<figure><img src="image_1.png" /></figure>

HAL
open science

# Professional Competencies Level Assessment for Training of Masters in Information Security

Natalia Miloslavskaya, Alexander Tolstoy

► To cite this version:

Natalia Miloslavskaya, Alexander Tolstoy. Professional Competencies Level Assessment for Training of Masters in Information Security. 9th IFIP World Conference on Information Security Education (WISE), May 2015, Hamburg, Germany. pp.135-145, 10.1007/978-3-319-18500-2_12. hal-01334297

HAL Id: hal-01334297

https://hal.science/hal-01334297

Submitted on 20 Jun 2016

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Professional Competencies Level Assessment for Training of Masters in Information Security

Miloslavskaya Natalia and Tolstoy Alexander

The National Research Nuclear University MEPhI (Moscow Engineering Physics Institute),
31 Kashirskoye shosse, Moscow, Russia

(NGMiloslavskaya, AITolstoj)@mephi.ru

**Abstract.** The peculiarities of assessing the level of professional competency formation in information security (IS) are discussed. The approach described uses the levels of mastering of specific disciplines forming this competency. Professional competencies in the field of information security and their levels are defined. The paper explains how these competencies can be formed. Metrics for the level of mastery of the discipline are introduced. The competencies level assessment model is proposed. The model application to the "Business Continuity and Information Security Maintenance" program for Masters at the NRNU MEPhI is shown. Important notes on using the model are given in conclusion.

**Keywords:** Masters in Information Security, Professional Competency, Professional Competencies Level Assessment, Professional Competencies Level Assessment Model

## 1 INTRODUCTION

A professional in any field of activity must have specific qualifying characteristics. This is also true for the sphere of information security (IS). The modern approach to the determination of qualifying characteristics is based on the definition of professional competencies (further competencies) as a professional's capacity to solve given problems and to perform specific work within his/her sphere of activity [1-3].

Qualifying characteristics for IS specialists can be presented as a set of their competencies in the field of IS (further IS competencies). They are used while implementing organizational personnel policy (including the role identification and assignment, the personnel recruitment and placement) and training (including the definition of requirements that the educational institutions' graduates must meet, and the implementation of an educational process that meets these requirements). Joint efforts of organizations' personnel departments and educational institutions together with the existence of some unified set of competencies will definitely enable coordination of their activities in order to best meet the staffing needs.
A problem of assessing the level of competencies (CL) formed in the implementa-
tion of a specific curriculum in the field of IS arises while conducting personnel train-
ing in this area. Two approaches are applicable for assessing this level:

1. assessment at the training completion (can be done via one single examination on all aspects related to a specific IS competency);

2. assessment of the levels of mastery of all specific disciplines forming one IS com-
petency.

This paper describes a model that enables us to implement the second approach,
which, from our point of view, is more interesting than the first. The remainder of the
paper is organized as follows. Professional IS competencies and their levels are de-
fined in Section 2. Section 3 explains how these IS competencies can be formed. Sec-
tion 4 introduces metrics to measure the mastery level of the disciplines. The CL as-
sessment model is proposed in Section 5. The model application to the "Business
Continuity and Information Security Maintenance" program for Masters at the NRNU
MEPhI is shown in Section 6. Some important notes on using the model are given in
conclusion.

## 2 INFORMATION SECURITY COMPETENCIES AND THEIR LEVELS

Competencies support definitions of job classifications/occupational group profiles, roles and responsibilities, position descriptions, duty statements, etc. [3]. A competency is traditionally defined as a combination of observable and measurable knowledge, abilities and skills (Fig. 1) (as well as individual attributes and work experience) that contribute to enhanced employee performance and ultimately result in organizational success [3, 4].

Knowledge is the cognizance of facts, truths and principles gained from formal
training and/or experience.

A skill is a developed proficiency or dexterity in mental operations or physical
processes that is often acquired through specialized training; using these skills results
in successful performance.

Ability is the power or aptitude to perform physical or mental activities that are of-
ten affiliated with a particular profession.

<figure><img src="image_3.png" /><figcaption>Fig. 1. Three competency's parameters</figcaption></figure>
Hence, knowledge, abilities and skills levels are three integral parameters (attributes) of a specific competency, which are necessary to perform a job successfully. In our case this competency is related to the field of IS.

For recruitment it is important not only to formulate all the parameters of a certain competency, but also to determine the necessary levels of these parameters. At present it seems reasonable to use the US Government IS Workforce Development Model defining the following levels of competency [3].

*Level 0 (Not Applicable).* The knowledge, abilities and skills levels within the framework of this IS competency are unrelated to the requirements set either by an organization engaged in recruitment for a certain employment or by an institution at a student's training completion.

*Level 1 (Entry-Level).* The level corresponds to the presence of only basic knowledge in the area of professional activity to which this competency is related (basic understanding of IS concepts, common knowledge and its application to computer systems architecture) and limited experience (gained in a classroom and/or experimental scenarios or as a trainee on-the-job) that partially meets the requirements of abilities and skills. A professional has the ability to understand and discuss terminology, concepts and principles, and issues related to this competency. Help or mentoring is needed in performing these skills. The focus is on learning and development of on-the-job experience. When hiring a professional with such CL it is required to provide some mechanism to increase this level. These measures may include training at the workplace under the supervision of experienced staff members or requiring additional training (in the form of retraining courses). In an institution of higher education this level can be raised to the minimum needed to meet the requirements, which characterizes the final level of formation of a specific IS competency.

*Level 2 (Intermediate).* A professional possessing the IS competency of this level demonstrates solid IS knowledge and skills necessary to successfully solve typical professional tasks within the competency and with minimal guidance. He is able to understand and discuss the competency context and implications of changes to processes, policies and procedures in the professional field. Help or mentoring from an expert may be required from time-to-time (to handle novel or more complex, atypical situations), but the skills can be implemented independently. The focus is on applying and enhancing the levels of IS knowledge and skills. In an educational institution this level characterizes a basic understanding of a specific IS competency.

*Level 3 (Advanced).* A professional possessing the IS competency of this level has expert understanding, wide knowledge and abilities within that competency. Further, he or she can apply this competency in new or complex situations in related IS areas. He demonstrates expert knowledge of laws, regulations, policies and procedures, and standards in the area of his/her professional activity, including the ability to interpret and to translate subject matter to various audiences and for different applications. This allows him/her to take part in the development of various organizational documents and to focus on broad organizational/professional issues, including participation in senior and executive level discussions regarding this competency. The actions associated with these skills can be performed without assistance and are aimed at solving wide professional and organizational tasks with a focus on well-organized and accu-
rate work in a team to implement the modern ideas. This professional provides con-
sistent, practical and relevant ideas and perspectives on process or practice improve-
ments, which may easily be implemented. He is a recognized authority within the
organization. He is able to coach and mentor others in applying this IS competency by
translating complex nuances into easy to understand terms in various business and
technology contexts. In an institution this level characterizes an advanced, final level
of gaining competency in a specific IS competency.

This paper is focused on solving the problem of assessing the level of IS compen-
tency, developed by the students of the higher education institutions.

3 INFORMATION SECURITY COMPETENCIES
FORMATION

To train IS professionals in an educational institution means to develop the students’
IS competencies in a particular area of their professional activity. The existence of
such IS competencies when training is complete means the graduate has the ability to
perform his job successfully and to solve practical tasks assigned to him by his em-
ployer.

Traditional competencies’ formation is mastery of a specific number of educational
disciplines (further disciplines). In general, they include training courses, various
practices (practical works) and completion of a final qualifying work (FQW). One
particular institution combined these disciplines to define specific features of an edu-
cational program leading to a Bachelor’s or Master’s degree, or a Specialist diploma,
in the IS field [1].

Implementation of a specific programme (for example, for Masters in IS) usually
aims to develop some number of students' competencies *CJ* (Fig. 2). A predetermined
number *M* of disciplines [*D*<sub>m</sub>] (*m*=1,...,*M*) is involved in the formation of each IS
competency. A few disciplines directly form a specific competency (e.g. competency
*C*<sub>j</sub>). The rest of the disciplines are designed to create the required levels of IS
knowledge, abilities and skills, necessary for mastering of disciplines, directly form-
ing all necessary IS competencies. As an example, Fig. 2 shows that *N* disciplines
[*D*<sub>*mn*</sub>] (*n*=1,...,*N*) providing the knowledge, skills and abilities for the discipline *D*<sub>*m*</sub>.

Thus, the levels of attributes of a specific IS competency are formed directly and
indirectly by the levels of IS knowledge, abilities and skills, obtained by mastering of
a set of disciplines.

To determine the levels of competency in the various attributes making up IS, we
have to measure the levels of mastery of disciplines making up that competency. We
must also assess the contribution of each discipline to achieving IS competency.
<figure><img src="image_4.png" /><figcaption>Fig. 2. Diagram of IS competencies' formation</figcaption></figure>

## 4 METRICS FOR THE LEVELS OF MASTERY OF THE DISCIPLINE

Different scales can be used to assess the level of mastery of the discipline (DML). It may be a mark in points from 0 to 100 (Fig. 3a) or 0 to 10 (Fig. 3b), a literal indexing from J to A (Fig. 3c) or a mixed form (Fig. 3d) from 1 ("very bad") to 5 ("excellent"). There are also other assessment scales.

<figure><img src="image_5.png" /><figcaption>Fig. 3. Levels of mastery of the IS disciplines</figcaption></figure>

To assess DMLs using CL it is necessary to select a single scale. This paper uses a point scale – from 0 to 100 (Fig. 3a). Converting the measurement of a DML from one scale to another does not pose difficulties in any particular case (Fig. 3 can be used as an example for that purpose).

The assessment of a specific IS DML for *D*<sub>m</sub> designated here as *DA*<sub>m</sub> should integrate the assessments of the level of gained IS knowledge *KD*<sub>m</sub>, the level of formed IS abilities *AD*<sub>m</sub> and the level of acquired IS skills *SD*<sub>m</sub>, developed by mastery of this discipline. Then
$$DA_m = \alpha_{km}KD_m + \alpha_{am}AD_m + \alpha_{sm}SD_m, \quad (1)$$

where $\alpha_{km}, \alpha_{am}, \alpha_{sm}$ are the weights of the contribution of the attributes (knowledge, abilities and skills) into DML. These attributes must satisfy the condition $\alpha_{km} + \alpha_{am} + \alpha_{sm} = 1$.

The levels $KD_m, AD_m, SD_m$, which the students develop while mastering specific IS disciplines, are defined during the testing of their progress. Students are evaluated in some way, for example by examination. In that case, the control questions for progress testing should be formulated in such a way that these levels can be clearly assessed based on responses to them.

The following features associated with the peculiarities of a specific IS discipline can also be considered. For example, if the discipline is a training course, its curriculum can be implemented using various forms of training: lectures, seminars, and labs. Lectures mainly form the knowledge level, seminars – abilities level and labs – skills level.

If the discipline consists only of the lectures (e.g. a more theoretical discipline studying international law or explaining how to write IS policies), then $\alpha_{km} = 1, \alpha_{am} = 0, \alpha_{sm} = 0$.

In case of seminars (e.g. with an assignment to write a specific private IS policy), then $\alpha_{km} \ll \alpha_{am}, \alpha_{km} \le \alpha_{sm}, \alpha_{am} \ge \alpha_{sm}$.

If nothing but labs (e.g. how to detect network intrusions using IDS predefined for a student or a group of students), then $\alpha_{km} \ll \alpha_{sm}, \alpha_{km} \le \alpha_{am}, \alpha_{am} \le \alpha_{sm}$.

In case of practices and FQW, then $\alpha_{km} \le \alpha_{am}, \alpha_{km} \ll \alpha_{sm}, \alpha_{am} \le \alpha_{sm}$.

The values of $\alpha_{km}, \alpha_{am}, \alpha_{sm}$ for a specific discipline can be determined by an expert, who can be a professor/instructor/tutor conducting studies on the discipline. For example, these values for a discipline being a training course can be determined based on analysis of the work involved in a discipline (we call it a discipline laboriousness) expressed in credits or time of classes' duration in academic hours $T_0$ in view of duration of lectures $T_k$, seminars $T_a$ and labs $T_s$:

$$\alpha_{km} = \frac{T_k}{T_0}; \alpha_{am} = \frac{T_a}{T_0}; \alpha_{sm} = \frac{T_s}{T_0}; T_0 = T_k + T_a + T_s. \quad (2)$$

# 5 INFORMATION SECURITY COMPETENCIES LEVEL ASSESSMENT MODEL

In the introduction we emphasized that we will assess a specific IS competency $CA_j$ and its attributes' values (the levels of IS knowledge $KC_j$, abilities $AC_j$ and skills $SC_j$) using the second approach. That approach is based on the characteristics of disciplines forming this competency (DML $DA_m$, the levels $KD_m, AD_m$ and $SD_m$).

Let us set the following assumptions for the model.

1. Some disciplines $D_{mn}$ are essential for disciplines $D_m$. These disciplines $D_m$ directly form some IS competency $C_j$ (Fig. 2). Thus, the disciplines $D_{mn}$ indirectly determine the characteristics of the competency $C_j$. Due to length limits of the paper, we do not consider the characteristics of the underlying disciplines $D_{mn}$.
2. The results of mastering a specific discipline $D_{mn}$ can be used in the formation of each IS competency $C_j$ connected with this discipline. Therefore, the differentiation of the contribution of a particular discipline into the formation of different competencies is not taken into account.

3. We weight the contributions of a discipline $D_m$ to the formation of a specific IS competency $C_j$. For $D_m, m=1,...,M$; and $M$ is the number of disciplines $D_m$ forming the competency $C_j$, these weights are $\beta k_{jm}$ for the levels of knowledge, $\beta a_{jm}$ for the abilities, and $\beta s_{jm}$ for the skills. The weights $\beta k_{jm}, \beta a_{jm}, \beta s_{jm}$ are defined by experts. From our point of view for the weights' values it is easy to use 11-points range (from 0 to 10 like in Table 1 from Section 5). It is not so important what range the experts will choose, because while assessing the attribute values for $C_j$ the levels $KD_m, AD_m$ and $SD_m$ with these weights are normalized by their sums as it is shown further (expressions (3), (4), (5)).

4. The single points scale from 0 to 100 is used to assess the level of competencies, their attributes and characteristics of disciplines. The transition from this scale to four-level IS competency assessment (Section 2) is done in accordance with Fig. 4.

<figure><img src="image_6.png" /><figcaption>Fig. 4. Linking of scales for competency assessment</figcaption></figure>

The IS competencies level assessment model is shown in Fig. 5.

<figure><img src="image_7.png" /><figcaption>Fig. 5. Diagram of IS competencies level assessment model</figcaption></figure>

Initial data for the model are the following:
1. a set of IS disciplines $D_m$ (where $m=1,...,M$; M is a number of disciplines), directly forming the selected IS competency $C_j$;

2. DML assessments $DA_m$ ($m=1,...,M$) and the levels $KD_m$, $AD_m$ and $SD_m$);

3. the coefficients for each discipline $\alpha_{km}$, $\alpha_{am}$, $\alpha_{sm}$ ($m=1,...,M$);

4. the weights $\beta k_{jm}$, $\beta a_{jm}$ and $\beta s_{jm}$ ($m=1,...,M$) for attributes' assessment for $C_j$.

The main expressions for the model are the following.

1. Assessment of attribute value for $C_j$, determining the IS knowledge level:

$$KC_j = \sum_{m=1}^{M} (\beta k_{jm} KD_m) / \sum_{m=1}^{M} (\beta k_{jm}). \quad (3)$$

2. Assessment of attribute value for $C_j$, determining the IS abilities level:

$$AC_j = \sum_{m=1}^{M} (\beta a_{jm} AD_m) / \sum_{m=1}^{M} (\beta a_{jm}). \quad (4)$$

3. Assessment of attribute value for $C_j$, determining the IS skills level:

$$SC_j = \sum_{m=1}^{M} (\beta s_{jm} SD_m) / \sum_{m=1}^{M} (\beta s_{jm}). \quad (5)$$

4. Assessment of IS competency level $CA_j$ according to the points scale. The following options are possible here.

Option 1. If the contributions of attributes into $CA_j$ are equal, then the assessment of $CA_j$ is calculated as:

$$CA_j = (KC_j + AC_j + SC_j)/3. \quad (6)$$

Option 2. If the contributions of attributes into $CA_j$ are not equal, then it is necessary to introduce $\lambda k_j$, $\lambda a_j$, $\lambda s_j$ ($\lambda k_j + \lambda a_j + \lambda s_j = 1$) (like for $\alpha_{km}$, $\alpha_{am}$, $\alpha_{sm}$ from Section 4) determined by experts and to assess $CA_j$ as:

$$CA_j = \lambda k_j KC_j + \lambda a_j AC_j + \lambda s_j SC_j. \quad (7)$$

Option 3 (called frontier). It is based on the transition from points to levels (Fig. 4). The assessment of $CA_j$ is done by the following rules:

«0», if at least one attribute is at this level;

«1», if at least one attribute is at this level and the rest are at the higher levels (2, 3);

«2», if at least one attribute is at this level and the rest are at the higher level (3);

«3», if the values of all competency attributes are at the same level (3).

Option 4. If DMLs $DA_m$ (forming $C_j$) are known and the contributions of these disciplines into competency formation $\mu_{jm}$ ($m=1,...,M$) are defined, then the assessment of $CA_j$ is calculated as:

$$CA_j = \sum_{m=1}^{M} (\mu_{jm} DA_m) / \sum_{m=1}^{M} (\mu_{jm}). \quad (8)$$

If weights $\beta k_{jm}$, $\beta a_{jm}$, $\beta s_{jm}$ are defined, then values $\mu_{jm}$ can be calculated as:

$$\mu_{jm} = \beta k_{jm} + \beta a_{jm} + \beta s_{jm}. \quad (9)$$
# 6 MODEL USAGE EXAMPLE

The IS competencies assessment model described above is based on the system of assessing the levels of mastery of disciplines forming a specific IS competency. This model was used at the "Cybernetics and Information Security" Faculty of the National Research Nuclear University "MEPhI" (Moscow Engineering Physics Institute) (Russia) at the implementation of the "Business Continuity and Information Security Maintenance" (BC&ISM) program for Masters [5].

The requirements of the Federal State Educational Standard (FSES) of training Masters in IS were taken into account in developing the curriculum for this program. FSES defines the area and professional activities, for which Masters should be trained. It also lists the professional activities and tasks that Masters graduates should be able to solve. The basic IS competencies are defined for each type of professional activities.

An educational institution has the right to work out its own curriculum (to choose specific disciplines) and to add more IS competencies reflecting the specific program. When a graduate masters the Masters' program, he/she will have developed additional competencies defined by the institution [5]. At the completion of training they must be able to fulfill the following activities:

* to analyze and to investigate models of systems ensuring business continuity (BC) and models of IS maintenance ($C_1$);

* to practically implement the standards relating to BC&ISM ($C_2$);

* to conduct IS risk assessment for the purpose of IS maintenance ($C_3$);

* to carry out the synthesis and analysis of design projects on BC&ISM for their organization where they work (O's) ($C_4$);

* to ensure the effective usage of O's IT resources to meet BC&ISM requirements ($C_5$);

* to participate in the design and operation of O's IS incident management system ($C_6$);

* to participate in the design and operation of O's BC&ISM system ($C_7$);

* to conduct technical auditing (monitoring) of O's information protection ($C_8$);

* to develop proposals for improving O's BC&ISM system ($C_9$);

* to establish and effectively implement a set of measures (rules, procedures, practical methods, guidelines, methods, tools) for BC&ISM ($C_{10}$).

All these competencies are developed during the implementation of a specific curriculum, which includes the specific IS disciplines [5].

The paper considers the formation of only one competency $C_7$ as an example, when a graduate should be able to participate in the design and operation of O's BC&ISM system.

Based on an analysis of the curriculum, ten IS disciplines $D_m$, ($m=1,...,M$), form this IS competency [5]:

* 6 training courses, namely:

- "Protected IT" (abbreviation PIT),
- “IS Management” (ISM),

- “IS Risk Management Basics” (ISRMB),

- “IS Incident Management Basics” (ISIMB),

- “IT Security Assessment” (ITSA),

- “Business Continuity Management” (BCM),

* Practical Works during Semesters 1, 2 and 3 (P1, P2, P3), and

* Completion of a FQW (FQW).

Initial data for the IS competency assessment model are shown in Table 1. It should be noted that:

* $\alpha_{km}, \alpha_{am}, \alpha_{sm}$ for the contributions of knowledge, abilities and skills levels into the level of mastery of the particular discipline (6 training courses) were determined on the basis of work involved in mastering the discipline (expression (2)) ($T_0, T_k, T_a, T_s$), taken from the curriculum [5];

* $\alpha_{km}, \alpha_{am}, \alpha_{sm}$ for the contributions of knowledge, abilities and skills levels into the level of mastery of the particular discipline (P1, P2, P3 and FQW) were determined by experts. The following peculiarities were taken into account: the contributions of the levels of gained knowledge $KD_m$ and formed abilities $AD_m$ decrease during the training, and the contribution of acquired skills $SD_m$ increases;

* the levels $KD_m, AD_m$ and $SD_m$ were defined along a 100 point scale during progress testing (exams) for a particular student;

* the assessments of DML $DA_m$ were determined according to the expression (1);

* the weights' values for $C_7$ attributes ($\beta k_{7m}, \beta a_{7m}$ and $\beta s_{7m}$) were determined by experts.

<table><caption>Table 1. Initial data for competency assessment modeling</caption><thead><tr><th>D<sub>m</sub></th><th>T<sub>0</sub></th><th>T<sub>k</sub></th><th>T<sub>a</sub></th><th>T<sub>s</sub></th><th>α<sub>km</sub></th><th>α<sub>am</sub></th><th>α<sub>sm</sub></th><th>KD<sub>m</sub></th><th>AD<sub>m</sub></th><th>SD<sub>m</sub></th><th>DA<sub>m</sub></th><th>βk<sub>jm</sub></th><th>βa<sub>jm</sub></th><th>βs<sub>jm</sub></th></tr></thead><tbody><tr><td>PIT</td><td>72</td><td>42</td><td>0</td><td>30</td><td>0,58</td><td>0</td><td>0,42</td><td>65</td><td>0</td><td>70</td><td>67</td><td>10</td><td>0</td><td>6</td></tr><tr><td>ISM</td><td>72</td><td>36</td><td>36</td><td>0</td><td>0,5</td><td>0,5</td><td>0</td><td>60</td><td>70</td><td>0</td><td>65</td><td>10</td><td>10</td><td>0</td></tr><tr><td>ISRMB</td><td>30</td><td>15</td><td>15</td><td>0</td><td>0,5</td><td>0,5</td><td>0</td><td>65</td><td>75</td><td>0</td><td>70</td><td>8</td><td>8</td><td>0</td></tr><tr><td>ISIMB</td><td>72</td><td>36</td><td>36</td><td>0</td><td>0,5</td><td>0,5</td><td>0</td><td>70</td><td>85</td><td>0</td><td>78</td><td>8</td><td>8</td><td>0</td></tr><tr><td>ITSA</td><td>72</td><td>36</td><td>36</td><td>0</td><td>0,5</td><td>0,5</td><td>0</td><td>65</td><td>65</td><td>0</td><td>65</td><td>7</td><td>6</td><td>0</td></tr><tr><td>BCM</td><td>32</td><td>16</td><td>16</td><td>0</td><td>0,5</td><td>0,5</td><td>0</td><td>80</td><td>85</td><td>0</td><td>83</td><td>10</td><td>10</td><td>0</td></tr><tr><td>P1</td><td>-</td><td>-</td><td>-</td><td>-</td><td>0,3</td><td>0,5</td><td>0,2</td><td>70</td><td>80</td><td>75</td><td>76</td><td>3</td><td>7</td><td>7</td></tr><tr><td>P2</td><td>-</td><td>-</td><td>-</td><td>-</td><td>0,2</td><td>0,4</td><td>0,4</td><td>70</td><td>85</td><td>80</td><td>80</td><td>2</td><td>8</td><td>8</td></tr><tr><td>P3</td><td>-</td><td>-</td><td>-</td><td>-</td><td>0,1</td><td>0,3</td><td>0,6</td><td>70</td><td>90</td><td>95</td><td>91</td><td>1</td><td>9</td><td>9</td></tr><tr><td>FQW</td><td>-</td><td>-</td><td>-</td><td>-</td><td>0,1</td><td>0,2</td><td>0,7</td><td>70</td><td>90</td><td>90</td><td>88</td><td>1</td><td>10</td><td>10</td></tr></tbody></table>

The attribute values assessments for $C_7$ can be determined using data from Table 1:

1) for the knowledge level (expression (3)) $KC_7 = 68$;

2) for the abilities level (expression (4)) $AC_7 = 76$;

3) for the skills level (expression (5)) $SC_7 = 84$.

Within the framework of the model let us define competency $C_7$ level assessment $CA_7$ for four options.
*Option 1.* When the contributions of competency attributes to the level of competency is equal, then the competency level assessment will be determined by the expression (6) as CA<sub>7</sub> = 76. The competency level assessment will refer to the second (intermediate) level in accordance with the scale from Fig. 4.

*Option 2.* When the contribution of competency attributes to the level of competency is unequal, then it is necessary to introduce λk<sub>7</sub> , λa<sub>7</sub> , λs<sub>7</sub>.

If the knowledge level is more important (e.g., $\lambda k_7 = 0,8$; $\lambda a_7 = 0,1$; $\lambda s_7 = 0,1$), then according to the expression (7) $CA_7 = 71$, which corresponds to the second (intermediate) level from Fig. 4.

If the abilities and skills levels are more important (e.g., $\lambda k_7 = 0,1$; $\lambda a_7 = 0,45$; $\lambda s_7 = 0,45$), then according to the expression (7) $CA_7 = 79$, which also corresponds to the second (intermediate) level from Fig. 4.

*Option 3.* For frontier approach $CA_7 = 68$, which corresponds to the first (entry-level) level from Fig. 4.

*Option 4.* Using the expression (9) and data from Table 1 for $\mu_{jm}$ ($m=1,...,M$), it is possible to use expression (8) to determine the competency level assessment as $CA_7 = 77$, corresponding to the second (intermediate) level from Fig. 4.

# 7 CONCLUSION

The model presented in this paper allows the assessment of the level of any professional competency in the IS field. It also allows the assessment of the values of the competency's attributes according to the assessment characteristics of the disciplines that form this competency. The above example uses the model to assess one of the competencies in the IS Masters programme, confirming the usefulness and efficiency of the proposed model.

We note that using this model requires changes in the way one assesses mastery of a specific discipline. It is necessary to assess not only the entire discipline in general, but also to separately assess the levels of knowledge, abilities and skills developed by the students as they master the discipline. In addition, the values of some of the model's parameters should be determined by experts.

Approaches that have been used in this model can be applied to construct another model, which solves the inverse task. If the required IS competency level, its attributes and their assessment are known, then the actual problems are the selection and determination of the list of disciplines forming the specific competency, determination of their characteristics (the list and the level of knowledge, skills and abilities to be developed at the training completion), and formulating the initial data for a particular IS professional training curriculum and training courses. But the development of an inverse model is more complicated problem because it should use different synthesis methods. This requires solving a few optimization problems with predefined criteria.
# 8 REFERENCES

1. Tolstoy, A.I. Basis for the formation of professional competencies of graduates from educational institutions along training directions and specialities included in the enlarge direction 090000 – Information Security. Information Technologies Security. 4(2008), 46-55. (in Russian).

2. Information Technology (IT) Security Essential Body of Knowledge (EBK): A Competency and Functional Framework for IT Security Workforce Development (National Cyber Security Division, United States Department of Homeland Security, October 2008).

3. State Government Information Security Workforce Development Model. A Best Practice Model and Framework. June 2010. Final Version1.0 (US).

4. What is a Competency? http://hr.unl.edu/compensation/nuvalues/corecompetencies.shtml (access date: 22.01.2015).

5. Miloslavskaya, N., Senatorov, M., Tolstoy, A., Zapechnikov S.: "Business Continuity and Information Security Maintenance" Masters' Training Program. In: Dodge, R.C., Futcher, L. (eds.) WISE8. IFIP AICT, vol. 406, pp. 95-102. Springer (2013).