10-Year Industry Transition Roadmap & Statutory Compact Horizon

To transform cybersecurity from an unregulated corporate cost center into a federally recognized skilled trade, the industry requires a realistic, phased transition strategy.

Recognizing that statutory licensing compacts (analogous to the Interstate Medical Licensure Compact or NCEES Professional Engineering standard) require sustained multi-state legislative coordination, this roadmap separates Voluntary Market Adoption (Years 0-5) from Statutory Interstate Codification (Years 5-10).

1. Phased 10-Year Strategic Horizons

+─────────────────────────────────────────────────────────────────────────────+
| Phase 1: Private Market Adoption & JATC Pilots (Years 0 - 2)                |
| • Non-profit Board/Guild incorporation  • JATC pilot cohorts                |
| • Insurer premium credits               • Grandfathering portfolio audits   |
+─────────────────────────────────────────────────────────────────────────────+
                                       │
                                       ▼
+─────────────────────────────────────────────────────────────────────────────+
| Phase 2: Federal Procurement & Critical Infrastructure (Years 3 - 5)        |
| • Defense/Federal contractor clauses    • Critical sector adoption (ICS/Med)|
| • Actuarial loss data published         • Model state compact drafted       |
+─────────────────────────────────────────────────────────────────────────────+
                                       │
                                       ▼
+─────────────────────────────────────────────────────────────────────────────+
| Phase 3: Interstate Compacts & Statutory Safe Harbors (Years 5 - 10)        |
| • Model bill passed in pilot states     • Interstate compact reaches quorum |
| • Mandatory sign-off for critical infra • Statutory safe harbor enacted     |
+─────────────────────────────────────────────────────────────────────────────+

2. Phase Breakdown & Milestones

Phase 1: Voluntary Market Adoption & Institutional Chartering (Years 0 - 2)

• Four-Pillar Institutional Chartering: Simultaneous 501(c)(6) non-profit incorporation of the National Cybersecurity Trade Board (NCTB), the Cybersecurity Craft Guild (CCG), the Participating Employer Council (PEC), and the Cyber Underwriting & Actuarial Advisory Consortium (CUAAC).
• Federal DOL Apprenticeship Registration: Formally registering the National Guidelines for Apprenticeship Standards (NGAS) with the U.S. Department of Labor under 29 CFR Part 29 and Part 30.
• JATC Pilot Cohorts: Launching DOL-registered apprenticeship cohorts in 3 to 5 regional industrial and technology hubs in partnership with public community colleges and PEC employer sponsors.
• Actuarial Risk Incentive Program: Implementing CUAAC standardized underwriting warranty schedules, granting 25% to 35% Preferred Risk premium credits for organizations maintaining compliant Journeyman-to-Apprentice ratios (2:1).
• Grandfathering Review Windows: Opening the 24-month structured portfolio evaluation window for experienced practitioners to transition into Journeyman or Master Practitioner tiers.

Phase 2: Critical Infrastructure & Procurement Standards (Years 3 - 5)

• Federal Procurement Integration: Introducing preferential procurement scoring in federal defense contracts (FAR/DFARS) for suppliers employing licensed Master Practitioners and maintaining auditable apprentice ratios.
• Critical Sector Standardization: High-reliability industries (ICS/SCADA, MedTech/IoMT, nuclear, defense industrial base) adopt trade sign-off standards into operational safety baselines.
• Actuarial Baseline Report: Publishing the first comprehensive 5-year actuarial study comparing breach frequency and claim severity between trade-staffed vs. unstandardized organizations.
• Drafting the Model Compact Legislation: Partnering with the Council of State Governments (CSG) to draft the National Cybersecurity Trade Licensure Compact (NCTLC).

Phase 3: Statutory Interstate Compacts & Safe Harbor (Years 5 - 10)

• State Legislative Enactment: Introducing and passing the NCTLC across state legislatures, beginning with a 5-to-10 state founding compact quorum.
• Mutual Reciprocity & Mobility: Full digital multi-state licensure enabling direct interstate physical and remote deployment of Journeymen and Masters.
• Mandatory Master of Record (MoR) Statutory Sign-Off: Codifying statutory requirements for public utilities, municipal infrastructure, and healthcare networks to maintain a designated MoR.
• Affirmative Defense / Statutory Safe Harbor: State laws establish a legal safe harbor against punitive data-breach damages for enterprises operating under trade compliance and respecting MoR safety sign-offs.
• The Fallback Statutory Mandate Bridge: If private cyber insurance syndicates restrict underwriting capacity, the trade framework automatically activates pre-drafted statutory bridges into mandatory Federal Procurement (FAR/DFARS), state Public Utility Commission (PUC) operational licenses, and federal infrastructure grant rules (CISA/IIJA), permanently sustaining trade adoption.

3. Grandfathering & Legacy Transition Windows

To ensure immediate operational continuity without stranding existing senior professionals or enforcing artificial credential gatekeeping, the Board and Guild administer a structured 24-to-36-month transition window across three parallel on-ramps:

A. The Three Legacy Transition Tracks

+─────────────────────────────────────────────────────────────────────────────+
|               INCOMING EXPERIENCED PRACTITIONER ON-RAMPS                   |
+─────────────────────────────────────────────────────────────────────────────+
                                       │
         ┌─────────────────────────────┼─────────────────────────────┐
         ▼                             ▼                             ▼
+─────────────────+           +─────────────────+           +─────────────────+
|    TRACK A:     |           |    TRACK B:     |           |    TRACK C:     |
| Career Runtime  |           | Benchmark Fast- |           | Practical Live  |
|  & Portfolio    |           | Track (Optional)|           | Challenge Exam  |
| (Zero Certs)    |           | (Active/Lapsed) |           | (No Paperwork)  |
+─────────────────+           +─────────────────+           +─────────────────+
         │                             │                             │
 • 4+ yrs (8k hrs)             • Historical CISSP,           • 4-hour proctored
   W-2 / 1099 proof              CISM, GSLC, etc.              range lab
 • 2 peer affidavits           • Permanent RTI credit        • Instant technical
 • Direct Journeyman             regardless of AMF             validation
         │                             │                             │
 • 8+ yrs (16k hrs)            • Combined with               • Full Journeyman
   + 3 artifacts                 runtime for Day-1             Licensure on
 • Oral Board Defense            Journeyman/Master             Day 1
 • Master Standing                             │                             │
         └─────────────────────────────┼─────────────────────────────┘
                                       ▼
+─────────────────────────────────────────────────────────────────────────────+
|                     DAY-1 RESPECTFUL TRADE PLACEMENT                        |
| • 4+ Years Runtime: Direct Licensed Journeyman (100% RJPB Floor)            |
| • 8+ Years Runtime: Direct Master Candidate / Oral Board (135% - 150% RJPB) |
+─────────────────────────────────────────────────────────────────────────────+

1. Track A: Career Runtime & Peer Portfolio Review (Zero Certifications Required):
   • Legacy Journeyman Standing (4+ Years / 8,000+ Verified Hours): Demonstrated through W-2s, 1099s, military service records (DD-214), or employer verification letters, paired with two professional reference affidavits confirming operational execution across core defensive domains.
   • Legacy Master Practitioner Standing (8+ Years / 16,000+ Verified Hours): Demonstrated through verifiable senior engineering runtime, submission of three sanitized engineering artifacts (e.g., system architecture blueprint, incident response post-mortem, detection engineering repository, or regulatory compliance filing), and successful defense before a three-member Master Practitioner Oral Board.
2. Track B: Benchmark Fast-Track (Active or Lapsed Credentials):
   • Durable RTI Credit: Any recognized multi-domain benchmark examination ever passed by the practitioner (including CISSP, CISM, GSLC, CISA, CCSP) is permanently credited as Related Technical Instruction (RTI).
   • Zero AMF Penalization: Lapsed credential status has zero negative impact; practitioners are never required to pay back-dues or active annual maintenance fees (AMFs) to commercial certification vendors.
   • Combined with verified runtime (4+ years for Journeyman, 6+ years for Master), Track B enables rapid administrative verification with expedited portfolio processing.
3. Track C: Practical Range Challenge Track (Hands-On Fast Path):
   • Designed for non-traditional candidates, CTF competitors, independent security researchers, or contractors seeking immediate validation without compiling historical employment paper trails.
   • Passing the proctored, 4-hour hands-on Board Practical Challenge Examination awards immediate Licensed Journeyman standing.
   • The 5-Domain Modular Station Architecture (4-Hour Proctored Exam):
     • Station 1 (Perimeter, Cloud & Network Defense - 45 min): WAF and egress rule authoring, zero-trust microsegmentation, and control-plane policy remediation.
     • Station 2 (Detection Engineering & Incident Triage - 50 min): Live SIEM/EDR alert telemetry triage, containment execution, and Sigma/YARA detection rule generation.
     • Station 3 (IAM & Cryptographic Controls - 45 min): Privilege escalation remediation, PAM policy authoring, and PKI key rotation ceremonies.
     • Station 4 (Vulnerability & Attack Surface Management - 45 min): Attack surface analysis, patch prioritization, and automated remediation scripting.
     • Station 5 (Defensive GRC & Control Verification - 45 min): Log audit attestation, baseline compliance validation, and exception documentation.
   • Automated Scoring & Passing Thresholds: Pre-warmed lab environments execute automated, deterministic scoring scripts evaluating container state, rule executions, and policy checks. Candidates must achieve a minimum 80% aggregate passing score across all five stations, with no single domain station scoring below 70%.
   • Grandfathering Retake & Cooldown Policy:
     • Attempt Cooldowns: A mandatory 30-day cooldown applies between Attempt 1 and Attempt 2; a 60-day cooldown applies between Attempt 2 and Attempt 3. Retakes are capped at a maximum of three (3) attempts within a 12-month rolling window.
     • Modular Station Retest Option: A candidate who achieves >=80% on four stations but fails a single station (<70%) is granted a 60-day Modular Retake Window to re-test only the failed station.
     • Fallback PLA Placement: Candidates who do not achieve a full passing score after three attempts receive structured placement credit: scoring >=70% on 3 or 4 stations awards direct placement into Apprentice Tier 4 (6,000 hours credited / 80% RJPB wage floor); scoring >=70% on 1 or 2 stations awards placement into Apprentice Tier 3 (4,000 hours credited / 70% RJPB wage floor).

B. Grandfathering Transition Summary Table

C. International Practitioner Portability, Foreign Credential Evaluation & Visa Equity

The Cybersecurity Trade Project separates immigration status from technical engineering competence. Foreign-trained engineers, international practitioners, and work-authorized visa holders (H-1B, TN, O-1, L-1, E-3, and Permanent Residents) possess full access to trade licensure:

1. Foreign Operational Experience Verification: Operational runtime logged with international employers, foreign government entities, or multinational corporations is fully credited toward Track A (8,000+ hrs) or Track C challenge eligibility. International tax documents, foreign employer letters, or verified client engagements satisfy documentation requirements.
2. International Credential & Degree Articulation: Technical degrees from accredited international universities and global cybersecurity certifications (e.g., CREST, ISO/IEC 27001 Lead Implementer, OffSec) are evaluated by the Board Credential Evaluation Clearinghouse for direct Prior Learning Assessment (PLA) and Related Technical Instruction (RTI) credits.
3. Prevailing Wage (RJPB) Anti-Exploitation Floor: Under 20 CFR § 655.731, participating employers sponsoring H-1B or specialty occupation visa holders must compensate licensed practitioners at or above 100% of the Regional Journeyman Prevailing Benchmark (RJPB). This eliminates predatory wage suppression, prevents abusive third-party contracting margins, and guarantees visa workers full market compensation.
4. Immigration Sponsorship Anti-Coercion Protections: Under the trade Code of Ethics and Section 274B of the Immigration and Nationality Act (INA), threatening to revoke, delay, or withhold visa sponsorship or legal status as leverage against a technical safety refusal (Form FORM-001) or grievance is classified as a Class C Major Ethical Violation. Sponsoring employers engaging in immigration retaliation face immediate loss of preferred insurance discount tiers, mandatory JATC arbitration, and formal reporting to federal labor authorities. Affected workers receive confidential representation through the Guild Ombudsperson under the Blind Whistleblower Proxy.
5. Classified Defense Scope Carveout: In accordance with federal statutory mandates (e.g., NISPOM / DoD 5220.22-M, ITAR), positions requiring U.S. government security clearances remain restricted to U.S. citizens pursuant to federal law. All commercial, enterprise, financial, healthcare, cloud, and SaaS operational seats remain fully open to legally authorized international practitioners.

4. Post-Transition Pipeline & Sunsetting (Year 4 Onwards)

Upon the conclusion of the 36-month transition window (Year 4 onwards), provisional grandfathering on-ramps sunset permanently to protect the long-term integrity of the trade license.

+─────────────────────────────────────────────────────────────────────────────+
|               PERMANENT POST-TRANSITION PIPELINE (YEAR 4+)                  |
+─────────────────────────────────────────────────────────────────────────────+
                                       │
         ┌─────────────────────────────┴─────────────────────────────┐
         ▼                                                           ▼
+─────────────────────────────────+         +─────────────────────────────────+
|     STANDARD APPRENTICESHIP     |         |     LATERAL DIRECT CHALLENGE    |
|   (New Entrants / Career Chg)   |         |    (Experienced Practitioners)  |
+─────────────────────────────────+         +─────────────────────────────────+
         │                                                           │
 • 8,000 OJT hours (Domains 1-5)             • 8,000+ verified runtime hours
 • 576 RTI hours                             • Documented W-2 / 1099 / DD-214
 • PLA credits capped at 4,000 hrs           • Formal portfolio audit
         │                                                           │
         └─────────────────────────────┬─────────────────────────────┘
                                       ▼
+─────────────────────────────────────────────────────────────────────────────+
|               MANDATORY BOARD PRACTICAL CHALLENGE EXAMINATION               |
|         • 4-Hour 5-Domain Proctored Exam (Required for All Journeymen)      |
+─────────────────────────────────────────────────────────────────────────────+
                                       ▼
                        FULL LICENSED JOURNEYMAN STANDING

A. Permanent Sunset of Provisional Grandfathering Tracks

• Track A Sunset: Uncredentialed career runtime alone no longer grants direct Day-1 Journeyman Licensure without passing the Board Practical Challenge Examination.
• Track B Sunset: Commercial vendor certifications (CISSP, CISM, GSLC) no longer grant standalone Day-1 licensure; they convert into standard Related Technical Instruction (RTI) classroom transfer credits within the apprenticeship system.
• Track C Grandfathering Sunset: Zero-documentation, unverified exam challenges are retired as a standalone grandfathering mechanism.

B. Permanent Post-Transition Pathways

1. Graduating Apprenticeship Pathway:
   • All standard registered apprentices completing their 8,000 on-the-job training (OJT) hours and 576 Related Technical Instruction (RTI) hours must pass the 4-Hour Board Practical Challenge Examination as their mandatory exit licensing gate.
   • High-aptitude candidates, degree holders, and military veterans may apply Prior Learning Assessment (PLA) credits to bypass up to 4,000 hours (50% Residency Floor), but must complete the remaining 4,000 hours of live supervised operational practice before challenging the exam.
2. Permanent Lateral Direct Challenge Pathway (Experienced Practitioners):
   • Experienced practitioners entering the trade from unorganized sectors, foreign jurisdictions, or military transitions after Year 3 may challenge the Journeyman Licensure examination directly.
   • Mandatory Prerequisites: The candidate must submit verified documentation of at least 8,000 hours (4+ years) of direct defensive operational runtime through W-2s, 1099s, military DD-214 records, or employer affidavits.
   • Candidates meeting the runtime prerequisite who successfully pass the proctored 4-Hour Board Practical Challenge Examination receive full Licensed Journeyman standing.