Career.

# Federal Capability Statement

**Used in:** [expert/09: Procurement from the engineer's chair](/lessons/expert/09)

## How to use

A capability statement is your business card for federal work. Contracting officers and primes scan it in under 30 seconds. The job is to answer three questions fast: who are you, what can you do, and have you done it before.

Fill in every bracketed slot. If you cannot fill one, that is a gap to fix before you send this out. Do not invent past performance. One real project beats three you cannot defend.

Export the final version to PDF. Two pages. Not three. Not one.

---

## Page 1

### Company Overview

**[COMPANY NAME]**
[ADDRESS]
[WEBSITE]

| Field | Value |
|---|---|
| UEI | [UEI] |
| CAGE Code | [CAGE CODE] |
| Primary NAICS | [NAICS PRIMARY] |
| Secondary NAICS | [NAICS SECONDARY] |
| Certifications | [CERTIFICATIONS] |

**Point of Contact**
[POC NAME], [POC TITLE]
[POC EMAIL] | [POC PHONE]

---

### Core Competencies

- [COMPETENCY 1]
- [COMPETENCY 2]
- [COMPETENCY 3]
- [COMPETENCY 4]

Keep each to one line. A noun phrase, not a sentence. Example: "RAG pipelines on classified networks." Not: "We help our customers build retrieval-augmented generation pipelines."

---

### Differentiators

What makes you different from the other 200 small businesses on this NAICS code? Three to five bullets. Be concrete.

- [DIFFERENTIATOR 1]
- [DIFFERENTIATOR 2]
- [DIFFERENTIATOR 3]
- [DIFFERENTIATOR 4]
- [DIFFERENTIATOR 5]

Bad: "World-class team with deep expertise."
Good: "All five engineers hold TS/SCI with CI poly. Two are former NSA."

---

## Page 2

### Past Performance

Three projects. Use the same format for each. If you do not have three, list one or two and say so. Lying gets you debarred.

**Project 1**
Customer: [PROJECT 1 CUSTOMER]
Period: [PROJECT 1 PERIOD]
Value: [PROJECT 1 VALUE]
Scope: [PROJECT 1 SCOPE]

**Project 2**
Customer: [PROJECT 2 CUSTOMER]
Period: [PROJECT 2 PERIOD]
Value: [PROJECT 2 VALUE]
Scope: [PROJECT 2 SCOPE]

**Project 3**
Customer: [PROJECT 3 CUSTOMER]
Period: [PROJECT 3 PERIOD]
Value: [PROJECT 3 VALUE]
Scope: [PROJECT 3 SCOPE]

Scope is two or three lines. What did you build, on what contract vehicle, and what was the outcome the customer cared about.

---

### Corporate Data

| Field | Value |
|---|---|
| DUNS (legacy) | [DUNS] |
| Socio-economic certs | [SOCIO-ECONOMIC CERTS] |
| SAM.gov status | Active |
| Bonding capacity | If applicable |

---

### Contact

[POC NAME]
[POC TITLE]
[POC EMAIL]
[POC PHONE]
[WEBSITE]

---

## Formatting notes for the PDF

- Two pages. Hard limit. Cut competencies before you spill to a third page.
- One font. Use a system font like Calibri, Arial, or Helvetica. 10 or 11 point body.
- Header in your brand color. The rest in black on white.
- Logo top left or top center. Not both. Not huge.
- Margins 0.5 inch minimum.
- Save as `CapStatement_[COMPANY]_YYYY-MM.pdf`. Date the file so the recipient knows it is current.
- Update it every quarter. An old cap statement signals an inactive company.

# DD-254 Walkthrough

**Used in:** [cleared/01: Cleared AI landscape](/lessons/cleared/01)

## How to use

The DD-254 is not a form you fill in. It is a form your customer or prime fills in and sends to you. Your job is to read it carefully and know what each block means before you accept the work.

This walkthrough goes block by block. Read it once cover to cover. Then keep it next to you when a real DD-254 lands in your inbox.

If any block on a real DD-254 does not match what was promised verbally, stop. Talk to your Facility Security Officer (FSO) before you sign anything or start work.

---

## What the DD-254 is

The DD Form 254, Contract Security Classification Specification, tells a contractor what classified information they will access on a contract, at what level, and what rules apply. It is the legal handshake that says "this contract is cleared work, and here are the boundaries."

No DD-254, no classified work. If a prime asks you to start before a DD-254 is in place, that is a red flag.

---

## Block-by-block

### Block 1: Clearance and Safeguarding

**1a: Facility Clearance Required.** The level of facility clearance (FCL) your company needs. Confidential, Secret, or Top Secret.

**1b: Level of Safeguarding Required.** What you must be able to store at your facility. Often lower than 1a. You can have a Secret FCL but not be cleared to store anything ("Secret, no safeguarding").

**Gotcha:** If 1b says "None" you cannot store classified at your site. All work happens at the customer location or an approved facility.

### Block 2: Type of Contract

Prime contract, subcontract, IDIQ, BPA, etc. Tells you where you sit in the contract chain.

### Block 3: Contract Numbers and Dates

The contract number and period of performance. Check the dates against your offer letter or subcontract agreement. Mismatches happen.

### Block 4: Is This a Follow-On Contract?

If yes, the previous contract number is listed. This matters for record retention and continuity of access.

### Block 5: Final DD-254

Marked when the contract is closing out. Tells you to destroy or return classified material.

### Block 6: Contractor Information

Name, address, and CAGE code of the contractor. Confirm this is your company.

### Block 7: Subcontractor Information

If you are the prime and have cleared subs, they go here.

### Block 8: Actual Performance Location

Where the classified work happens. Customer site, your facility, both, or other.

**Gotcha:** Remote cleared work usually requires a SCIF or approved alternate work location. "Work from home" and "Secret" do not mix unless you have a home SCIF. You do not have a home SCIF.

### Block 9: General Identification of Procurement

A short description of the contract. Read it. If it does not match what you were briefed on verbally, ask.

### Block 10: Contractor Will Require Access To

The heart of the form. Check boxes for the types of classified access you will have. Common ones:

- 10a: COMSEC
- 10b: Restricted Data
- 10c: Critical Nuclear Weapon Design Information
- 10d: Formerly Restricted Data
- 10e: Intelligence Information (SCI, non-SCI)
- 10f: Special Access Program (SAP)
- 10g: NATO
- 10h: Foreign Government Information

Each box has its own training, briefings, and reporting requirements. SCI means you need SCI indoctrination. SAP means program-specific read-on.

### Block 11: In Performing This Contract, the Contractor Will

What activities you will actually do. Boxes for: receive classified, generate classified, fabricate hardware, perform services only, have TEMPEST requirements, have OPSEC requirements, and others.

**Gotcha:** If 11 says you will generate classified and your team has no derivative classifier trained, you have a training gap before day one.

### Block 12: Public Release

Whether public release of information about the contract requires customer approval. Almost always yes for classified work. Do not post about the contract on LinkedIn.

### Block 13: Security Guidance

Where your classification guidance comes from. Usually a Security Classification Guide (SCG) referenced by number. You need to read that SCG before you can derivatively classify anything.

### Block 14: Additional Security Requirements

Free text. The customer adds anything the form did not cover. Read every word. Custom requirements live here.

### Block 15: Inspections

Which agency inspects your security program. Usually DCSA. Sometimes a different cognizant security agency for SCI or SAP.

### Block 16: Certification and Signature

Government signature block. If this is blank, the DD-254 is not in effect.

---

## Common gotchas

- **Block 10 mismatch.** You were told the work was Secret. Block 10 has SCI checked. Stop. The clearance ramp-up just got months longer.
- **Block 1b says "None" but you were told to expect to bring work home.** You cannot. Ask where the SCIF is.
- **Block 13 references an SCG you do not have access to.** Ask the prime or FSO to provide it before kickoff.
- **Block 8 lists a location that is not your office or the customer site.** Find out where it is and whether you have to relocate.
- **No signed Block 16.** Not a real DD-254 yet. Do not start work.

---

## What to ask your FSO before you sign

1. Have you reviewed this DD-254? Does it match the FCL we hold?
2. Are all the boxes in Block 10 within what our personnel are cleared for today?
3. Do we have the training in place for Block 11 activities?
4. Where is the SCG referenced in Block 13? Can I get a copy?
5. What is our reporting obligation timeline once I am read on?
6. Are there any conflicting DD-254s on other contracts I support?

---

## What to ask the prime

1. Is this the final DD-254 or a draft?
2. Who is the customer Contracting Officer's Representative (COR) for security questions?
3. What is the read-on process and timeline?
4. Where is the performance location physically? Address, building, room.
5. Is there a separate SAP or SCI brief I will need beyond this DD-254?

---

## When to escalate to your security officer

Escalate immediately if:

- The DD-254 lists access you do not hold and no plan to upgrade exists.
- The performance location is not approved for the safeguarding level.
- You are asked to do classified work before the DD-254 is signed in Block 16.
- The Block 14 text contains requirements your facility cannot meet (TEMPEST, two-person integrity, specific safe types).
- The prime asks you to ignore or work around any block.

A bad DD-254 is a security violation waiting to happen. A 30-minute conversation with your FSO is cheaper than a security incident report.

# Cleared Resume Bullets

**Used in:** [cleared/06: Talking about your work without violating](/lessons/cleared/06)

## How to use

You worked on classified programs. You cannot say what, where, or for whom. You still need a resume that gets you the next job.

Five patterns below. Each shows the structure, a bad example, and a good example. The bad examples are fictional. The good examples are fictional. Do not copy them. Use them as a shape and write your own.

When in doubt, run your final draft past your FSO before you post.

---

## Pattern 1: Problem type + customer type + scale + impact

**The pattern.** Describe the *kind* of problem, the *type* of customer, the *scale* of the work, and the *outcome*. Never the specific customer, program name, or location.

**Bad example (fictional):**
> Built RAG pipeline for NSA Project HARVEST that searched 4M classified documents across SIPR and JWICS for the SIGINT directorate.

Why it is bad: names the agency, names the program, names the network, names the directorate. Four violations in one sentence.

**Good example (fictional):**
> Built retrieval system over millions of documents for an intelligence community customer on a high-side network. Cut analyst search time by 60%.

Why it works: "intelligence community customer" describes the type. "High-side network" describes the environment without naming it. Scale is real, impact is real.

---

## Pattern 2: Technology + role + team size + outcome

**The pattern.** Lead with the technology stack and what you did with it. The customer is generic. The team size shows scope.

**Bad example (fictional):**
> Lead engineer on $40M CIA contract building Llama 3 70B inference cluster on AWS GovCloud TS region for OSD/AT&L analysts.

Why it is bad: names the agency, names the dollar value (often FOUO), names the specific cloud region, names the end customer office.

**Good example (fictional):**
> Led 6-engineer team deploying open-weights LLM inference on a classified cloud environment. Served thousands of analysts across a federal customer.

Why it works: technology is generic enough. Team size is real. "Classified cloud environment" is fine. "Federal customer" is fine.

---

## Pattern 3: Compliance framework + accomplishment

**The pattern.** When your work involved a public framework (FedRAMP, NIST, STIGs, DISA), you can name the framework. You cannot name the specific system that went through it.

**Bad example (fictional):**
> Took ODNI's IC GPT system through FedRAMP High ATO in 9 months.

Why it is bad: names the agency and the system.

**Good example (fictional):**
> Led FedRAMP High ATO for a generative AI platform. Authored SSP, ran control assessments, achieved authorization in under 12 months.

Why it works: framework is public, accomplishment is concrete, system identity is hidden.

---

## Pattern 4: Skill demonstrated + measurable outcome

**The pattern.** Lead with a skill the next employer cares about. Show the outcome. Skip the program details entirely.

**Bad example (fictional):**
> Wrote prompt injection detection for NGA's geospatial AI assistant after a red team finding in Q3 2024.

Why it is bad: names the agency, names the system, dates the incident.

**Good example (fictional):**
> Designed prompt injection defenses for a production LLM application. Reduced successful injection rate from 14% to under 1% on internal red team tests.

Why it works: skill is hireable, numbers are real, no program identity.

---

## Pattern 5: Clearance + access without naming the program

**The pattern.** Your clearance level is a credential. You can list it. You cannot list the specific compartments or programs unless the program is publicly acknowledged.

**Bad example (fictional):**
> TS/SCI with CI poly. Read on to TALENT KEYHOLE and BYEMAN. Current on Project STELLAR access.

Why it is bad: names compartments, names programs.

**Good example (fictional):**
> TS/SCI with CI polygraph. Current SCI accesses with multiple intelligence community customers.

Why it works: clearance level is fine to state. "Current SCI accesses" signals you are read on somewhere without saying where.

---

## Closing checklist

Before you publish or send any bullet, answer yes to all six:

1. Have I removed every program name, code word, and project nickname?
2. Have I removed every specific agency, directorate, or office name?
3. Have I removed every specific location (building, base, city when paired with mission)?
4. Have I removed every specific dollar value that is not publicly available?
5. Have I checked that combining this bullet with my other bullets does not create a mosaic that identifies a program?
6. If this bullet went on LinkedIn tomorrow, would my FSO have a problem with it?

If any answer is no, rewrite. If you are not sure, ask your FSO. "I asked first" is a much better story than "I posted and got called in."

# LinkedIn Audit Checklist

**Used in:** [foundations/05: AI for your transition](/lessons/foundations/05)

## How to use

Go through the 25 items in order. Each has a one-line "why." Mark each item done, not done, or not applicable. Do not skip. The items you want to skip are usually the ones that matter most.

Budget 90 minutes the first time. Revisit every 90 days.

---

## Headline

**1. Headline reads like a job title plus value, not a rank.**
Why: Recruiters search by job title. "Cybersecurity Engineer | Cloud Security | TS/SCI" beats "SFC, US Army."

**2. Headline does not lead with clearance.**
Why: Clearance belongs in the About section or skills. Leading with it can look thirsty and triggers OPSEC questions.

**3. Headline includes one keyword a recruiter would search.**
Why: If you want AI jobs, the word "AI" or "ML" should be in the headline.

---

## About section

**4. First sentence states what you do now or want to do next.**
Why: LinkedIn cuts the About section to about three lines in the preview. The first line decides if anyone reads on.

**5. No military jargon in the first paragraph.**
Why: Civilian recruiters do not know what S-3 or O-6 means. Translate or skip.

**6. About section is written in first person.**
Why: Third person reads cold. "I led" beats "John led."

**7. About section ends with a clear call to action.**
Why: "DM me about AI engineering roles in DC" gives the recruiter the next step.

---

## Current role framing

**8. Current role title is translated to civilian language.**
Why: "Operations Manager" is searchable. "First Sergeant" is not.

**9. Current role description leads with outcomes, not duties.**
Why: "Cut deployment time 40%" beats "Responsible for unit readiness."

**10. Current role uses bullets, not paragraphs.**
Why: Recruiters scan. Walls of text get skipped.

---

## Branch translation

**11. Acronyms are spelled out at least once.**
Why: "NCOIC" means nothing outside the military. "Lead supervisor (NCOIC)" works.

**12. Civilian-equivalent job titles appear in parentheses where useful.**
Why: "Platoon Sergeant (mid-level operations manager)" tells a recruiter what to compare you to.

**13. Numbers replace ranks where possible.**
Why: "Led 40 people and a $2M equipment account" lands. "Was an E-7" does not.

---

## Photo and banner

**14. Photo is a recent, clear, head-and-shoulders shot.**
Why: No photo gets fewer profile views. A photo from 12 years ago is worse than no photo.

**15. Photo is not in uniform unless you are still in.**
Why: A uniform photo signals you have not transitioned mentally. If you are still in, uniform is fine.

**16. Banner is not the default blue.**
Why: The default banner says "I have not put 10 minutes into this." A skyline, a logo, anything is better.

---

## Skills

**17. Top 3 skills match the job you want next.**
Why: LinkedIn weights the top 3 heavily in search.

**18. Skills include 1 to 2 specific technical tools.**
Why: "Python" or "Splunk" or "AWS" gets you into keyword searches. "Leadership" does not.

**19. Skills are endorsed by at least 5 people.**
Why: Endorsements are weak signal but zero endorsements is a negative signal.

---

## Recommendations

**20. At least 3 recommendations are visible on the profile.**
Why: Three is the threshold where the profile looks active. Zero looks dead.

**21. At least one recommendation is from a civilian or from someone who has transitioned.**
Why: A wall of military recommendations tells a civilian recruiter you have not built a civilian network yet.

---

## Activity

**22. You have posted, commented, or shared something in the last 30 days.**
Why: Recruiters check recent activity. A dead profile gets passed over.

---

## Security and settings

**23. Clearance level is not in the headline or banner.**
Why: Putting "TS/SCI" in your headline is an OPSEC flag, especially if your company and location are also public. Put it in skills or About.

**24. "Browse privately" is enabled when you are job searching at your current company.**
Why: Otherwise your boss sees you browsed the VP's profile at 11pm.

**25. Connection visibility is set to "only you" if you are cleared.**
Why: Your connection list is a target. Foreign collection looks at cleared engineers' networks. Lock it down.

---

## After the audit

Fix the items that are broken. Do not try to do all 25 in one sitting. Pick 5 today, 5 next week, and so on.

Then put a recurring 90-day reminder on your calendar. Profiles drift.