will help them succeed.
• Share about failures as well as successes. You as a mentor are not expected to be perfect. Sharing lessons learned from past failures will help your mentee avoid similar mistakes.
• Keep the mentee at the center. While you as a mentor will definitely benefit from the partnership, remember that the mentee’s growth and learning is top priority.
• Use helpful frameworks. While ad hoc conversations can be beneficial, your mentee might benefit from the use of structured frameworks such as SMART goals and SWOT analysis.
• Be open to learning. Mentors – and not just mentees – can expect to grow and learn from the partnership. Keep an open mind, and see what your mentee may be able to teach or show you.
• Share experiences instead of dictating actions. You can explain how you handled a similar situation or make suggestions based on past lessons learned – but try to let the mentee come to their own conclusions.
• Be a connector. Your knowledge of people and resources at CMS are a treasure trove to your mentee. Point them to valuable tools like the ISSO Handbook and introduce them to more people they can learn from.
• Be honest. Don’t be afraid to challenge your mentee if their ideas or actions are headed off-course. Be kind but direct with your feedback so they can improve and hold themselves accountable to their goals.
• Be approachable and available. Regular connection with your mentee is necessary for you to maintain a thriving relationship. While the two of you will decide together on meeting frequency, make sure they feel comfortable reaching out for guidance.
• Ask for help. Even as the mentor, you can ask questions or get help anytime from the ISSO Support Team: ISSO@cms.hhs.gov. Please don’t hesitate to reach out.

Tips for mentees

You will be most successful as a mentee in the program if you:

• Set SMART goals. Take time to document clear goals with specific outcomes SMART goals are Specific, Measurable, Achievable, Relevant, and Time-Bound. Make sure your goals for the mentorship are realistic, taking the availability and experience of your mentor into consideration.
• Take responsibility. Your mentor can provide tools and advice, but you are ultimately responsible for your own growth and learning. Be an active and eager participant in the process. Take initiative and take notes!
• Take appropriate risks. Your mentor may help you stretch beyond your comfort zone and lean in to new opportunities. Appropriate risk-taking is excellent for growth. Don’t be afraid to make mistakes as long as you learn from them.
• Respect your mentor’s time. Remember your mentor is a volunteer, giving of their time to help you grow. Make the most of the time you have with them. Always come prepared with an agenda, and let them know well in advance if you need to reschedule.
• Understand your mentor’s limits. Your mentor will help you as much as they can, but if you have a need they can’t address because of limited time or lack of experience in a specific realm, they will point you to resources or other people who can help.
• Give helpful feedback. Be honest about your needs and goals. Ask questions if there’s something you don’t understand. Your mentor can’t read your mind, so let them know if there’s something else they can do to help – and when they are doing a great job!
• Invest in the relationship. Trust and mutual respect do not happen automatically when the mentorship begins. You can nurture the relationship by showing appreciation, communicating thoughtfully, and demonstrating a growth mindset.
• Ask for help. Remember your mentor is there to support you, so ask questions when you have them. Regarding the mentorship itself, you can also ask questions or get help anytime from the ISSO Support Team: ISSO@cms.hhs.gov.

ISSO resources

For anyone participating in the ISSO Mentorship Program, it’s important to have quick access to ISSO resources provided by CMS and other organizations. 

The CMS Information Systems Security Officer (ISSO) Handbook is the authoritative guide for everything a CMS ISSO needs. As a mentor or mentee, this handbook is your trusted tool to help you find useful information like:

Tips for getting started - Everything a new ISSO needs for onboarding at CMS, including self-assessment, initial meetings, and goals for the first year.

Role and responsibilities - Learn what’s expected of an ISSO at CMS, and how to perform all required duties.

ISSO toolkit - Everything you need to be successful as an ISSO, including helpful documents, events, Slack channels, tools, and programs.

Training opportunities - Browse free training offerings from CMS and HHS to help ISSOs of all skill levels advance their knowledge and grow in their careers.