# ISO/IEC Competence Requirements for Information Security Professionals

Natalia Miloslavskaya, Alexander Tolstoy

► To cite this version:

Natalia Miloslavskaya, Alexander Tolstoy. ISO/IEC Competence Requirements for Information Security Professionals. 10th IFIP World Conference on Information Security Education (WISE), May 2017, Rome, Italy. pp.135-146, 10.1007/978-3-319-58553-6_12. hal-01690957

HAL Id: hal-01690957

https://inria.hal.science/hal-01690957

Submitted on 23 Jan 2018

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
ISO/IEC Competence Requirements for Information
Security Professionals

Natalia Miloslavskaya and Alexander Tolstoy

The National Research Nuclear University MEPhI (Moscow Engineering Physics Institute),
31 Kashirskoye shosse, Moscow, Russia

{NGMiloslavskaya, AITolstoj}@mephi.ru

**Abstract.** In the modern interconnected world, the requirements for competencies for information security (IS) professionals are needed as never before. The peculiarities of the European approach to the development of IS professional competencies are discussed using the example of the European e-Competence Framework e-CF 3.0. Bases on this, two short content predictions for new ISO/IEC 27021 and ISO/IEC 19896 international standards are proposed.

**Keywords:** Information Security, Competence, Information Security Professionals, ISO/IEC Standards

# 1 INTRODUCTION

The ever-growing need for information security (IS) professionals in this fast-moving field is currently understood worldwide as never before. A professional in any field of activity (including the IS area) must have specific qualifying characteristics. The modern approach to determining them is based on the definition of a set of professional competencies demonstrating a professional's capacity to solve given problems and to perform specific work within his sphere of activity.

We distinguish "competence" from "competency" [1]. Competence refers to the ability to apply knowledge and skills to achieve intended results and to do something well: the quality or state of being competent. It enables a person to function effectively in a job or situation and demonstrate the ability to apply knowledge and/or skills. In turn, competencies support definitions of job classifications/occupational group profiles, roles and responsibilities, position descriptions, duty statements, etc. A competency is traditionally defined as a combination of observable and measurable knowledge (K), skills (S), and abilities (A) (KSA all together) as well as individual attributes and work experience that contribute to enhanced employee performance and ultimately result in organizational success. Knowledge is the cognizance of facts, truths and principles gained from formal training and/or experience. A skill is a developed proficiency or dexterity in mental operations or physical processes that is often acquired through specialized training; using these skills results in successful performance. Ability is the power or aptitude to perform physical or mental activities
that are often affiliated with a particular profession. The ability to apply knowledge and skills in a productive manner, which can be characterized by such attributes of behavior as aptitude, initiative, enthusiasm, willingness, communication skills, team participation, leadership and others, shows the professional's effectiveness.

The efforts to develop a common approach to vocational training's Common Body of Knowledge (CBK) and requirements to the IS professional competencies are underway worldwide for a long time. A CBK is "a collection of information and a framework that provides a basis for understanding terms and concepts in a particular knowledge area" [2] and it relates only to the first competency's component. The first attempts to create a common point of view on the subject in general were in the World International Conferences on IS Education (WISEs) in the late 1990's and early 2000's [3-5]. About the same time, some CBKs for security professionals were initiated by the industry for certification purposes (like CISA, CISSP, GIAC, etc.).

At present, we can say that three key views – American, Australian and European (analyzed in [6]) – have been formed:

* "Information Technology Security Essential Body of Knowledge: A Competency and Functional Framework for IT Security Workforce Development" by the National Cyber Security Division of the U.S. Department of Homeland Security [7] and the more specialized National Initiative for Cybersecurity Education (NICE), led by the National Institute of Standards and Technology [8];

* "Cyber Security Capability Framework & Mapping of IS Manual Roles" [9] by the Australian Government Information Management Office;

* e-Competence Framework 3.0 (e-CF 3.0) by the European Commission [10].

e-CF 3.0 will include four new ISO/IEC standards, as yet uncompleted: 27021 "Information technology -- Security techniques -- Competence requirements for information security management systems professionals"; and three parts of 19896 "Information technology -- Competence requirements for information security testers and evaluators": 1) "Introduction, concepts and general requirements"; 2) "Knowledge, skills and effectiveness requirements for ISO/IEC 19790 testers"; 3) "Knowledge, skills and effectiveness requirements for ISO/IEC 15408 evaluators".

The main goals of this paper are to analyze e-CF 3.0 as a potential source of additional IS professional requirements beyond those of the current ISO/IEC standards on IS professional competence. It is organized as follows. e-CF 3.0 is analyzed in detail in Section 2. In Section 3 and Section 4 we discuss possible contents of the ISO/IEC 27021 and ISO/IEC 19896-1 standards respectively. Key findings conclude the paper.

## 2 THE EUROPEAN e-COMPETENCE FRAMEWORK

e-CF 3.0 is a result of nine years' continuing effort and commitment by multi-stakeholders from the European ICT sector, with the encouragement of the European Commission and strongly backed by the CEN ICT Skills Workshop community. This 53-pages document defines competence as a demonstrated ability to apply knowledge, skills, and attitudes for achieving observable results.
Compared to the four IS functions (Manage, Design, Implement and Evaluate) from [7] and the seven Specialty areas (Securely Provision; Operate and Maintain; Protect and Defend; Investigate; Collect and Operate; Analyze; Oversight and Development) from [8], e-CF 3.0 is structured with four dimensions reflecting different levels of business and human resource planning requirements in addition to job/work proficiency guidelines. Dimension 1 covers five e-Competence areas derived from the ICT business processes, namely Plan (A) – Build (B) – Run (C) – Enable (D) – Manage (E). Dimension 2 reflects a set of reference e-Competences (40 in total) for each area. Dimension 3 describes proficiency levels for each e-Competence. Dimension 4 is a sample of knowledge (K) and skills (S) but not abilities (A) related to e-Competences in Dimension 2.

The main shortcoming of e-CF 3.0 is that it distinguishes e-Competences only for two types of IS professionals – ICT Security Manager and ICT Security Specialist. Table 1 allows us to compare them very easily.

<table><caption>**Table 1.** General description for ICT Security Manager and ICT Security Specialist (e-CF 3.0)</caption><thead><tr><td>ICT Security Manager</td><td>ICT Security Specialist</td></tr></thead><tbody><tr><td>Manages the ICT security policy (ICTSP).</td><td>Ensures the ICTSP's implementation.</td></tr><tr><td>Mission: Defines the ICTSP. Manages security deployment across all Information Systems. Ensures the provision of information availability. Recognized as the ICTSP expert by internal and external stakeholders.</td><td>...Proposes and implements necessary IS updates. Advises, supports, informs and provides IS training and awareness. Takes direct action on all/part-of a network/system. Recognized as the ICT technical IS expert by peers.</td></tr><tr><td>Deliverables: accountable: ICTSP; responsible: Knowledge or Information base, IS strategy; contributor: Risk Management policy, New technology integration proposal, ICT Strategy &amp; Implementation.</td><td>...accountable: Knowledge or Information base (Security); responsible: New technology integration proposal (Security); contributor: Risk Management policy &amp; plan; ICTSP.</td></tr><tr><td>Main tasks: defines and implements procedures linked to ICT security; contributes to the development of the organization's IS policy; establishes the prevention plan; informs and raises awareness among general management; ensures the promotion of the IS charter among users; inspects and ensures that IS principles and rules are applied.</td><td>...ensures security and appropriate uses of ICT resources; evaluates risks, threats and consequences; provides security training/education; provides technical validation of security tools; contributes to definition of security standards; audits vulnerabilities; monitors security developments to ensure ICT resource data and physical security.</td></tr><tr><td>Key performance indicators: ICTSP effectiveness.</td><td>...Security measures in place.</td></tr></tbody></table>

e-Competences for the ICT Security Manager and Specialist are shown in Tables 2 and 3 respectively. As can be seen, they have only one common e-Competence (E.8 IS Management), but with different proficiency levels (PLs). E.8 e-CF 3.0 contains seven K and seven S examples (only examples are given, not the full lists):

* K1-K7: the organization's IS management policy and its implications for engagement with customers, suppliers and subcontractors; the best practices and standards
in IS management; the critical risks for IS management; the ICT internal audit approach; IS detection techniques, including mobile and digital; cyber attack techniques and counter measures for avoidance; computer forensics;

* S1-S7: document the IS management policy, linking it to business strategy; analyze the company critical assets and identify weaknesses and vulnerability to intrusion or attack; establish a risk management plan to feed and produce preventative action plans; perform IS audits; apply monitoring and testing techniques; establish the recovery plan; implement the recovery plan in case of crisis.

<table><caption>**Table 2.** e-Competences for ICT Security Manager (e-CF 3.0)</caption><tr><td>A.7 Technology Trend Monitoring – Investigates latest ICT technological developments to establish understanding of evolving technologies. Devises innovative solutions for integration of new technology into existing products, applications or services or for the creation of new solutions.</td><td>PL 4: Exploits wide ranging knowledge of new and emerging technologies, coupled with a deep understanding of the business, to envision and articulate solutions for the future. Provides expert guidance and advice, to the leadership team to support strategic decision-making.</td></tr><tr><td>D.1 IS Strategy Development – Defines and makes applicable a formal organizational strategy, scope and culture to maintain IS from external and internal threats, i.e. digital forensic for corporate investigations or intrusion investigation. Provides the foundation for IS Management, including role identification and accountability. Uses defined standards to create objectives for information integrity, availability, and data privacy.</td><td>PL 5: Provides strategic leadership to embed IS into the culture of the organization.</td></tr><tr><td>E.3 Risk Management – Implements the management of risk across information systems through the application of the defined risk management policy and procedure. Assesses risk to the organization's business, including web, cloud and mobile resources. Documents potential risk and containment plans.</td><td>PL 3: Decides on appropriate actions required to adapt security and address risk exposure. Evaluates, manages and ensures validation of exceptions; audits ICT processes and environment.</td></tr><tr><td>E.8 IS Management – Implements IS policy. Monitors and takes action against intrusion, fraud, IS breaches or leaks. Ensures that IS risks are analyzed and managed. Reviews IS incidents, makes recommendations for IS policy and strategy to ensure continuous improvement of IS provision.</td><td>PL 4: Provides leadership for the integrity, confidentiality and availability of data stored on information systems and complies with all legal requirements.</td></tr><tr><td>E.9 IS Governance – Defines, deploys and controls the management of information systems in line with business imperatives. Takes into account all internal and external parameters such as legislation and industry standard compliance to influence risk management and resource deployment to achieve balanced business benefit.</td><td>PL 4: Provides leadership for IS governance strategy by communicating, propagating and controlling relevant processes across the entire ICT infrastructure.</td></tr></table>
<table><caption>**Table 3.** e-Competences for ICT Security Specialist (e-CF 3.0)</caption><tr><td>C.2 Change Support – Implements and guides the evolution of an ICT solution. Ensures efficient control and scheduling of software or hardware modifications to prevent multiple upgrades creating unpredictable outcomes. Minimizes service disruption as a consequence of changes and adheres to defined service level agreement (SLA). Ensures consideration and compliance with IS procedures.</td><td>PL 3: Ensures the integrity of the system by controlling the application of functional updates, software or hardware additions and maintenance activities. Complies with budget requirements.</td></tr><tr><td>C.3 Service Delivery – Ensures service delivery in accordance with established SLA's. Takes proactive action to ensure stable and secure applications and ICT infrastructure to avoid potential service disruptions, attending to capacity planning and to IS. Updates operational document library and logs all service incidents. Maintains monitoring and management tools (i.e. scripts, procedures). Maintains IS services. Takes proactive measures.</td><td>PL 3: Programmes the schedule of operational tasks. Manages costs and budget according to the internal procedures and external constraints. Identifies the optimum number of people required to resource the operational management of the IS infrastructure.</td></tr><tr><td>D.9 Personnel Development – Diagnoses individual and group competence, identifying skill needs and skill gaps. Reviews training and development options and selects appropriate methodology taking into account the individual, project and business requirements. Coaches and/or mentors individuals and teams to address learning needs.</td><td>PL 3: Monitors and addressees the development needs of individuals and teams.</td></tr><tr><td>D.10 Information and Knowledge Management – Identifies and manages information and considers information distribution policies. Creates information structure to enable exploitation and optimization of information. Understands appropriate tools to be deployed to create, extract, maintain, renew and propagate business knowledge in order to capitalize from the information asset.</td><td>PL 3: Analyses business processes and associated information requirements and provides the most appropriate information structure.</td></tr><tr><td>E.8 IS Management – Equal to those for ICT Security Manager.</td><td>PL 3: Evaluates IS management measures and indicators and decides if compliant to IS policy. Investigates and instigates remedial measures to address IS breaches. PL 4: Equal to those for ICT Security Manager.</td></tr></table>

The IS competencies are mentioned throughout e-CF 3.0 and incorporated within the relevant dimensions in several places (e.g., K8-security and S4-contribute to the development of ICT strategy and policy, including ICT security and quality for A.1 Information System and Business Strategy Alignment; K6-ICT security standards for A.2 Service Level Management; K2-systems architecture requirements performance, maintainability, extendibility, scalability, availability, security and accessibility for A.5 Architecture Design; K14-security for B.1 Application Development; and K5-best practices and standards in IS management for C.2 Change Support and C.3 Service Delivery, etc.).
## 3 WHAT TO EXPECT FROM ISO/IEC 27021

The ISO/IEC 27000 family of standards is a globally accepted world leading for managing IS in organizations and will be broadened by the new ISO/IEC 27021 "...Competence requirements for information security management systems professionals". Its development started in fall 2013 and final publication is planned for October 2017. In March 2017, ISO/IEC 27021 is at the 40.20 "Draft international standard ballot initiated" stage) (see Fig.1).

<figure><img src="image_2.png" /><figcaption>Fig. 1. ISO/IEC 27021 preview at http://www.iso.org</figcaption></figure>

By providing a required Body of Knowledge (BoK) in the area of IS management (ISM) only, this standard combines with ISO/IEC 27001 [11] to produce a logical continuation of that standard. It is expected to specify the minimum competence requirements and to provide guidelines for setting the BoK for ISM system (ISMS) professionals required for leading or establishing, implementing, maintaining and continually improving ISMS according to the Plan-Do-Check-Act (PDCA) cycle. In the worst case, only elements of the BoK will be given in the standard.

Clause 7.2 of ISO/IEC 27001 supports ISMSs by ensuring that people are competent. For that purpose, the following activities should be performed: identify the competence requirements for those who have an impact on IS performance within an organization; acquire the necessary competence whenever current personnel fail to meet the organization's IS competence requirements; and evaluate the effectiveness of any actions taken to acquire the IS competence that the organization needs to have.
The audience of ISO/IEC 27021 includes, but is not limited to, the following categories: organizations seeking ISMS professionals, to define the competence required for positions in ISMS related roles; educational institutions, to align their syllabi for training ISMS professionals; ISMS professional certification bodies, to use the BoK for examination sources; all ISMS related roles (such as managers, auditors, advisers and others), to prove their competence as ISMS professionals; and students, to understand and attain the competence required for working in the area.

As can be seen in the ISO/IEC 27021 preview, an ISMS professional refers to a person who establishes, implements, maintains and continuously improves one or more ISMS processes. And competence is the ability to apply knowledge and skills to achieve intended results [12].

ISO/IEC 27001 leads to dividing the KSA competencies of ISMS professionals (see Fig. 2) into two groups:

1) *General or domain-independent*, including managerial; and

2) *Professional or domain-specific* for IS and ISMS Planning – Operation – Support – Performance evaluation – Improvement (particularly for the IS and ISMS areas like Risk Management, Incident Management, Auditing, Security Controls, Business Continuity, Forensics, Access Control, Data Protection, Intrusion Prevention, Vulnerabilities Assessment, Physical and Environmental Security, Cryptography, etc.).

<figure><img src="image_3.png" /><figcaption>Fig. 2. ISMS competencies areas</figcaption></figure>

Some examples of general competence are: Organisation organisation design, culture and business, Project Management, Leadership, Governance, Strategies and Policies, IT and Information Systems, Human Resources, Communication, Problem management, Analytical Methods, Efficiency and Effectiveness Measurement, Finance and Budgeting, Compliance, and Supplier Management.

The IS domain-specific competences include but are not limited to knowledge and skills required in the following areas:
1) IS governance within a business governance framework: the organization's business context, IS governance concepts, strategies, standards (such as ISO/IEC 27014) and policies, ISMS-specific legal and regulatory issues, IS assessment methodologies, business continuity, asset management, etc.;

2) IS risk management: IS risk assessment and treating, and their application within the ISMS scope (on ISO/IEC 27005 basis);

3) IS incident management: IS incident detection, reporting, assessment and response, and their application within the scope of ISMS (based on ISO/IEC 27035);

4) IS auditing: internal and external IS audit, monitoring and self-assessment, their application within the scope of ISMS (based on ISO/IEC 27006-27008); and

5) IS controls: IS policy implementation, access control, cryptography, operations and communication security, human resources security, physical and environmental security, system security, compliance, etc.

The ISMS domain-specific competences include but are not limited to knowledge and skills required in the following areas:

1) ISMS Planning: ISM strategy and policies, ISMS scope, objectives, structure, roles, all subprocesses, resources, reporting, communication, etc. with such key knowledge terms as Business impact analysis, assets, IS risk acceptance criteria, IS controls, IS threat modelling, vulnerabilities, etc.;

2) ISMS Operation: ISM subprocess design, implementation, efficient and effective operation and documentation, etc. with such key knowledge terms as security measures, IS monitoring, insider IS threats, IS threat analysis, vulnerability analysis, intrusion detection and prevention system, access control, antivirus software, system log, SIEM, configuration and patch management, etc.;

3) ISMS Support: ISMS subprocess life cycle, documentation, awareness, education and training, information protection tools, etc. with such key knowledge terms as end users' IS training, IS curriculum and training programme, learning objectives, testing, learning management system, etc.;

4) ISMS Performance Evaluation: IS auditing, monitoring, measurement and analysis, as well as determining compliance with external/internal relevant regulation on a periodic basis, etc. with such key knowledge terms as IS monitoring and measurement, control, IS internal and external audits, IS audit programme, scope and criteria, IS effectiveness, vulnerability assessment, etc.; and

5) ISMS Improvement: constant strategic and tactical improvement of all key aspect of ISMS in a timely manner in accordance with the most recent technological innovations and corresponding methodologies and frameworks.

We hope to see more advanced lists in ISO/IEC 27021 than those specified here, with detailed descriptions for each competence.
## 4 WHAT TO EXPECT FROM ISO/IEC 19896-1

Compared to ISO/IEC 27021, the first two parts of ISO/IEC 19896 are at the 30.60 “Close of voting/comment period” stage in March 2017, while the third is at the 10.99 stage (new project approved). Their audience includes IS and IS product evaluation and conformance testing specialists (testers and evaluators), validators, certifiers and approval authorities, testing laboratories, vendors and technical providers as well as organizations offering professional credentialing.

We expect that ISO/IEC 19896-1 will provide an overview of the definitions, the fundamental concepts, and a general description of the framework used to communicate the competence requirements for IT product security evaluations and conformance testing as well as the minimum competence requirements for IT product security evaluators and testers to conduct its testing/evaluation using standards established by the ISO committee CASCO.

Without any doubt, all parts of the ISO/IEC 19896 series will be based on ISO/IEC 17025:2005 “General requirements for the competence of testing and calibration laboratories” [13], which was also prepared by CASCO. ISO/IEC 17025 is frequently specified as a basis for conformity testing amongst security assurance conformance-testing and evaluation laboratories. It addresses the general requirements for the competence of testing and calibration laboratories (a broad range of laboratories, and not only in the field of IT product security assurance testing and evaluation).

Clause 5 of ISO/IEC 17025 requires two important controls: 1) laboratory management, to ensure the competence of all who operate specific equipment, perform tests and/or calibrations, evaluate results and sign test reports and calibration certificates; and 2) personnel performing specific tasks to be qualified on the basis of appropriate education, training, experience and/or demonstrated essential skills. Thus, in order to support conformity in evaluating or conformance-testing IT security products, one of the key factors is the competence of the individuals performing this work.

As for any other professional activity, a minimum competence is needed to support achieving conformity and repeatability of the results. The main elements of competence are the minimum necessary knowledge, skills, experience and qualifications relevant to the target IT product security assurance standard. The CBK is formed from a knowledge of IT product architecture and design in relevant technology areas, all relevant standards, policies and procedures, any associated testing or evaluation methods, typical vulnerabilities, which may occur in that product or technology, etc.

Skills are the ability to understand the evaluation and testing scope (including its boundaries), to analyze various documentation, to understand the source code used in specifying and implementing products, to develop and perform functional and special IS testing, to use specialized testing tools, to interpret testing results and to write reports detailing these results, etc. Additional skills to communicate effectively and to perform project management are needed at the higher competence's levels.

An experienced individual should have a deep understanding of the accreditation body's requirements and policies, have already performed evaluations or testing, and perhaps have taught or mentored others.
The specification of particular educational qualifications can help determine an in-
dividual's ability to follow a formal program or work independently. In some cases, it
may be acceptable to substitute appropriate and relevant experience for education or
qualifications.

These main elements of competence can be extended by additional elements such
as leadership, teamwork, initiative, aptitude, willingness, etc.

All competence elements must assume their measurability. Knowledge tests may
include an examination of professional qualifications gained through third parties or
through testing by approval authorities or the laboratory itself. Methods for skills
measurement should demonstrate the mastery of all necessary skills. They can be
based on a specific laboratory's proficiency testing programme or on the use of previ-
ous training records. Experience is measured not by the number of years of experi-
ence, but by the number of projects in which a person participated before (considering
project complexity, technologies and test methods used). An individual's education
can be measured by referring to the educational certification issued by accredited and
recognized authorities/university and checked by the laboratory.

It will be reasonable to include in ISO/IEC 19896-1 a few competence levels, to
distinguish different levels of professional capability and define professional roles
within the organizations with respect to competence. For example, the first one is
usually a technician, supporting another's activities and performing testing or evalua-
tion under supervision. An evaluator/tester is competent to work unsupervised in
many areas, but may require supervision in a few testing and evaluation areas. A sen-
ior evaluator/tester is competent to work unsupervised in most areas and is able to
supervise the work of two previous persons. A lead evaluator/tester is competent to
work unsupervised in all areas of testing or evaluation according to the defined stand-
ards and methods, to provide project management, to supervise the work of three
other persons and to communicate with stakeholders.

We estimate this standard will be ready for publication not earlier than 2018.

5 CONCLUSION

Our dynamic life has put us in the forefront of the need to develop the specialized
professional competencies for the very popular field of IS in the short term. While
waiting for them, it is very hard to predict the new ISO/IEC 27021 and ISO/IEC
19896-1 international standards' content, even after scrupulously analyzing the
ISO/IEC 27000 standard family and ISO/IEC 17025 as their main statements. Our
review of the key ideas underlying the European approach to IS professionals' com-
petencies development revealed that e-CF 3.0 as the first all-Europe attempt to begin
formulating e-Competencies was not very successful with respect to the IS area be-
cause of its very narrow consideration, but it began a very proper and necessary pro-
cess. Since the description of e-Competencies for IS professionals is not the primary
goal of e-CF 3.0, it can be used only as the most basic initial guidance, and requires
substantial additions and clarifications. For example, general, business and manageri-
al knowledge and skills, competence in IS area and legal issues, IS operation, auditing
and risk management from e-CF 3.0 are completely applicable to ISO/IEC 27021 and
ISO/IEC 19896-1. Hence, all European academia, industry and governments hope to
see soon mature enough and usable standards.

# 6 ACKNOWLEDGEMENT

This work was supported by Competitiveness Growth Program of the Federal Auton-
omous Educational Institution of Higher Education National Research Nuclear Uni-
versity MEPhI (Moscow Engineering Physics Institute).

7 REFERENCES

1. Tolstoy, A., Miloslavskaya, N. "Professional Competencies Level Assessment for Training of Masters in Information Security". In book: Information Security Education Across the Curriculum. IFIP Advances in Information and Communication Technology. 9th IFIP WG 11.8 World Conference, WISE 9, Hamburg, Germany, May 26-28, 2015, Proceedings. Springer International Publishing. Vol. 453, 2015, pp. 135-145.

2. Bishop, M., Engle, S., "The Software Assurance CBK and University Curricula". 10th Colloquium for Information Systems Security Education. University of Maryland, USA. 2006.

3. Fischer-Hübner, S., Yngström, L. (Eds.): Proceedings of the IFIP WG 11.8 First World Conference on Information Security Education WISE1, June 17-19, 1999, Kista, Sweden.

4. Armstrong, H., Yngström, K. (Eds.): Proceedings of the IFIP WG 11.8 Second World Conference on Information Security Education WISE2, July 12-14, 2001, Perth, Australia.

5. Irvine, C.E., Armstrong, H.L. (Eds.): Security Education and Critical Infrastructures, IFIP WG11.8 Third Annual World Conference on Information Security Education WISE3, June 26-28, 2003, Monterey, California, USA. Kluwer 2003.

6. Miloslavskaya, N., Tolstoy, A., "State-Level Views on Professional Competencies in the Field of IoT and Cloud Information Security". Proceedings of 2016 4th International Conference on Future Internet of Things and Cloud Workshops. 3rd International Symposium on Intercloud and IoT (ICI 2016). August 22-24, 2016, Vienna (Austria), Pp. 83-90.

7. State Government Information Security Workforce Development Model. A Best Practice Model and Framework. June 2010. Final Version 1.0.

8. The U.S. National Cybersecurity Workforce Framework. URL: https://www.dhs.gov/national-cybersecurity-workforce-framework (access date 08.11.2016).

9. The Cyber Security Capability Framework & Mapping of ISM Roles. Final Report. Australian Government Information Management Office. June 2010.

10. The European e-Competence Framework 3.0. A common European Framework for ICT Professionals in all industry sectors. CWA 16234:2014 Part 1. CEN.

11. ISO/IEC 27001:2013 "Information technology -- Security techniques – Information security management systems — Requirements".

12. ISO/IEC 17024:2012 "Conformity assessment -- General requirements for bodies operating certification of persons".

13. ISO/IEC 17025:2005 "General requirements for the competence of testing and calibration laboratories".