Withdrawn NIST Technical Series Publication
Warning Notice
The attached publication has been withdrawn (archived), and is provided solely for historical purposes.
It may have been superseded by another publication (indicated below).

Withdrawn Publication
Series/Number
Title
Publication Date(s)Withdrawal Date
Withdrawal Note

NIST Special Publication 800-181
National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce
Framework
August 2017
November 16, 2020
SP 800-181 is superseded in its entirety by the publication of SP 800-181
Revision 1.

Superseding Publication(s) (if applicable)
The attached publication has been superseded by the following publication(s):Series/Number
Title
Author(s)Publication Date(s)URL/DOINIST Special Publication 800-181 Revision 1
Workforce Framework for Cybersecurity (NICE Framework)
Rodney Petersen; Danielle Santos; Karen A. Wetzel; Matthew C. Smith; Greg
Witte
November 2020
https://doi.org/10.6028/NIST.SP.800-181r1

Additional Information (if applicable)
Contact
Latest revision of theattached publication
Related Information
Withdrawal
Announcement Link

NICE Framework: NICEFramework@nist.gov
National Initiative for Cybersecurity Eductation (NICE): https://nist.gov/nicehttps://csrc.nist.gov/publications/detail/sp/800-181/rev-1/final

Date updated: November 13, 2020

NIST Special Publication 800-181

National Initiative for Cybersecurity
Education (NICE)
Cybersecurity Workforce Framework
William Newhouse
Stephanie Keith
Benjamin Scribner
Greg Witte

This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-181

NIST Special Publication 800-181

National Initiative for Cybersecurity
Education (NICE)
Cybersecurity Workforce Framework
William Newhouse
Applied Cybersecurity Division
Information Technology Laboratory

Stephanie Keith
Cyber Workforce Strategy & Policy Division
Office of the Deputy DoD Chief Information Officer

Benjamin Scribner
Cyber Education and Awareness Branch
DHS National Protection and Programs Directorate

Greg Witte
G2, Inc.
Annapolis Junction, MD

This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-181
August 2017

U.S. Department of Commerce
Wilbur L. Ross, Jr., Secretary
National Institute of Standards and Technology
Kent Rochford, Acting NIST Director and Under Secretary of Commerce for Standards and Technology

Authority
This publication has been developed by NIST in accordance with its statutory responsibilities under theFederal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines,
including minimum requirements for federal information systems, but such standards and guidelines shallnot apply to national security systems without the express approval of appropriate federal officials
exercising policy authority over such systems. This guideline is consistent with the requirements of the
Office of Management and Budget (OMB) Circular A-130.
Nothing in this publication should be taken to contradict the standards and guidelines made mandatory
and binding on federal agencies by the Secretary of Commerce under statutory authority. Nor should
these guidelines be interpreted as altering or superseding the existing authorities of the Secretary ofCommerce, Director of the OMB, or any other federal official. This publication may be used bynongovernmental organizations on a voluntary basis and is not subject to copyright in the United States.
Attribution would, however, be appreciated by NIST.
National Institute of Standards and Technology Special Publication 800-181
Natl. Inst. Stand. Technol. Spec. Publ. 800-181, 144 pages (August 2017)
CODEN: NSPUE2This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-181

Certain commercial entities, equipment, or materials may be identified in this document to describe an experimental
procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by
NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the
purpose.
There may be references in this publication to other publications currently under development by NIST in
accordance with its assigned statutory responsibilities. The information in this publication, including concepts andmethodologies, may be used by federal agencies even before the completion of such companion publications. Thus,
until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain
operative. For planning and transition purposes, federal agencies may wish to closely follow the development ofthese new publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback
to NIST. Many NIST cybersecurity publications, other than the ones noted above, are available at
http://csrc.nist.gov/publications.

Comments on this publication may be submitted to:
National Institute of Standards and Technology
Attn: NICE, Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000
Email: ncwf@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA).

NIST SP 800-181

NICE FRAMEWORK

Reports on Computer Systems Technology

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

The Information Technology Laboratory (ITL) at NIST promotes the U.S. economy and publicwelfare by providing technical leadership for the Nation’s measurement and standards
infrastructure. ITL develops tests, test methods, reference data, proof of concept
implementations, and technical analyses to advance the development and productive use of
information technology. ITL’s responsibilities include the development of management,
administrative, technical, and physical standards and guidelines for the cost-effective security
and privacy of other than national security-related information in federal information systems.
The Special Publication 800-series reports on ITL’s research, guidelines, and outreach efforts in
information system security, and its collaborative activities with industry, government, andacademic organizations.
Abstract
This publication describes the National Initiative for Cybersecurity Education (NICE)
Cybersecurity Workforce Framework (NICE Framework), a reference structure that describes
the interdisciplinary nature of the cybersecurity work. It serves as a fundamental reference
resource for describing and sharing information about cybersecurity work and the knowledge,
skills, and abilities (KSAs) needed to complete tasks that can strengthen the cybersecurity
posture of an organization. As a common, consistent lexicon that categorizes and describes
cybersecurity work, the NICE Framework improves communication about how to identify,
recruit, develop, and retain cybersecurity talent. The NICE Framework is a reference source fromwhich organizations or sectors can develop additional publications or tools that meet their needs
to define or provide guidance on different aspects of cybersecurity workforce development,planning, training, and education.
Keywords
Ability; cybersecurity; cyberspace; education; knowledge; role; skill; specialty area; task;
training; work role.

Revisions
Please visit the NICE Framework revisions website [1] to determine if there have been any
updates to the NICE Framework.

Supplemental Content
A Reference Spreadsheet for the NICE Framework is available athttps://www.nist.gov/file/372581.

ii

NIST SP 800-181

NICE FRAMEWORK

Acknowledgements

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

The authors gratefully acknowledge and appreciate the significant contributions from individuals
and organizations in the public and private sectors, whose thoughtful and constructive comments
improved the overall quality, thoroughness, and usefulness of this publication. We appreciate theleadership and work of Rodney Petersen, Director of the National Initiative for Cybersecurity
Education (NICE) at NIST. We wish to thank Tanya Brewer, Dean Bushmiller, Lynne Clarke,
Jerri Damavandy, Lisa Dorr, Ryan Farr, Jim Foti, Jodi Guss, Keith Hall, Chris Kelsall, Elizabeth
Lennon, Jeff Marron, Joshua Musicante, Stephen Olechnowicz, Lori Pfannenstein, Chuck
Romine, Kevin Sanchez-Cherry, Danielle Santos, Stephanie Shively, Matthew Smith, Kevin
Stine, Bluma Sussman, Caroline Tan, Baris Yakin, and Clarence Williams for their individual
contributions to this publication.
The first NICE Framework was posted for public comment in September 2012 and published as
final in April 2013 as the National Cybersecurity Workforce Framework version 1.0 [2]. The
authors recognize Dr. Jane Homeyer, Anne Quigley, Rex Min, Noel Kyle, Maya Yankelevich,and Peggy Maxson for leading its development, along with Montana Williams and Roy Burgess
for their leadership in the development of National Cybersecurity Workforce Framework version
2.0 which was posted in April 2014 [3].
Finally, the authors respectfully acknowledge the seminal work in computer security that dates tothe 1960s. The vision, insights, and dedicated efforts of those early pioneers in computer security
serve as the philosophical and technical foundation for the tasks, knowledge, skills, and abilities
noted in this publication.
Trademark Information

All trademarks or registered trademarks belong to their respective organizations.

iii

NIST SP 800-181

NICE FRAMEWORKExecutive Summary
The National Initiative for Cybersecurity Education (NICE), led by the National Institute ofStandards and Technology (NIST) of the U.S. Department of Commerce, is a partnership
between government, academia, and the private sector working to energize and promote a robust
network and an ecosystem of cybersecurity education, training, and workforce
development. NICE fulfills this mission by coordinating with government, academic, andindustry partners to build on existing successful programs, facilitate change and innovation, andbring leadership and vision to increase the number of skilled cybersecurity professionals helping
to keep our nation secure.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

NICE is committed to cultivating an integrated cybersecurity workforce that is globallycompetitive from hire to retire and prepared to protect our nation from existing and emerging
cybersecurity challenges. NICE promotes nationwide initiatives that increase the number ofpeople with the knowledge, skills, and abilities to perform the tasks required for cybersecurity
work.
As threats that exploit vulnerabilities in our cyberinfrastructure grow and evolve, an integrated
cybersecurity workforce must be capable of designing, developing, implementing, andmaintaining defensive and offensive cyber strategies. An integrated cybersecurity workforce
includes technical and nontechnical roles that are staffed with knowledgeable and experienced
people. An integrated cybersecurity workforce can address the cybersecurity challenges inherent
to preparing their organizations to successfully implement aspects of their missions and businessprocesses connected to cyberspace.
This publication provides a fundamental reference in support of a workforce capable of meetingan organization’s cybersecurity needs by using a common, consistent lexicon to describe
cybersecurity work by category, specialty area, and work role. It provides a superset ofcybersecurity Knowledge, Skills, and Abilities (KSAs) and Tasks for each work role. The NICE
Framework supports consistent organizational and sector communication for cybersecurity
education, training, and workforce development.
A user of the NICE Framework will reference it for different aspects of workforce development,
education, and/or training purposes, and when that material is used at organizational levels, theuser should customize what is pulled from the NICE Framework to standards, regulations, needs,
and mission of the user’s organization. The NICE Framework is a reference starting point for thecontent of guidance and guidelines on career paths, education, training, and credentialing
programs.
The NICE Framework is a resource that will strengthen an organization’s ability to communicate
consistently and clearly about cybersecurity work and its cybersecurity workforce. Organizations
or sectors can develop additional publications or tools that meet their needs to define or provide
guidance on different aspects of workforce development, planning, training, and education.
An online reference spreadsheet tool [4] is available on the NICE Framework website [5].

iv

NIST SP 800-181

NICE FRAMEWORKTable of Contents
Executive Summary ..................................................................................................... iv
1

Introduction ............................................................................................................ 1
1.1 NICE Framework Background ........................................................................ 1
1.2 Purpose and Applicability................................................................................ 2
1.3 Audience/Users .............................................................................................. 2
1.3.1 Employers ............................................................................................ 2

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

1.3.2 Current and Future Cybersecurity Workers .......................................... 3
1.3.3 Educators/Trainers ............................................................................... 3
1.3.4 Technology Providers ........................................................................... 4
1.4 Organization of this Special Publication .......................................................... 4
2

NICE Framework Components and Relationships .............................................. 5
2.1 Components of the NICE Framework ............................................................. 5
2.1.1 Categories ............................................................................................ 5
2.1.2 Specialty Areas .................................................................................... 5
2.1.3 Work Roles ........................................................................................... 5
2.1.4 Knowledge, Skills, and Abilities (KSAs) ................................................ 5
2.1.5 Tasks .................................................................................................... 6
2.2 NICE Framework Component Relationships .................................................. 6

3

Using the NICE Framework ................................................................................... 7
3.1 Identification of Cybersecurity Workforce Needs ............................................ 7
3.2 Recruitment and Hiring of Highly Skilled Cybersecurity Talent ....................... 8
3.3 Education and Training of Cybersecurity Workforce Members ....................... 8
3.4 Retention and Development of Highly Skilled Cybersecurity Talent ............... 8

4

Extensions ............................................................................................................ 10
4.1 Competencies ............................................................................................... 10
4.2 Job Titles ...................................................................................................... 10
4.3 Cybersecurity Guidance and Guideline documents ...................................... 10
List of Appendices

Appendix A – Listing of NICE Framework Elements ................................................ 11
A.1 NICE Framework Workforce Categories ....................................................... 11
A.2 NICE Framework Specialty Areas................................................................. 12v

NIST SP 800-181

NICE FRAMEWORK

A.3 NICE Framework Work Roles ....................................................................... 15
A.4 NICE Framework Tasks ................................................................................ 24
A.5 NICE Framework Knowledge Descriptions ................................................... 59
A.6 NICE Framework Skills Descriptions ............................................................ 77
A.7 NICE Framework Ability Descriptions ........................................................... 88
Appendix B – Work Role Detail Listing ..................................................................... 95
B.1 Securely Provision (SP) ................................................................................ 95
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

B.2 Operate and Maintain (OM) ........................................................................ 101
B.3 Oversee and Govern (OV) .......................................................................... 104
B.4 Protect and Defend (PR)............................................................................. 110
B.5 Analyze (AN) ............................................................................................... 112
B.6 Collect and Operate (CO) ........................................................................... 116
B.7 Investigate (IN) ........................................................................................... 121
Appendix C – Workforce Development Tools ......................................................... 123
C.1 DHS Cybersecurity Workforce Development Toolkit................................... 123
C.1.1 Proficiency Levels and Career Paths................................................ 123
C.2 Baldrige Cybersecurity Excellence Builder Tool ......................................... 123
C.3 Position Description Drafting Tool ............................................................... 124
Appendix D – Cross Reference to Guidance and Guideline Documents ............. 125
D.1 Cybersecurity Framework ........................................................................... 125
D.1.2 Example Integration of Cybersecurity Framework with NICE
Framework .................................................................................................. 127
D.2 Systems Security Engineering .................................................................... 129
D.3 U.S. Office of Personnel Management Federal Cybersecurity Codes ........ 130
Appendix E – Acronyms ........................................................................................... 132
Appendix F – References ......................................................................................... 134
List of Tables
Table 1 - NICE Framework Workforce Categories ........................................................ 11
Table 2 - NICE Framework Specialty Areas .................................................................. 12
Table 3 - NICE Framework Work Roles ........................................................................ 16
Table 4 - NICE Framework Tasks ................................................................................. 24
Table 5 - NICE Framework Knowledge Descriptions .................................................... 59vi

NIST SP 800-181

NICE FRAMEWORKTable 6 - NICE Framework Skills Descriptions .............................................................. 77
Table 7 - NICE Framework Ability Descriptions ............................................................ 88
Table 8 - Crosswalk of NICE Framework Workforce Categories to Cybersecurity
Framework Functions ........................................................................................... 127
Table 9 – Crosswalk of Work Role IDs to OPM Cybersecurity Codes......................... 131

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

vii

NIST SP 800-181

1

NICE FRAMEWORKIntroduction

The National Initiative for Cybersecurity Education (NICE), led by the National Institute ofStandards and Technology (NIST) in the U.S. Department of Commerce, is a partnership
between government, academia, and the private sector that seeks to energize and promote arobust network and an ecosystem of cybersecurity education, training, and workforce
development. NICE fulfills this mission by coordinating with government, academic, andindustry partners to build on existing successful programs, facilitate change and innovation, andbring leadership and vision to increase the number of skilled cybersecurity professionals helping
to keep our nation secure and economically competitive.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

NICE is committed to cultivating an integrated cybersecurity workforce that is globallycompetitive from hire to retire, prepared to protect our nation from existing and emerging
cybersecurity challenges.
Throughout this document, the combined terms “cybersecurity workforce” is shorthand for aworkforce with work roles that have an impact on an organization’s ability to protect its data,systems, and operations. Included are new work roles that have been known traditionally as
information technology (IT) security roles. Those roles have been added to this workforce
framework to highlight their importance to the overall cybersecurity posture of an organization.
Additionally, some of the work roles described herein include the shorter term cyber to be
inclusive of sectors where cyber has become the conversational norm for this field.
A cybersecurity workforce includes not only technically focused staff, but also those who apply
knowledge of cybersecurity when preparing their organization to successfully implement its
mission. A knowledgeable and skilled cybersecurity workforce is needed to address
cybersecurity risks within an organization’s overall risk management process.
1.1

NICE Framework BackgroundThe concept for the NICE Framework began before the establishment of NICE in 2010 and grewout of the recognition that the cybersecurity workforce had not been defined and assessed. To
address this challenge, the Federal Chief Information Officers (CIO) Council took on the task in2008 to provide a standard framework to understand the cybersecurity roles within the federal
government. Input from focus groups with subject matter experts from numerous federal
agencies helped the Federal CIO Council produce a research report that referenced where otherinformation technology professional development efforts were already under way, and thirteen
specific roles were identified as needed by agencies to conduct cybersecurity work.
Building on this inherently multidisciplinary exploration of the “field” of cybersecurity, theComprehensive National Cybersecurity Initiative’s included a focus on workforce that tasked
several agencies to work together to develop a cybersecurity workforce framework. The firstdraft was posted for public comment in September 2011. Comments were incorporated into
version 1.0 [2].
A subsequent U.S. government-wide review noted specific areas to be further examined andrefined. The Department of Homeland Security (DHS) gathered input and validated final
1

NIST SP 800-181

NICE FRAMEWORK

recommendations via focus groups with subject matter experts from around the country andacross industry, academia, and government resulting in a second version of the NICE
Framework, version 2.0 [3], shared publicly in 2014.
The Office of the Secretary of Defense (OSD) expanded on version 2.0 through internal
engagements with service components and external engagements with the private sector. The
DHS and NIST co-authors worked with OSD to refine their expansion to become this publication
with a goal to emphasize private sector applicability and to reinforce the vision that the NICE
Framework is a reference resource for both the public and private sectors.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

1.2

Purpose and Applicability

This publication serves as a fundamental reference resource to support a workforce capable ofmeeting an organization’s cybersecurity needs. It provides organizations with a common,
consistent lexicon that categorizes and describes cybersecurity work.
Using the NICE Framework as a fundamental reference will improve the communication needed
to identify, recruit, and develop cybersecurity talent. The NICE Framework will allow employers
to use focused, consistent language in professional development programs, in their use ofindustry certifications and academic credentials, and in their selection of relevant training
opportunities for their workforce.
The NICE Framework facilitates the use of a more consistent, comparable, and repeatableapproach to select and specify cybersecurity roles for positions within organizations. It also
provides a common lexicon that academic institutions can use to develop cybersecurity curriculathat better prepares students for current and anticipated cybersecurity workforce needs.
The application of the NICE Framework offers the ability to describe all cybersecurity work. An
applicability goal of the NICE Framework is that any cybersecurity job or position can be
described by identifying the relevant material from one or more components of the NICE
Framework. For each job or position, the context of the mission or business processes andpriorities will drive which material is selected from the NICE Framework.
Organizations or sectors can use the NICE Framework to develop additional publications or toolsthat meet their needs to define or provide guidance on different aspects of workforce
development, planning, training, and education.
1.3

Audience/Users

The NICE Framework can be viewed as a non-prescriptive cybersecurity workforce dictionary.
Users of the NICE Framework who reference it should implement it locally for different
workforce development, education, or training purposes.
1.3.1

Employers

Use of the NICE Framework’s common lexicon enables employers to inventory and develop
their cybersecurity workforce. The NICE Framework can be used by employers andorganizational leadership to:2

NIST SP 800-181

NICE FRAMEWORKThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181•

Inventory and track their cybersecurity workforce to gain a greater understanding of thestrengths and gaps in Knowledge, Skills, and Abilities and Tasks performed;•

Identify training and qualification requirements to develop critical Knowledge, Skills,
and Abilities to perform cybersecurity Tasks;•

Improve position descriptions and job vacancy announcements selecting relevant KSAs
and Tasks, once work roles and tasks are identified;•

Identify the most relevant work roles and develop career paths to guide staff in gaining
the requisite skills for those roles; and•Establish a shared terminology between hiring managers and human resources (HR) staff
for the recruiting, retention, and training of a highly-specialized workforce.

1.3.2

Current and Future Cybersecurity Workers

The NICE Framework supports those in the cybersecurity field and those who might wish toenter the cybersecurity field, to explore Tasks within cybersecurity Categories and work roles. It
also assists those who support these workers, such as human resource staffing specialists andguidance counselors, to help job seekers and students understand which cybersecurity work roles
and which associated Knowledge, Skills, and Abilities are being valued by employers for indemand cybersecurity jobs and positions.
These workers are further supported when vacancy announcements and open position
descriptions use the NICE Framework’s common lexicon to provide clear and consistentdescriptions of the cybersecurity tasks and training that are needed for those positions.
When training providers and industry certification providers use the common lexicon of the
NICE Framework, those in the cybersecurity field, or those who might wish to enter the
cybersecurity field, can find training and/or certification providers that can teach the tasks
necessary to secure a cybersecurity job or to progress into new positions. Use of the common
lexicon helps students and professionals to obtain KSAs that are typically demonstrated by aperson whose cybersecurity position includes a given work role. This understanding helps themto find academic programs that include learning outcomes and knowledge units that map to the
KSAs and Tasks that are valued by employers.
1.3.3

Educators/Trainers

The NICE Framework provides a reference for educators to develop curriculum, certificate ordegree programs, training programs, courses, seminars, and exercises or challenges that cover the
KSAs and Tasks described in the NICE Framework.
Human resource staffing specialists and guidance counselors can use the NICE Framework as aresource for career exploration.

3

NIST SP 800-181

1.3.4

NICE FRAMEWORKTechnology Providers

The NICE Framework allows a technology provider to identify the cybersecurity work roles andthe KSAs and Tasks associated with hardware and software products and services they provide.
A technology provider can then create appropriate support materials to assist members of thecybersecurity workforce in the proper configuration and management of their products.
1.4

Organization of this Special Publication

The remainder of this special publication is organized as follows:This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181•

Chapter 2 defines the components of the NICE Framework: (i) Categories; (ii) Specialty
Areas; (iii) Work Roles; (iv) associated supersets of Knowledge, Skills, and Abilities; and(v) Tasks for each work role.

•

Chapter 3 describes using the NICE Framework•

Chapter 4 notes areas where other publications, guidelines, guidance, and tools can
expand the impact of the NICE Framework.

•

Appendix A describes the NICE Framework list of Categories, Specialty Areas, Work
Roles, KSAs, and Tasks.

•

Appendix B provides a detailed listing of each work role, including the associated KSAs
and Tasks.

•

Appendix C provides some examples of workforce development tools•

Appendix D provides some examples of guidance or guideline documents that crossreference some of the content of those documents to components in the NICE Framework•

Appendix E gives selected acronyms and abbreviations used in this document.

•

Appendix F gives references cited in this document.

4

NIST SP 800-181

NICE FRAMEWORK2NICE Framework Components and Relationships

2.1

Components of the NICE Framework

The NICE Framework organizes cybersecurity and related work. This section introduces anddefines the core components of the NICE Framework in support of those areas.
2.1.1

Categories

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Categories provide the overarching organizational structure of the NICE Framework. There areseven Categories and all are composed of Specialty Areas and work roles. This organizational
structure is based on extensive job analyses, which group together work and workers that sharecommon major functions, regardless of job titles or other occupational terms.
2.1.2

Specialty Areas

Categories contain groupings of cybersecurity work, which are called Specialty Areas. There
were 31 specialty areas called out in National Cybersecurity Workforce Framework version 1.0[2] and 32 in National Cybersecurity Workforce Framework version 2.0 [3]. Each specialty area
represents an area of concentrated work, or function, within cybersecurity and related work. In
previous versions of the NICE Framework, tasks and KSAs were associated with each specialty
area. KSAs and Tasks are now associated with the work roles.
2.1.3

Work RolesWork roles are the most detailed groupings of cybersecurity and related work which include alist of attributes required to perform that role in the form of knowledge, skills, and abilities(KSAs) and tasks performed in that role.
Work being performed in a job or position is described by selecting one or more work roles fromthe NICE Framework relevant to that job or position, in support of mission or businessprocesses.
To aid in the organization and communication about cybersecurity responsibilities, work roles
are grouped into specific classes of categories and specialty areas as shown in Appendix A.
2.1.4

Knowledge, Skills, and Abilities (KSAs)

Knowledge, Skills, and Abilities (KSAs) are the attributes required to perform work roles and are
generally demonstrated through relevant experience, education, or training.
Knowledge is a body of information applied directly to the performance of a function.
Skill is often defined as an observable competence to perform a learned psychomotor act.
Skills in the psychomotor domain describe the ability to physically manipulate a tool or
instrument like a hand or a hammer. Skills needed for cybersecurity rely less on physicalmanipulation of tools and instruments and more on applying tools, frameworks, processes,
5

NIST SP 800-181

NICE FRAMEWORK

and controls that have an impact on the cybersecurity posture of an organization orindividual.
Ability is competence to perform an observable behavior or a behavior that results in an
observable product.
2.1.5

Tasks

A Task is a specific defined piece of work that, combined with other identified Tasks, composes
the work in a specific specialty area or work role.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

2.2

NICE Framework Component Relationships

The NICE Framework components describe cybersecurity work. As illustrated in Figure 1, eachCategory is composed of Specialty Areas, each of which is composed of one or more work roles.
Each work role, in turn, includes KSAs and Tasks.
Grouping components in this manner simplifies communication about cybersecurity workforce
topics, and helps with alignment to other frameworks. Specific associations of work roles to
KSAs and Tasks are shown in Appendix B and in a reference spreadsheet [4] posted to the NICE
Framework website [5].

Figure 1 - Relationships among NICE Framework Components

6

NIST SP 800-181

3

NICE FRAMEWORK

Using the NICE Framework

Using the NICE Framework to understand organizational needs and assess the extent to whichthose needs are met can help an organization to plan, implement, and monitor a successful
cybersecurity program.
3.1

Identification of Cybersecurity Workforce Needs

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Cybersecurity is a rapidly changing and expanding field. This expansion requires a cadre ofskilled workers to help organizations perform cybersecurity functions. As organizations identify
what is needed to adequately manage current and future cybersecurity risk, leaders need toconsider the cybersecurity workforce capabilities and capacity needed.
Figure 2 illustrates how the NICE Framework is a central reference to help employers build acapable and ready cybersecurity workforce.

Figure 2 - Building Blocks for a Capable and Ready Cybersecurity Workforce

The circular arrows on the left side of Figure 2 are activities that are likely to have an impact onan organization’s ability to develop a capable and ready workforce:•

Using the common lexicon of the NICE Framework clarifies communication between
cybersecurity educators, trainers/certifiers, employers, and employees.

•

Performing criticality analysis will identify those KSAs and tasks that are critical for
successful performance with a given work role and those that are key to multiple work
roles.

•

Running a proficiency analysis will inform an organization’s expectation of the level (e.g.
entry-level, expert) for positions, comprised often of more than one work role. The
proficiency analysis should enable refinement of selection of the relevant tasks, andKSAs needed for the work roles that make up that position.
7

NIST SP 800-181

NICE FRAMEWORKAppendix C identifies some existing workforce development tools that support identification of
cybersecurity workforce needs.
3.2

Recruitment and Hiring of Highly Skilled Cybersecurity TalentThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Referencing the NICE Framework will help organizations to accomplish strategic workforce
planning and hiring. NICE Framework material, when used during the creation or revision of
position descriptions in vacancy announcements and job postings, will help candidates to seekout specific positions for which they are interested, capable, or qualified. Tasks used to describe
a position’s duties and responsibilities, and KSAs used to describe the position’s needed skills
and qualifications, should allow candidates and hiring managers to communicate more
effectively. Position descriptions and vacancy announcements using the NICE Framework
terminology support more consistent evaluation criteria for vetting and approving candidates.
For organizations who are concerned with workforce gaps, a review of the NICE Framework’s
list of tasks can determine specific tasks which are not being performed by the organization.
Those tasks allow the organization to identify the work role(s) and specialty area(s) that are gaps.
The organization is better able to engage with the community of education, training, andcredential, and certification providers who map their offerings to the NICE Framework. The
organization can identify training that will allow existing staff member to address the gaps. The
organization’s hiring managers using data pulled from the NICE Framework in this manner canrecognize applicants who have the KSAs to perform the cybersecurity tasks.
3.3

Education and Training of Cybersecurity Workforce Members

The NICE Framework’ identification of tasks in work roles allows educators to prepare learners
with the specific KSAs from which they can demonstrate the ability to perform cybersecurity
tasks.
Academic institutions are a critical part of preparing and educating the cybersecurity workforce.
Collaboration among public and private entities, such as through the NICE program, enables
such institutions to determine common knowledge and abilities that are needed. In turn,developing and delivering curricula that are harmonized with the NICE Framework lexicon
allows institutions to prepare students with the skills needed by employers. As the pipeline ofstudents finding desired jobs in cybersecurity increases, more students will be attracted toacademic cybersecurity programs as a pathway to a career.
3.4

Retention and Development of Highly Skilled Cybersecurity Talent

A critical aspect of a skilled cybersecurity workforce involves the development and retention of
the skilled talent already onboard. A current employee has existing relationships, institutional
knowledge, and organizational experience that is hard to replace. Refilling a position after an
employee leaves may bring new advertising and hiring costs, expenses for training, diminishedproductivity, and reduced morale. The following list illustrates some of the ways that the NICE
Framework supports retention and development of cybersecurity talent:

8

NIST SP 800-181

NICE FRAMEWORKThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181•

Organizations can develop career pathways that describe the qualifications necessary for
progressively challenging and evolving sets of work roles, such as those enumerated by
the NICE Framework.

•

A detailed understanding of the KSAs and Tasks helps existing staff to understand thespecific steps needed to develop their capabilities, promoting readiness for a desired
position.

•

An organization might offer staff rotations to provide opportunities to develop and use
new skills.

•

Organizations can identify personnel that are diligent in improving KSAs in relevant
areas, recognizing those who perform well.

•Organizations can create development/improvement plans for staff to help them map out
how they can obtain KSAs required for new work roles.

•

Group training opportunities can be identified to prepare staff members to enhancecommon knowledge, skills, and abilities in the work roles of an organization.

•

Organizations can use training and examinations that are based for specific cybersecurity
skills and abilities to assess proficiency in a realistic environment.

•

Organizations can use existing personnel to fill critical cybersecurity staffing needs,
leveraging the ability to review resumes of existing staff to identify those with desirable
KSAs.

•

The NICE Framework is helpful for existing employees who desire to move into acybersecurity work role from another position. An organization can describe the KSAs
needed to allow a reliable employee in a non-cybersecurity work role to become part ofthe cybersecurity workforce taking on cybersecurity tasks.

9

NIST SP 800-181

4NICE FRAMEWORKExtensions

Organizations or sectors can use the NICE Framework to develop additional publications or toolsthat meet their needs and define or provide guidance on different aspects of workforce
development, planning, training, and education.
New reference materials that cross-reference elements of the NICE Framework will be shared
via the NICE website [5].

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

The following areas are a few examples from which additional publications or tools could be
developed.
4.1

Competencies

The Department of Labor’s Employment and Training Administration [6] defines a competency
as the capability of applying or using knowledge, skills, abilities, behaviors, and personal
characteristics to successfully perform critical work tasks, specific functions, or operate in agiven role or position. In addition to the enumeration of technical KSAs, competency models
also consider behavioral indicators and describe nontechnical considerations such as Personal
Effectiveness, Academic, and Workplace Competencies. Additional information about these
considerations is available from the Department of Labor’s CareerOneStop Site [7].
4.2

Job Titles

Job titles are a description of an employee’s job or position in an organization. A mapping ofsample job titles to specialty areas or work roles would help organizations to use the NICE
Framework.
4.3

Cybersecurity Guidance and Guideline documents

NICE Strategic Goal #3, Guide Career Development and Workforce Planning, aims to support
employers to address market demands and enhance recruitment, hiring, development, andretention of cybersecurity talent. One objective within this strategic goal is to publish and raiseawareness of the NICE Framework and encourage adoption. Adoption in this case means that the
NICE Framework is used as a reference resource for actions related to cybersecurity workforce,training, and education.
One way to encourage adoption of the NICE Framework is to encourage authors of cybersecurity
guidance or guideline documents to cross reference their content with components of the NICE
Framework. Three example publications are explored in Appendix D.

10

NIST SP 800-181

NICE FRAMEWORKAppendix A – Listing of NICE Framework Elements
A.1

NICE Framework Workforce Categories

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Table 1 provides a description of each Category described by the NICE Framework. Each includes a two-character abbreviation (e.g.,
SP) for quick reference of the Category and to support the creation of NICE Framework work role identifiers (see Table 3 - NICE
Framework work roles). This listing will be updated periodically [1]. The definitive source for the most current version of this material
can be found in the Reference Spreadsheet for NIST Special Publication 800-181 [4].
Table 1 - NICE Framework Workforce Categories
Categories

Securely Provision (SP)Operate and Maintain (OM)

Oversee and Govern (OV)

Protect and Defend (PR)
Analyze (AN)Collect and Operate (CO)Investigate (IN)

Descriptions

Conceptualizes, designs, procures, and/or builds secure information
technology (IT) systems, with responsibility for aspects of system and/or
network development.
Provides the support, administration, and maintenance necessary toensure effective and efficient information technology (IT) system
performance and security.
Provides leadership, management, direction, or development andadvocacy so the organization may effectively conduct cybersecurity
work.
Identifies, analyzes, and mitigates threats to internal information
technology (IT) systems and/or networks.
Performs highly-specialized review and evaluation of incoming
cybersecurity information to determine its usefulness for intelligence.
Provides specialized denial and deception operations and collection of
cybersecurity information that may be used to develop intelligence.
Investigates cybersecurity events or crimes related to information
technology (IT) systems, networks, and digital evidence.

11

NIST SP 800-181

A.2

NICE FRAMEWORKNICE Framework Specialty Areas

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Table 2 provides a description of each of the NICE Framework Specialty Areas. Each Specialty Area includes a three-character
abbreviation (e.g., RSK) for quick reference of the specialty area and to support the creation of NICE Framework work role identifiers(see Table 3 - NICE Framework work roles). This listing will be updated periodically [1]. The definitive source for the most current
version of this material can be found in the Reference Spreadsheet for NIST Special Publication 800-181 [4].
Table 2 - NICE Framework Specialty Areas

Categories

Specialty Areas

Securely Provision(SP)

Risk Management (RSK)Operate and Maintain(OM)

Specialty Area Descriptions

Oversees, evaluates, and supports the documentation, validation, assessment, andauthorization processes necessary to assure that existing and new information
technology (IT) systems meet the organization's cybersecurity and risk
requirements. Ensures appropriate treatment of risk, compliance, and assurance
from internal and external perspectives.
Software Development (DEV)
Develops and writes/codes new (or modifies existing) computer applications,software, or specialized utility programs following software assurance bestpractices.
Systems Architecture (ARC)
Develops system concepts and works on the capabilities phases of the systems
development life cycle; translates technology and environmental conditions (e.g.,
law and regulation) into system and security designs and processes.
Technology R&D (TRD)
Conducts technology assessment and integration processes; provides andsupports a prototype capability and/or evaluates its utility.
Systems Requirements Planning Consults with customers to gather and evaluate functional requirements and(SRP)
translates these requirements into technical solutions. Provides guidance tocustomers about applicability of information systems to meet business needs.
Test and Evaluation (TST)
Develops and conducts tests of systems to evaluate compliance withspecifications and requirements by applying principles and methods for costeffective planning, evaluating, verifying, and validating of technical, functional,
and performance characteristics (including interoperability) of systems orelements of systems incorporating IT.
Systems Development (SYS)
Works on the development phases of the systems development life cycle.
Data Administration (DTA)
Develops and administers databases and/or data management systems that allow
for the storage, query, protection, and utilization of data.
Knowledge Management (KMG) Manages and administers processes and tools that enable the organization to
identify, document, and access intellectual capital and information content.

12

NIST SP 800-181

Categories

NICE FRAMEWORKThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Specialty Areas

Specialty Area Descriptions

Customer Service and TechnicalSupport (STS)

Addresses problems; installs, configures, troubleshoots, and provides
maintenance and training in response to customer requirements or inquiries (e.g.,tiered-level customer support). Typically provides initial incident information to
the Incident Response (IR) Specialty.
Installs, configures, tests, operates, maintains, and manages networks and theirfirewalls, including hardware (e.g., hubs, bridges, switches, multiplexers, routers,
cables, proxy servers, and protective distributor systems) and software that
permit the sharing and transmission of all spectrum transmissions of information
to support the security of information and information systems.
Installs, configures, troubleshoots, and maintains server configurations(hardware and software) to ensure their confidentiality, integrity, andavailability. Manages accounts, firewalls, and patches. Responsible for access
control, passwords, and account creation and administration.
Studies an organization's current computer systems and procedures, and designs
information systems solutions to help the organization operate more securely,
efficiently, and effectively. Brings business and information technology (IT)together by understanding the needs and limitations of both.
Provides legally sound advice and recommendations to leadership and staff on avariety of relevant topics within the pertinent subject domain. Advocates legal
and policy changes, and makes a case on behalf of client via a wide range ofwritten and oral work products, including legal briefs and proceedings.
Conducts training of personnel within pertinent subject domain. Develops, plans,
coordinates, delivers and/or evaluates training courses, methods, and techniques
as appropriate.
Oversees the cybersecurity program of an information system or network,
including managing information security implications within the organization,
specific program, or other area of responsibility, to include strategic, personnel,
infrastructure, requirements, policy enforcement, emergency planning, security
awareness, and other resources.
Develops policies and plans and/or advocates for changes in policy that support
organizational cyberspace initiatives or required changes/enhancements.
Supervises, manages, and/or leads work and workers performing cyber andcyber-related and/or cyber operations work.
Applies knowledge of data, information, processes, organizational interactions,skills, and analytical expertise, as well as systems, networks, and information

Network Services (NET)Systems Administration (ADM)

Systems Analysis (ANA)

Oversee and Govern(OV)

Legal Advice and Advocacy(LGA)

Training, Education, andAwareness (TEA)
Cybersecurity Management(MGT)

Strategic Planning and Policy(SPP)
Executive Cyber Leadership(EXL)
Program/Project Management(PMA) and Acquisition

13

NIST SP 800-181

Categories

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Protect and Defend(PR)

NICE FRAMEWORKSpecialty Areas

Cyber Defense Analysis (CDA)
Cyber Defense
Infrastructure Support (INF)

Incident Response (CIR)

Vulnerability Assessment andManagement (VAM)

Analyze(AN)

Threat Analysis (TWA)

Exploitation Analysis (EXP)
All-Source Analysis (ASA)

Targets (TGT)
Language Analysis (LNG)

Specialty Area Descriptions

exchange capabilities to manage acquisition programs. Executes duties
governing hardware, software, and information system acquisition programs andother program management policies. Provides direct support for acquisitions thatuse information technology (IT) (including National Security Systems), applying
IT-related laws and policies, and provides IT-related guidance throughout the
total acquisition life cycle.
Uses defensive measures and information collected from a variety of sources to
identify, analyze, and report events that occur or might occur within the network
to protect information, information systems, and networks from threats.
Tests, implements, deploys, maintains, reviews, and administers theinfrastructure hardware and software that are required to effectively manage thecomputer network defense service provider network and resources. Monitors
network to actively remediate unauthorized activities.
Responds to crises or urgent situations within the pertinent domain to mitigate
immediate and potential threats. Uses mitigation, preparedness, and response andrecovery approaches, as needed, to maximize survival of life, preservation ofproperty, and information security. Investigates and analyzes all relevant
response activities.
Conducts assessments of threats and vulnerabilities; determines deviations fromacceptable configurations, enterprise or local policy; assesses the level of risk;
and develops and/or recommends appropriate mitigation countermeasures inoperational and nonoperational situations.
Identifies and assesses the capabilities and activities of cybersecurity criminals
or foreign intelligence entities; produces findings to help initialize or support law
enforcement and counterintelligence investigations or activities.
Analyzes collected information to identify vulnerabilities and potential for
exploitation.
Analyzes threat information from multiple sources, disciplines, and agencies
across the Intelligence Community. Synthesizes and places intelligence
information in context; draws insights about the possible implications.
Applies current knowledge of one or more regions, countries, non-state entities,
and/or technologies.
Applies language, cultural, and technical expertise to support informationcollection, analysis, and other cybersecurity activities.

14

NIST SP 800-181

Categories

Collect and Operate(CO)

NICE FRAMEWORKSpecialty Areas

Collection Operations (CLO)

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Cyber Operational Planning(OPL)

Cyber Operations (OPS)Investigate(IN)

Cyber Investigation (INV)

Digital Forensics (FOR)A.3

Specialty Area Descriptions

Executes collection using appropriate strategies and within the priorities
established through the collection management process.
Performs in-depth joint targeting and cybersecurity planning process. Gathers
information and develops detailed Operational Plans and Orders supporting
requirements. Conducts strategic and operational-level planning across the fullrange of operations for integrated information and cyberspace operations.
Performs activities to gather evidence on criminal or foreign intelligence entities
to mitigate possible or real-time threats, protect against espionage or insider
threats, foreign sabotage, international terrorist activities, or to support otherintelligence activities.
Applies tactics, techniques, and procedures for a full range of investigative tools
and processes to include, but not limited to, interview and interrogation
techniques, surveillance, counter surveillance, and surveillance detection, andappropriately balances the benefits of prosecution versus intelligence gathering.
Collects, processes, preserves, analyzes, and presents computer-related evidencein support of network vulnerability mitigation and/or criminal, fraud,counterintelligence, or law enforcement investigations.

NICE Framework Work Roles

Table 3 provides a description of each of the work roles described by the NICE Framework. Each work role is identified by theCategory and Specialty Area, followed by a sequential number (e.g., SP-RSK-001 is the first work role in the SP Category and RSK
Specialty Area). Some of the work role Descriptions originate with external documents (e.g., Committee on National Security Systems
Instruction [CNSSI] 4009) and include that information in the description column. This listing will be updated periodically [1]. The
definitive source for the most current version of this material can be found in the Reference Spreadsheet for NIST Special Publication
800-181 [4].

15

NIST SP 800-181

NICE FRAMEWORKTable 3 - NICE Framework Work Roles

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Category

Specialty Area

Work RoleWork Role ID

Work Role Description

Securely
Provision(SP)

Risk Management(RSK)

Authorizing Official/Designating
Representative

SP-RSK-001

Security Control Assessor

SP-RSK-002

Software Developer

SP-DEV-001

Secure Software Assessor

SP-DEV-002

Enterprise Architect

SP-ARC-001

Security Architect

SP-ARC-002

Senior official or executive with the authority toformally assume responsibility for operating an
information system at an acceptable level of risk toorganizational operations (including mission,functions, image, or reputation), organizational assets,
individuals, other organizations, and the Nation(CNSSI 4009).
Conducts independent comprehensive assessments ofthe management, operational, and technical security
controls and control enhancements employed withinor inherited by an information technology (IT) system
to determine the overall effectiveness of the controls(as defined in NIST SP 800-37).
Develops, creates, maintains, and writes/codes new(or modifies existing) computer applications,software, or specialized utility programs.
Analyzes the security of new or existing computer
applications, software, or specialized utility programs
and provides actionable results.
Develops and maintains business, systems, andinformation processes to support enterprise mission
needs; develops information technology (IT) rules
and requirements that describe baseline and target
architectures.
Ensures that the stakeholder security requirements
necessary to protect the organization’s mission andbusiness processes are adequately addressed in all
aspects of enterprise architecture including reference
models, segment and solution architectures, and theresulting systems supporting those missions andbusiness processes.

SoftwareDevelopment(DEV)

Systems
Architecture
(ARC)

16

NIST SP 800-181

Category

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Operate andMaintain(OM)

NICE FRAMEWORKWork Role ID

Work Role Description

Technology R&D(TRD)

Specialty Area

Research & Development
Specialist

SP-TRD-001

Systems
Requirements
Planning (SRP)
Test andEvaluation (TST)

Systems Requirements Planner

SP-SRP-001

System Testing and Evaluation
Specialist

SP-TST-001

Systems
Development(SYS)

Information Systems Security
Developer

SP-SYS-001

Systems Developer

SP-SYS-002

Database Administrator

OM-DTA-001

Data Analyst

OM-DTA-002

Knowledge Manager

OM-KMG-001

Conducts software and systems engineering andsoftware systems research to develop new
capabilities, ensuring cybersecurity is fully integrated.
Conducts comprehensive technology research toevaluate potential vulnerabilities in cyberspacesystems.
Consults with customers to evaluate functional
requirements and translate functional requirements
into technical solutions.
Plans, prepares, and executes tests of systems toevaluate results against specifications andrequirements as well as analyze/report test results.
Designs, develops, tests, and evaluates information
system security throughout the systems development
life cycle.
Designs, develops, tests, and evaluates information
systems throughout the systems development life
cycle.
Administers databases and/or data management
systems that allow for the secure storage, query,protection, and utilization of data.
Examines data from multiple disparate sources withthe goal of providing security and privacy insight.
Designs and implements custom algorithms,
workflow processes, and layouts for complex,
enterprise-scale data sets used for modeling, data
mining, and research purposes.
Responsible for the management and administrationof processes and tools that enable the organization to
identify, document, and access intellectual capital andinformation content.

Data
Administration(DTA)

Knowledge
Management(KMG)

Work Role

17

NIST SP 800-181

Category

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Oversee andGovern(OV)NICE FRAMEWORKWork Role ID

Work Role Description

Customer Service
and TechnicalSupport (STS)Specialty Area

Technical Support Specialist

OM-STS-001

Network Services(NET)

Network Operations Specialist

OM-NET-001

Systems
Administration(ADM)

System Administrator

OM-ADM-001

Systems Analysis(ANA)

Systems Security Analyst

OM-ANA-001

Legal Advice andAdvocacy (LGA)

Cyber Legal Advisor

OV-LGA-001

Privacy Officer/Privacy
Compliance Manager

OV-LGA-002

Cyber Instructional Curriculum
Developer

OV-TEA-001

Cyber Instructor

OV-TEA-002

Information Systems Security
Manager

OV-MGT-001

Provides technical support to customers who needassistance utilizing client-level hardware and softwarein accordance with established or approved
organizational process components (i.e., Master
Incident Management Plan, when applicable).
Plans, implements, and operates network
services/systems, to include hardware and virtualenvironments.
Responsible for setting up and maintaining a systemor specific components of a system (e.g. for example,
installing, configuring, and updating hardware andsoftware; establishing and managing user accounts;
overseeing or conducting backup and recovery tasks;
implementing operational and technical security
controls; and adhering to organizational security
policies and procedures).
Responsible for the analysis and development of theintegration, testing, operations, and maintenance ofsystems security.
Provides legal advice and recommendations on
relevant topics related to cyber law.
Develops and oversees privacy compliance programand privacy program staff, supporting privacy
compliance, governance/policy, and incident response
needs of privacy and security executives and theirteams.
Develops, plans, coordinates, and evaluates cybertraining/education courses, methods, and techniques
based on instructional needs.
Develops and conducts training or education of
personnel within cyber domain.
Responsible for the cybersecurity of a program,organization, system, or enclave.

Training,
Education, andAwareness (TEA)

Work Role

18

NIST SP 800-181

Category

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Protect andDefend (PR)NICE FRAMEWORKWork Role ID

Work Role Description

Cybersecurity
Management(MGT)

Specialty Area

Communications Security(COMSEC) Manager

OV-MGT-002

Strategic Planningand Policy (SPP)

Cyber Workforce Developer andManager

OV-SPP-001

Cyber Policy and Strategy
Planner

OV-SPP-002

Executive Cyber
Leadership (EXL)

Executive Cyber Leadership

OV-EXL-001

Program/ProjectManagement(PMA) andAcquisition

Program Manager

OV-PMA-001

IT Project Manager
Product Support Manager

OV-PMA-002
OV-PMA-003

IT Investment/Portfolio Manager

OV-PMA-004

IT Program Auditor

OV-PMA-005

Cyber Defense Analyst

PR-CDA-001

Individual who manages the Communications
Security (COMSEC) resources of an organization(CNSSI 4009) or key custodian for a Crypto KeyManagement System (CKMS).
Develops cyberspace workforce plans, strategies, andguidance to support cyberspace workforce manpower,
personnel, training and education requirements and toaddress changes to cyberspace policy, doctrine,materiel, force structure, and education and training
requirements.
Develops and maintains cybersecurity plans, strategy,
and policy to support and align with organizational
cybersecurity initiatives and regulatory compliance.
Executes decision-making authorities and establishes
vision and direction for an organization's cyber andcyber-related resources and/or operations.
Leads, coordinates, communicates, integrates, and isaccountable for the overall success of the program,
ensuring alignment with agency or enterprise
priorities.
Directly manages information technology projects.
Manages the package of support functions required tofield and maintain the readiness and operational
capability of systems and components.
Manages a portfolio of IT investments that align withthe overall needs of mission and enterprise priorities.
Conducts evaluations of an IT program or its
individual components to determine compliance withpublished standards.
Uses data collected from a variety of cyber defense
tools (e.g., IDS alerts, firewalls, network traffic logs)
to analyze events that occur within their environments
for the purposes of mitigating threats.

Cyber Defense
Analysis (CDA)

Work Role

19

NIST SP 800-181

Category

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Analyze(AN)

NICE FRAMEWORKWork Role ID

Work Role Description

Cyber Defense
Infrastructure
Support (INF)
Incident Response(CIR)
Vulnerability
Assessment andManagement(VAM)

Specialty Area

Cyber Defense Infrastructure
Support Specialist

Work Role

PR-INF-001

Tests, implements, deploys, maintains, andadministers the infrastructure hardware and software.

Cyber Defense Incident
Responder
Vulnerability Assessment
AnalystPR-CIR-001

Threat Analysis(TWA)

Threat/Warning Analyst

AN-TWA-001

Exploitation
Analysis (EXP)

Exploitation Analyst

AN-EXP-001

All-Source
Analysis (ASA)

All-Source Analyst

AN-ASA-001

Mission Assessment Specialist

AN-ASA-002

Investigates, analyzes, and responds to cyberincidents within the network environment or enclave.
Performs assessments of systems and networks within
the network environment or enclave and identifies
where those systems/networks deviate fromacceptable configurations, enclave policy, or local
policy. Measures effectiveness of defense-in-deptharchitecture against known vulnerabilities.
Develops cyber indicators to maintain awareness ofthe status of the highly dynamic operating
environment. Collects, processes, analyzes, anddisseminates cyber threat/warning assessments.
Collaborates to identify access and collection gapsthat can be satisfied through cyber collection and/or
preparation activities. Leverages all authorized
resources and analytic techniques to penetratetargeted networks.
Analyzes data/information from one or multiple
sources to conduct preparation of the environment,
respond to requests for information, and submit
intelligence collection and production requirements insupport of planning and operations.
Develops assessment plans and measures of
performance/effectiveness. Conducts strategic andoperational effectiveness assessments as required forcyber events. Determines whether systems performed
as expected and provides input to the determination ofoperational effectiveness.

PR-VAM-001

20

NIST SP 800-181

Category

NICE FRAMEWORKSpecialty Area

Work Role ID

Work Role Description

Target Developer

AN-TGT-001

Target Network Analyst

AN-TGT-002

Language
Analysis (LNG)

Multi-Disciplined Language
AnalystAN-LNG-001

Collection
Operations (CLO)

All Source-Collection Manager

CO-CLO-001

Performs target system analysis, builds and/or
maintains electronic target folders to include inputs
from environment preparation, and/or internal orexternal intelligence sources. Coordinates withpartner target activities and intelligence organizations,and presents candidate targets for vetting andvalidation.
Conducts advanced analysis of collection and opensource data to ensure target continuity; to profile
targets and their activities; and develop techniques togain more target information. Determines how targets
communicate, move, operate and live based on
knowledge of target technologies, digital networks,
and the applications on them.
Applies language and culture expertise withtarget/threat and technical knowledge to process,analyze, and/or disseminate intelligence information
derived from language, voice and/or graphic material.
Creates and maintains language-specific databases
and working aids to support cyber action execution
and ensure critical knowledge sharing. Provides
subject matter expertise in foreign language-intensive
or interdisciplinary projects.
Identifies collection authorities and environment;
incorporates priority information requirements intocollection management; develops concepts to meetleadership's intent. Determines capabilities ofavailable collection assets, identifies new collection
capabilities; and constructs and disseminatescollection plans. Monitors execution of tasked
collection to ensure effective execution of thecollection plan.

Targets (TGT)This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Collect andOperate(CO)Work Role

21

NIST SP 800-181

Category

NICE FRAMEWORKSpecialty Area

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Cyber Operational
Planning (OPL)

Cyber Operations(OPS)

Work RoleWork Role ID

Work Role Description

All Source-Collection
Requirements Manager

CO-CLO-002

Cyber Intel Planner

CO-OPL-001

Cyber Ops Planner

CO-OPL-002

Partner Integration Planner

CO-OPL-003

Cyber Operator

CO-OPS-001

Evaluates collection operations and develops effectsbased collection requirements strategies using
available sources and methods to improve collection.
Develops, processes, validates, and coordinatessubmission of collection requirements. Evaluates
performance of collection assets and collection
operations.
Develops detailed intelligence plans to satisfy cyber
operations requirements. Collaborates with cyber
operations planners to identify, validate, and levy
requirements for collection and analysis. Participatesin targeting selection, validation, synchronization, andexecution of cyber actions. Synchronizes intelligence
activities to support organization objectives incyberspace.
Develops detailed plans for the conduct or support of
the applicable range of cyber operations throughcollaboration with other planners, operators and/or
analysts. Participates in targeting selection,
validation, synchronization, and enables integration
during the execution of cyber actions.
Works to advance cooperation across organizationalor national borders between cyber operations partners.
Aids the integration of partner cyber teams byproviding guidance, resources, and collaboration todevelop best practices and facilitate organizational
support for achieving objectives in integrated cyber
actions.
Conducts collection, processing, and/or geolocationof systems to exploit, locate, and/or track targets ofinterest. Performs network navigation, tacticalforensic analysis, and, when directed, executes on-net
operations.

22

NIST SP 800-181

NICE FRAMEWORKThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Category

Specialty Area

Investigate
(IN)

Cyber
Investigation(INV)
Digital Forensics(FOR)

Work Role ID

Work Role Description

Cyber Crime Investigator

Work Role

IN-INV-001

Law
Enforcement/Counterintelligence
Forensics Analyst

IN-FOR-001

Cyber Defense Forensics
AnalystIN-FOR-002

Identifies, collects, examines, and preserves evidence
using controlled and documented analytical andinvestigative techniques.
Conducts detailed investigations on computer-based
crimes establishing documentary or physicalevidence, to include digital media and logs associatedwith cyber intrusion incidents.
Analyzes digital evidence and investigates computer
security incidents to derive useful information in
support of system/network vulnerability mitigation.

23

NIST SP 800-181

A.4

NICE FRAMEWORKNICE Framework Tasks

Table 4 provides a listing of all the tasks that have been identified as being part of acybersecurity work role. Each work role includes a subset of the tasks listed here. This listing
will be updated periodically [1]. The definitive source for the most current version of thismaterial can be found in the Reference Spreadsheet for NIST Special Publication 800-181 [4].
Table 4 - NICE Framework Tasks
Task ID
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0001
T0002
T0003
T0004
T0005
T0006
T0007
T0008
T0009
T0010
T0011
T0012
T0013
T0014
T0015
T0016
T0017
T0018
T0019
T0020

Task Description

Acquire and manage the necessary resources, including leadership support, financial
resources, and key security personnel, to support information technology (IT) security goals
and objectives and reduce overall organizational risk.
Acquire necessary resources, including financial resources, to conduct an effective
enterprise continuity of operations program.
Advise senior management (e.g., Chief Information Officer [CIO]) on risk levels andsecurity posture.
Advise senior management (e.g., CIO) on cost/benefit analysis of information security
programs, policies, processes, systems, and elements.
Advise appropriate senior leadership or Authorizing Official of changes affecting theorganization's cybersecurity posture.
Advocate organization's official position in legal and legislative proceedings.
Analyze and define data requirements and specifications.
Analyze and plan for anticipated changes in data capacity requirements.
Analyze information to determine, recommend, and plan the development of a new
application or modification of an existing application.
Analyze organization's cyber defense policies and configurations and evaluate compliancewith regulations and organizational directives.
Analyze user needs and software requirements to determine feasibility of design within timeand cost constraints.
Analyze design constraints, analyze trade-offs and detailed system and security design, andconsider life cycle support.
Apply coding and testing standards, apply security testing tools including "'fuzzing" staticanalysis code scanning tools, and conduct code reviews.
Apply secure code documentation.
Apply security policies to applications that interface with one another, such as Business-toBusiness (B2B) applications.
Apply security policies to meet security objectives of the system.
Apply service-oriented security architecture principles to meet organization's
confidentiality, integrity, and availability requirements.
Assess the effectiveness of cybersecurity measures utilized by system(s).
Assess threats to and vulnerabilities of computer system(s) to develop a security risk profile.
Develop content for cyber defense tools.
Build, test, and modify product prototypes using working models or theoretical models.

T0021

T0022
T0023

Capture security controls used during the requirements phase to integrate security within theprocess, to identify key security objectives, and to maximize software security while
minimizing disruption to plans and schedules.
Characterize and analyze network traffic to identify anomalous activity and potential threats
to network resources.

24

NIST SP 800-181

NICE FRAMEWORKTask ID

Task Description

T0024

Collect and maintain data needed to meet system cybersecurity reporting.
Communicate the value of information technology (IT) security throughout all levels of theorganization stakeholders.
Compile and write documentation of program development and subsequent revisions,inserting comments in the coded instructions so others can understand the program.
Conduct analysis of log files, evidence, and other information to determine best methods for
identifying the perpetrator(s) of a network intrusion.
Conduct and/or support authorized penetration testing on enterprise network assets.
Conduct functional and connectivity testing to ensure continuing operability.
Conduct interactive training exercises to create an effective learning environment.
Conduct interviews of victims and witnesses and conduct interviews or interrogations ofsuspects.
Conduct Privacy Impact Assessments (PIAs) of the application’s security design for theappropriate security controls, which protect the confidentiality and integrity of PersonallyIdentifiable Information (PII).
Conduct risk analysis, feasibility study, and/or trade-off analysis to develop, document, andrefine functional requirements and specifications.
Confer with systems analysts, engineers, programmers, and others to design application andto obtain information on project limitations and capabilities, performance requirements, andinterfaces.
Configure and optimize network hubs, routers, and switches (e.g., higher-level protocols,
tunneling).
Confirm what is known about an intrusion and discover new information, if possible, after
identifying intrusion via dynamic analysis.
Construct access paths to suites of information (e.g., link pages) to facilitate access by endusers.
Develop threat model based on customer interviews and requirements.
Consult with customers to evaluate functional requirements.
Consult with engineering staff to evaluate interface between hardware and software.
Coordinate and provide expert technical support to enterprise-wide cyber defense
technicians to resolve cyber defense incidents.
Coordinate with Cyber Defense Analysts to manage and administer the updating of rules
and signatures (e.g., intrusion detection/protection systems, antivirus, and content blacklists)
for specialized cyber defense applications.
Coordinate with enterprise-wide cyber defense staff to validate network alerts.
Collaborate with stakeholders to establish the enterprise continuity of operations program,strategy, and mission assurance.
Coordinate with systems architects and developers, as needed, to provide oversight in thedevelopment of design solutions.
Correct errors by making appropriate changes and rechecking the program to ensure thatdesired results are produced.
Correlate incident data to identify specific vulnerabilities and make recommendations thatenable expeditious remediation.
Create a forensically sound duplicate of the evidence (i.e., forensic image) that ensures theoriginal evidence is not unintentionally modified, to use for data recovery and analysis
processes. This includes, but is not limited to, hard drives, floppy diskettes, CDs, PDAs,
mobile phones, GPS, and all tape formats.
Decrypt seized data using technical means.

T0025
T0026
T0027
T0028
T0029
T0030
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0031

T0032
T0033

T0034
T0035
T0036
T0037
T0038
T0039
T0040
T0041

T0042
T0043
T0044
T0045
T0046
T0047

T0048
T0049

25

NIST SP 800-181

Task ID

T0050

T0051
T0052
T0053
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0054
T0055

T0056
T0057
T0058
T0059
T0060
T0061
T0062
T0063
T0064
T0065
T0066
T0067
T0068
T0069
T0070

T0071
T0072
T0073
T0074
T0075
T0076
T0077

NICE FRAMEWORKTask Description

Define and prioritize essential system capabilities or business functions required for partial
or full system restoration after a catastrophic failure event.
Define appropriate levels of system availability based on critical system functions andensure that system requirements identify appropriate disaster recovery and continuity ofoperations requirements to include any appropriate fail-over/alternate site requirements,
backup requirements, and material supportability requirements for system
recover/restoration.
Define project scope and objectives based on customer requirements.
Design and develop cybersecurity or cybersecurity-enabled products.
Design group policies and access control lists to ensure compatibility with organizational
standards, business rules, and needs.
Design hardware, operating systems, and software applications to adequately address
cybersecurity requirements.
Design or integrate appropriate data backup capabilities into overall system designs, andensure that appropriate technical and procedural processes exist for secure system backups
and protected storage of backup data.
Design, develop, and modify software systems, using scientific analysis and mathematicalmodels to predict and measure outcome and consequences of design.
Determine level of assurance of developed capabilities based on test results.
Develop a plan to investigate alleged crime, violation, or suspicious activity utilizing
computers and the Internet.
Develop an understanding of the needs and requirements of information end-users.
Develop and direct system testing and validation procedures and documentation.
Develop and document requirements, capabilities, and constraints for design procedures andprocesses.
Develop and document systems administration standard operating procedures.
Review and validate data mining and data warehousing programs, processes, andrequirements.
Develop and implement network backup and recovery procedures.
Develop and maintain strategic plans.
Develop architectures or system components consistent with technical specifications.
Develop data standards, policies, and procedures.
Develop detailed security design documentation for component and interface specifications
to support system design and development.
Develop Disaster Recovery and Continuity of Operations plans for systems underdevelopment and ensure testing prior to systems entering a production environment.
Develop/integrate cybersecurity designs for systems and networks with multilevel security
requirements or requirements for the processing of multiple classification levels of dataprimarily applicable to government organizations (e.g., UNCLASSIFIED, SECRET, and
TOP SECRET).
Develop methods to monitor and measure risk, compliance, and assurance efforts.
Develop new or identify existing awareness and training materials that are appropriate forintended audiences.
Develop policy, programs, and guidelines for implementation.
Provide technical summary of findings in accordance with established reporting procedures.
Develop risk mitigation strategies to resolve vulnerabilities and recommend security
changes to system or system components as needed.
Develop secure code and error handling.

26

NIST SP 800-181

Task ID

T0078

T0079
T0080
T0081

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0082
T0083
T0084
T0085

T0086
T0087
T0088
T0089
T0090
T0091
T0092

T0093
T0094
T0095

T0096
T0097
T0098
T0099
T0100
T0101
T0102
T0103
T0104

NICE FRAMEWORKTask Description

Develop specific cybersecurity countermeasures and risk mitigation strategies for systems
and/or applications.
Develop specifications to ensure that risk, compliance, and assurance efforts conform withsecurity, resilience, and dependability requirements at the software application, system, andnetwork environment level.
Develop test plans to address specifications and requirements.
Diagnose network connectivity problem.
Document and address organization's information security, cybersecurity architecture, andsystems security engineering requirements throughout the acquisition life cycle.
Draft statements of preliminary or residual security risks for system operation.
Employ secure configuration management processes.
Ensure all systems security operations and maintenance activities are properly documented
and updated as necessary.
Ensure that the application of security patches for commercial products integrated into
system design meet the timelines dictated by the management authority for the intended
operational environment.
Ensure that chain of custody is followed for all digital media acquired in accordance with
the Federal Rules of Evidence.
Ensure that cybersecurity-enabled products or other compensating security control
technologies reduce identified risk to an acceptable level.
Ensure that security improvement actions are evaluated, validated, and implemented as
required.
Ensure that acquired or developed system(s) and architecture(s) are consistent withorganization's cybersecurity architecture guidelines.
Ensure that cybersecurity inspections, tests, and reviews are coordinated for the network
environment.
Ensure that cybersecurity requirements are integrated into the continuity planning for thatsystem and/or organization(s).
Ensure that protection and detection capabilities are acquired or developed using the IS
security engineering approach and are consistent with organization-level cybersecurity
architecture.
Establish and maintain communication channels with stakeholders.
Establish overall enterprise information security architecture (EISA) with the organization’s
overall security strategy.
Establish relationships, if applicable, between the incident response team and other groups,
both internal (e.g., legal department) and external (e.g., law enforcement agencies, vendors,
public relations professionals).
Evaluate and approve development efforts to ensure that baseline security safeguards areappropriately installed.
Evaluate contracts to ensure compliance with funding, legal, and program requirements.
Evaluate cost/benefit, economic, and risk analysis in decision-making process.
Evaluate factors such as reporting formats required, cost constraints, and need for security
restrictions to determine hardware configuration.
Evaluate the effectiveness and comprehensiveness of existing training programs.
Evaluate the effectiveness of laws, regulations, policies, standards, or procedures.
Examine recovered data for information of relevance to the issue at hand.
Fuse computer network attack analyses with criminal and counterintelligence investigations
and operations.

27

NIST SP 800-181

Task ID

T0105
T0106

T0107
T0108
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0109
T0110
T0111
T0112
T0113
T0114
T0115
T0116
T0117
T0118

T0119
T0120
T0121
T0122
T0123
T0124
T0125
T0126
T0127

T0128
T0129

NICE FRAMEWORKTask Description

Identify components or elements, allocate security functions to those elements, and describe
the relationships between the elements.
Identify alternative information security strategies to address organizational security
objective.
Identify and direct the remediation of technical problems encountered during testing andimplementation of new systems (e.g., identify and find work-arounds for communication
protocols that are not interoperable).
Identify and prioritize critical business functions in collaboration with organizational
stakeholders.
Identify and prioritize essential system functions or sub-systems required to support
essential capabilities or business functions for restoration or recovery after a system failure
or during a system recovery event based on overall system requirements for continuity andavailability.
Identify and/or determine whether a security incident is indicative of a violation of law that
requires specific legal action.
Identify basic common coding flaws at a high level.
Identify data or intelligence of evidentiary value to support counterintelligence and criminal
investigations.
Identify digital evidence for examination and analysis in such a way as to avoid
unintentional alteration.
Identify elements of proof of the crime.
Identify information technology (IT) security program implications of new technologies ortechnology upgrades.
Identify organizational policy stakeholders.
Identify security implications and apply methodologies within centralized and decentralized
environments across the enterprise’s computer systems in software development.
Identify security issues around steady state operation and management of software andincorporate security measures that must be taken when a product reaches its end of life.
Identify, assess, and recommend cybersecurity or cybersecurity-enabled products for use
within a system and ensure that recommended products are in compliance withorganization's evaluation and validation requirements.
Identify, collect, and seize documentary or physical evidence, to include digital media andlogs associated with cyber intrusion incidents, investigations, and operations.
Implement new system design procedures, test procedures, and quality standards.
Implement security designs for new or existing system(s).
Implement specific cybersecurity countermeasures for systems and/or applications.
Incorporate cybersecurity vulnerability solutions into system designs (e.g., Cybersecurity
Vulnerability Alerts).
Install and maintain network infrastructure device operating system software (e.g., IOS,
firmware).
Install or replace network hubs, routers, and switches.
Integrate and align information security and/or cybersecurity policies to ensure that systemanalysis meets security requirements.
Integrate automated capabilities for updating or patching system software where practicaland develop processes and procedures for manual updating and patching of system software
based on current and projected patch timeline requirements for the operational environmentof the system.
Integrate new systems into existing network architecture.

28

NIST SP 800-181

Task ID

T0130
T0131
T0132

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0133
T0134
T0135
T0136
T0137
T0138
T0139
T0140
T0141
T0142
T0143
T0144
T0145
T0146
T0147
T0148
T0149
T0150
T0151
T0152
T0153
T0154
T0155
T0156
T0157
T0158
T0159
T0160

NICE FRAMEWORKTask Description

Interface with external organizations (e.g., public affairs, law enforcement, Command orComponent Inspector General) to ensure appropriate and accurate dissemination of incident
and other Computer Network Defense information.
Interpret and apply laws, regulations, policies, standards, or procedures to specific issues.
Interpret and/or approve security requirements relative to the capabilities of new
information technologies.
Interpret patterns of noncompliance to determine their impact on levels of risk and/or
overall effectiveness of the enterprise’s cybersecurity program.
Lead and align information technology (IT) security priorities with the security strategy.
Lead and oversee information security budget, staffing, and contracting.
Maintain baseline system security according to organizational policies.
Maintain database management systems software.
Maintain deployable cyber defense audit toolkit (e.g., specialized cyber defense softwareand hardware) to support cyber defense audit missions.
Maintain directory replication services that enable information to replicate automaticallyfrom rear servers to forward units via optimized routing.
Maintain information exchanges through publish, subscribe, and alert functions that enable
users to send and receive critical information as required.
Maintain information systems assurance and accreditation materials.
Maintain knowledge of applicable cyber defense policies, regulations, and compliancedocuments specifically related to cyber defense auditing.
Make recommendations based on test results.
Manage accounts, network rights, and access to systems and equipment.
Manage and approve Accreditation Packages (e.g., ISO/IEC 15026-2).
Manage the compilation, cataloging, caching, distribution, and retrieval of data.
Manage the monitoring of information security data sources to maintain organizationalsituational awareness.
Manage the publishing of Computer Network Defense guidance (e.g., TCNOs, Concept ofOperations, Net Analyst Reports, NTSM, MTOs) for the enterprise constituency.
Manage threat or target analysis of cyber defense information and production of threat
information within the enterprise.
Monitor and evaluate a system's compliance with information technology (IT) security,
resilience, and dependability requirements.
Monitor and evaluate the effectiveness of the enterprise's cybersecurity safeguards to ensurethat they provide the intended level of protection.
Monitor and maintain databases to ensure optimal performance.
Monitor network capacity and performance.
Monitor and report the usage of knowledge management assets and resources.
Document and escalate incidents (including event’s history, status, and potential impact for
further action) that may cause ongoing and immediate impact to the environment.
Oversee and make recommendations regarding configuration management.
Oversee the information security training and awareness program.
Participate in an information security risk assessment during the Security Assessment andAuthorization process.
Participate in the development or modification of the computer environment cybersecurity
program plans and requirements.
Patch network vulnerabilities to ensure that information is safeguarded against outside
parties.

29

NIST SP 800-181

Task ID

T0161
T0162

T0163
T0164
T0165
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0166
T0167
T0168
T0169
T0170
T0171
T0172
T0173
T0174

T0175
T0176
T0177
T0178
T0179

T0180
T0181
T0182
T0183
T0184
T0185
T0186
T0187
T0188

NICE FRAMEWORKTask Description

Perform analysis of log files from a variety of sources (e.g., individual host logs, network
traffic logs, firewall logs, and intrusion detection system [IDS] logs) to identify possible
threats to network security.
Perform backup and recovery of databases to ensure data integrity.
Perform cyber defense incident triage, to include determining scope, urgency, and potential
impact, identifying the specific vulnerability, and making recommendations that enable
expeditious remediation.
Perform cyber defense trend analysis and reporting.
Perform dynamic analysis to boot an “image” of a drive (without necessarily having theoriginal drive) to see the intrusion as the user may have seen it, in a native environment.
Perform event correlation using information gathered from a variety of sources within theenterprise to gain situational awareness and determine the effectiveness of an observed
attack.
Perform file signature analysis.
Perform hash comparison against established database.
Perform cybersecurity testing of developed applications and/or systems.
Perform initial, forensically sound collection of images and inspect to discern possible
mitigation/remediation on enterprise systems.
Perform integrated quality assurance testing for security functionality and resiliency attack.
Perform real-time forensic analysis (e.g., using Helix in conjunction with LiveView).
Perform timeline analysis.
Perform needs analysis to determine opportunities for new and improved business processsolutions.
Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion
correlation and tracking, threat analysis, and direct system remediation) tasks to support
deployable Incident Response Teams (IRTs).
Perform secure programming and identify potential flaws in codes to mitigate
vulnerabilities.
Perform security reviews, identify gaps in security architecture, and develop a security risk
management plan.
Perform security reviews and identify security gaps in security architecture resulting inrecommendations for inclusion in the risk mitigation strategy.
Perform static media analysis.
Perform system administration on specialized cyber defense applications and systems (e.g.,
antivirus, audit and remediation) or Virtual Private Network (VPN) devices, to include
installation, configuration, maintenance, backup, and restoration.
Perform risk analysis (e.g., threat, vulnerability, and probability of occurrence) whenever anapplication or system undergoes a major change.
Perform tier 1, 2, and 3 malware analysis.
Perform validation steps, comparing actual results with expected results and analyze thedifferences to identify impact and risks.
Plan and conduct security authorization reviews and assurance case development for initialinstallation of systems and networks.
Plan and manage the delivery of knowledge management projects.
Plan, execute, and verify data redundancy and system recovery procedures.
Plan and recommend modifications or adjustments based on exercise results or system
environment.
Prepare audit reports that identify technical and procedural findings, and provide
recommended remediation strategies/solutions.

30

NIST SP 800-181

Task ID

T0189
T0190
T0191
T0192
T0193
T0194
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0195
T0196

T0197
T0198
T0199
T0200
T0201
T0202
T0203
T0204

T0205

T0206
T0207
T0208
T0209
T0210
T0211
T0212
T0213
T0214
T0215
T0216

NICE FRAMEWORKTask Description

Prepare detailed workflow charts and diagrams that describe input, output, and logicaloperation, and convert them into a series of instructions coded in a computer language.
Prepare digital media for imaging by ensuring data integrity (e.g., write blockers inaccordance with standard operating procedures).
Prepare use cases to justify the need for specific information technology (IT) solutions.
Prepare, distribute, and maintain plans, instructions, guidance, and standard operatingprocedures concerning the security of network system(s) operations.
Process crime scenes.
Properly document all systems security implementation, operations, and maintenanceactivities and update as necessary.
Provide a managed flow of relevant information (via web-based portals or other means)
based on mission requirements.
Provide advice on project costs, design concepts, or design changes.
Provide an accurate technical evaluation of the software application, system, or network,
documenting the security posture, capabilities, and vulnerabilities against relevantcybersecurity compliances.
Provide daily summary reports of network events and activity relevant to cyber defense
practices.
Provide enterprise cybersecurity and supply chain risk management guidance fordevelopment of the Continuity of Operations Plans.
Provide feedback on network requirements, including network architecture andinfrastructure.
Provide guidelines for implementing developed systems to customers or installation teams.
Provide cybersecurity guidance to leadership.
Provide input on security requirements to be included in statements of work and otherappropriate procurement documents.
Provide input to implementation plans and standard operating procedures.
Provide input to the Risk Management Framework process activities and related
documentation (e.g., system life-cycle support plans, concept of operations, operational
procedures, and maintenance training materials).
Provide leadership and direction to information technology (IT) personnel by ensuring thatcybersecurity awareness, basics, literacy, and training are provided to operations personnel
commensurate with their responsibilities.
Provide ongoing optimization and problem-solving support.
Provide recommendations for possible improvements and upgrades.
Provide recommendations on data structures and databases that ensure correct and quality
production of reports/management information.
Provide recommendations on new database technologies and architectures.
Provide system-related input on cybersecurity requirements to be included in statements ofwork and other appropriate procurement documents.
Provide technical assistance on digital evidence matters to appropriate personnel.
Provide technical documents, incident reports, findings from computer examinations,summaries, and other situational awareness information to higher headquarters.
Receive and analyze network alerts from various sources within the enterprise anddetermine possible causes of such alerts.
Recognize a possible security violation and take appropriate action to report the incident, as
required.
Recognize and accurately report forensic artifacts indicative of a particular operating
system.

31

NIST SP 800-181

Task ID

T0217
T0218
T0219
T0220

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0221
T0222
T0223
T0224
T0225
T0226
T0227
T0228
T0229
T0230
T0231
T0232
T0233
T0234
T0235

T0236
T0237
T0238
T0239
T0240
T0241
T0242
T0243
T0244
T0245
T0246

NICE FRAMEWORKTask Description

Address security implications in the software acceptance phase including completion
criteria, risk acceptance and documentation, common criteria, and methods of independent
testing.
Recommend new or revised security, resilience, and dependability measures based on the
results of reviews.
Recommend resource allocations required to securely operate and maintain an
organization’s cybersecurity requirements.
Resolve conflicts in laws, regulations, policies, standards, or procedures.
Review authorization and assurance documents to confirm that the level of risk is within
acceptable limits for each software application, system, and network.
Review existing and proposed policies with stakeholders.
Review or conduct audits of information technology (IT) programs and projects.
Review training documentation (e.g., Course Content Documents [CCD], lesson plans,
student texts, examinations, Schedules of Instruction [SOI], and course descriptions).
Secure the electronic device or information source.
Serve on agency and interagency policy boards.
Recommend policy and coordinate review and approval.
Store, retrieve, and manipulate data for analysis of system capabilities and requirements.
Supervise or manage protective or corrective measures when a cybersecurity incident orvulnerability is discovered.
Support the design and execution of exercise scenarios.
Provide support to security/certification test and evaluation activities.
Test and maintain network infrastructure including software and hardware devices.
Track and document cyber defense incidents from initial detection through final resolution.
Track audit findings and recommendations to ensure that appropriate mitigation actions aretaken.
Translate functional requirements into technical solutions.
Translate security requirements into application design elements including documenting theelements of the software attack surfaces, conducting threat modeling, and defining any
specific security criteria.
Troubleshoot system hardware and software.
Extract data using data carving techniques (e.g., Forensic Tool Kit [FTK], Foremost).
Use federal and organization-specific published documents to manage operations of their
computing environment system(s).
Capture and analyze network traffic associated with malicious activities using network
monitoring tools.
Use specialized equipment and techniques to catalog, document, extract, collect, package,and preserve digital evidence.
Utilize models and simulations to analyze or predict system performance under different
operating conditions.
Verify and update security documentation reflecting the application/system security design
features.
Verify that application software/network/system security postures are implemented asstated, document deviations, and recommend required actions to correct those deviations.
Verify that the software application/network/system accreditation and assurance
documentation is current.
Write and publish cyber defense techniques, guidance, and reports on incident findings toappropriate constituencies.

32

NIST SP 800-181

Task ID

T0247
T0248
T0249
T0250
T0251
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0252
T0253
T0254
T0255

T0256
T0257

T0258
T0259
T0260
T0261
T0262
T0263
T0264

T0265
T0266
T0267
T0268
T0269
T0270
T0271

NICE FRAMEWORKTask Description

Write instructional materials (e.g., standard operating procedures, production manual) to
provide detailed guidance to relevant portion of the workforce.
Promote awareness of security issues among management and ensure sound security
principles are reflected in the organization's vision and goals.
Research current technology to understand capabilities of required system or network.
Identify cyber capabilities strategies for custom hardware and software development basedon mission requirements.
Develop security compliance processes and/or audits for external services (e.g., cloudservice providers, data centers).
Conduct required reviews as appropriate within environment (e.g., Technical Surveillance,
Countermeasure Reviews [TSCM], TEMPEST countermeasure reviews).
Conduct cursory binary analysis.
Oversee policy standards and implementation strategies to ensure procedures and guidelines
comply with cybersecurity policies.
Participate in Risk Governance process to provide security risks, mitigations, and input onother technical risk.
Evaluate the effectiveness of procurement function in addressing information security
requirements and supply chain risks through procurement activities and recommend
improvements.
Determine scope, infrastructure, resources, and data sample size to ensure system
requirements are adequately demonstrated.
Provide timely detection, identification, and alerting of possible attacks/intrusions,anomalous activities, and misuse activities and distinguish these incidents and events frombenign activities.
Use cyber defense tools for continual monitoring and analysis of system activity to identify
malicious activity.
Analyze identified malicious activity to determine weaknesses exploited, exploitation
methods, effects on system and information.
Assist in identifying, prioritizing, and coordinating the protection of critical cyber defense
infrastructure and key resources.
Employ approved defense-in-depth principles and practices (e.g., defense-in-multiple
places, layered defenses, security robustness).
Identify security requirements specific to an information technology (IT) system in allphases of the system life cycle.
Ensure that plans of actions and milestones or remediation plans are in place forvulnerabilities identified during risk assessments, audits, inspections, etc.
Assure successful implementation and functionality of security requirements andappropriate information technology (IT) policies and procedures that are consistent with theorganization's mission and goals.
Perform penetration testing as required for new or updated applications.
Design countermeasures and mitigations against potential exploitations of programming
language weaknesses and vulnerabilities in system and elements.
Define and document how the implementation of a new system or new interfaces between
systems impacts the security posture of the current environment.
Design and develop key management functions (as related to cybersecurity).
Analyze user needs and requirements to plan and conduct system security development.
Develop cybersecurity designs to meet specific operational needs and environmental factors(e.g., access controls, automated applications, networked operations, high integrity and

33

NIST SP 800-181

Task ID

T0272
T0273
T0274
T0275
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0276
T0277
T0278
T0279
T0280
T0281
T0282
T0283
T0284
T0285
T0286
T0287
T0288
T0289
T0290
T0291
T0292
T0293
T0294
T0295
T0296
T0297
T0298
T0299
T0300

T0301

NICE FRAMEWORKTask Description

availability requirements, multilevel security/processing of multiple classification levels,and processing Sensitive Compartmented Information).
Ensure that security design and cybersecurity development activities are properly
documented (providing a functional description of security implementation) and updated asnecessary.
Develop and document supply chain risks for critical system elements, as appropriate.
Create auditable evidence of security measures.
Support necessary compliance activities (e.g., ensure that system security configuration
guidelines are followed, compliance monitoring occurs).
Participate in the acquisition process as necessary, following appropriate supply chain risk
management practices.
Ensure that all acquisitions, procurements, and outsourcing efforts address information
security requirements consistent with organization goals.
Collect intrusion artifacts (e.g., source code, malware, Trojans) and use discovered data toenable mitigation of potential cyber defense incidents within the enterprise.
Serve as technical expert and liaison to law enforcement personnel and explain incident
details as required.
Continuously validate the organization against
policies/guidelines/procedures/regulations/laws to ensure compliance.
Forecast ongoing service demands and ensure that security assumptions are reviewed asnecessary.
Define and/or implement policies and procedures to ensure protection of criticalinfrastructure as appropriate.
Collaborate with stakeholders to identify and/or develop appropriate solutions technology.
Design and develop new tools/technologies as related to cybersecurity.
Perform virus scanning on digital media.
Perform file system forensic analysis.
Perform static analysis to mount an "image" of a drive (without necessarily having theoriginal drive).
Perform static malware analysis.
Utilize deployable forensics toolkit to support operations as necessary.
Determine tactics, techniques, and procedures (TTPs) for intrusion sets.
Examine network topologies to understand data flows through the network.
Recommend computing environment vulnerability corrections.
Identify and analyze anomalies in network traffic using metadata.
Conduct research, analysis, and correlation across a wide variety of all source data sets(indications and warnings).
Validate intrusion detection system (IDS) alerts against network traffic using packet
analysis tools.
Isolate and remove malware.
Identify applications and operating systems of a network device based on network traffic.
Reconstruct a malicious attack or activity based off network traffic.
Identify network mapping and operating system (OS) fingerprinting activities.
Develop and document User Experience (UX) requirements including informationarchitecture and user interface requirements.
Develop and implement cybersecurity independent audit processes for application
software/networks/systems and oversee ongoing independent audits to ensure that
operational and Research and Design (R&D) processes and procedures are in compliancewith organizational and mandatory cybersecurity requirements and accurately followed by

34

NIST SP 800-181

Task ID

T0302
T0303
T0304
T0305
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0306
T0307
T0308
T0309
T0310
T0311
T0312
T0313

T0314
T0315
T0316
T0317
T0318
T0319
T0320
T0321
T0322
T0323
T0324
T0325
T0326
T0327

T0328
T0329
T0330
T0331
T0332

NICE FRAMEWORKTask Description

Systems Administrators and other cybersecurity staff when performing their day-to-day
activities.
Develop contract language to ensure supply chain, system, network, and operational
security are met.
Identify and leverage the enterprise-wide version control system while designing anddeveloping secure applications.
Implement and integrate system development life cycle (SDLC) methodologies (e.g., IBM
Rational Unified Process) into development environment.
Performs configuration management, problem management, capacity management, andfinancial management for databases and data management systems.
Supports incident management, service-level management, change management, releasemanagement, continuity management, and availability management for databases and data
management systems.
Analyze candidate architectures, allocate security services, and select security mechanisms.
Analyze incident data for emerging trends.
Assess the effectiveness of security controls.
Assist in the construction of signatures which can be implemented on cyber defense network
tools in response to new or observed threats within the network environment or enclave.
Consult with customers about software system design and maintenance.
Coordinate with intelligence analysts to correlate threat assessment data.
Design and document quality standards.
Develop a system security context, a preliminary system security Concept of Operations(CONOPS), and define baseline system security requirements in accordance with applicablecybersecurity requirements.
Develop and deliver technical training to educate others or meet customer needs.
Develop or assist in the development of computer based training modules or classes.
Develop or assist in the development of course assignments.
Develop or assist in the development of course evaluations.
Develop or assist in the development of grading and proficiency standards.
Assist in the development of individual/collective development, training, and/or remediationplans.
Develop or assist in the development of learning objectives and goals.
Develop or assist in the development of on-the-job training materials or programs.
Develop or assist in the development of written tests for measuring and assessing learnerproficiency.
Direct software programming and development of documentation.
Document a system's purpose and preliminary system security concept of operations.
Employ configuration management processes.
Evaluate network infrastructure vulnerabilities to enhance capabilities being developed.
Evaluate security architectures and designs to determine the adequacy of security design andarchitecture proposed or provided in response to requirements contained in acquisition
documents.
Follow software and systems engineering life cycle standards and processes.
Maintain assured message delivery systems.
Maintain incident tracking and solution database.
Notify designated managers, cyber incident responders, and cybersecurity service provider
team members of suspected cyber incidents and articulate the event's history, status, and35

NIST SP 800-181

Task ID

T0334
T0335
T0336
T0337
T0338
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0339

T0340
T0341
T0342
T0343
T0344
T0345
T0346
T0347
T0348
T0349

T0350
T0351
T0352
T0353
T0354
T0355
T0356
T0357
T0358
T0359
T0360
T0361
T0362

NICE FRAMEWORKTask Description

potential impact for further action in accordance with the organization's cyber incident
response plan.
Ensure that all systems components can be integrated and aligned (e.g., procedures,
databases, policies, software, and hardware).
Build, install, configure, and test dedicated cyber defense hardware.
Withdrawn: Integrated with T0228
Supervise and assign work to programmers, designers, technologists and technicians, andother engineering and scientific personnel.
Write detailed functional specifications that document the architecture development process.
Lead efforts to promote the organization's use of knowledge management and information
sharing.
Act as a primary stakeholder in the underlying information technology (IT) operational
processes and functions that support the service, provide direction and monitor all
significant activities so the service is delivered successfully.
Advocate for adequate funding for cyber training resources, to include both internal andindustry-provided courses, instructors, and related materials.
Analyze data sources to provide actionable recommendations.
Analyze the crisis to ensure public, personal, and resource protection.
Assess all the configuration management (change configuration/release management)
processes.
Assess effectiveness and efficiency of instruction according to ease of instructional
technology use and student learning, knowledge transfer, and satisfaction.
Assess the behavior of the individual victim, witness, or suspect as it relates to theinvestigation.
Assess the validity of source data and subsequent findings.
Assist in assessing the impact of implementing and sustaining a dedicated cyber defense
infrastructure.
Collect metrics and trending data.
Conduct a market analysis to identify, assess, and recommend commercial, Government offthe-shelf, and open source products for use within a system and ensure recommended
products are in compliance with organization's evaluation and validation requirements.
Conduct hypothesis testing using statistical processes.
Conduct learning needs assessments and identify requirements.
Confer with systems analysts, engineers, programmers, and others to design application.
Coordinate and manage the overall service provided to a customer end-to-end.
Coordinate with internal and external subject matter experts to ensure existing qualification
standards reflect organizational functional requirements and meet industry standards.
Coordinate with organizational manpower stakeholders to ensure appropriate allocation anddistribution of human capital assets.
Create interactive learning exercises to create an effective learning environment.
Design and develop system administration and management functionality for privileged
access users.
Design, implement, test, and evaluate secure interfaces between information systems,
physical systems, and/or embedded technologies.
Determine the extent of threats and recommend courses of action or countermeasures tomitigate risks.
Develop and facilitate data-gathering methods.
Develop and implement standardized position descriptions based on established cyber work
roles.

36

NIST SP 800-181

Task ID

T0363
T0364
T0365
T0366
T0367
T0368
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0369

T0370
T0371

T0372
T0373
T0374
T0375
T0376
T0377
T0378

T0379

T0380
T0381
T0382
T0383
T0384
T0385
T0386
T0387
T0388

NICE FRAMEWORKTask Description

Develop and review recruiting, hiring, and retention procedures in accordance with current
HR policies.
Develop cyber career field classification structure to include establishing career field entry
requirements and other nomenclature such as codes and identifiers.
Develop or assist in the development of training policies and protocols for cyber training.
Develop strategic insights from large data sets.
Develop the goals and objectives for cyber curriculum.
Ensure that cyber career fields are managed in accordance with organizational HR policies
and directives.
Ensure that cyber workforce management policies and processes comply with legal andorganizational requirements regarding equal opportunity, diversity, and fairhiring/employment practices.
Ensure that appropriate Service-Level Agreements (SLAs) and underpinning contracts havebeen defined that clearly set out for the customer a description of the service and themeasures for monitoring the service.
Establish acceptable limits for the software application, network, or system.
Establish and collect metrics to monitor and validate cyber workforce readiness including
analysis of cyber workforce data to assess the status of positions identified, filled, and filledwith qualified personnel.
Establish and oversee waiver processes for cyber career field entry and training qualification
requirements.
Establish cyber career paths to allow career progression, deliberate development, andgrowth within and between cyber career fields.
Establish manpower, personnel, and qualification data element standards to support cyberworkforce management and reporting requirements.
Establish, resource, implement, and assess cyber workforce management programs inaccordance with organizational requirements.
Gather feedback on customer satisfaction and internal service performance to foster
continual improvement.
Incorporates risk-driven systems maintenance updates process to address system
deficiencies (periodically and out of cycle).
Manage the internal relationship with information technology (IT) process owners
supporting the service, assisting with the definition and agreement of Operating Level
Agreements (OLAs).
Plan instructional strategies such as lectures, demonstrations, interactive exercises,
multimedia presentations, video courses, web-based courses for most effective learning
environment in conjunction with educators and trainers.
Present technical information to technical and nontechnical audiences.
Present data in creative formats.
Program custom algorithms.
Promote awareness of cyber policy and strategy as appropriate among management andensure sound principles are reflected in the organization's mission, vision, and goals.
Provide actionable recommendations to critical stakeholders based on data analysis andfindings.
Provide criminal investigative support to trial counsel during the judicial process.
Review and apply cyber career field qualification standards.
Review and apply organizational policies related to or influencing the cyber workforce.

37

NIST SP 800-181

Task ID

T0389
T0390
T0391
T0392
T0393
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0394
T0395
T0396
T0397
T0398
T0399
T0400
T0401
T0402

T0403
T0404

T0405
T0406
T0407
T0408
T0409
T0410
T0411
T0412
T0413
T0414
T0415

NICE FRAMEWORKTask Description

Review service performance reports identifying any significant issues and variances,initiating, where necessary, corrective actions and ensuring that all outstanding issues arefollowed up.
Review/Assess cyber workforce effectiveness to adjust skill and/or qualification standards.
Support integration of qualified cyber workforce personnel into information systems life
cycle development processes.
Utilize technical documentation or resources to implement a new mathematical, data
science, or computer science method.
Validate specifications and requirements for testability.
Work with other service managers and product owners to balance and prioritize services tomeet overall customer requirements, constraints, and objectives.
Write and publish after action reviews.
Process image with appropriate tools depending on analyst’s goals.
Perform Windows registry analysis.
Perform file and registry monitoring on the running system after identifying intrusion via
dynamic analysis.
Enter media information into tracking database (e.g., Product Tracker Tool) for digital
media that has been acquired.
Correlate incident data and perform cyber defense reporting.
Maintain deployable cyber defense toolkit (e.g., specialized cyber defense
software/hardware) to support Incident Response Team mission.
Effectively allocate storage capacity in the design of data management systems.
Read, interpret, write, modify, and execute simple scripts (e.g., Perl, VBScript) on Windows
and UNIX systems (e.g., those that perform tasks such as: parsing large data files,
automating manual tasks, and fetching/processing remote data).
Utilize different programming languages to write code, open files, read files, and write
output to different files.
Utilize open source language such as R and apply quantitative techniques (e.g., descriptive
and inferential statistics, sampling, experimental design, parametric and non-parametrictests of difference, ordinary least squares regression, general line).
Ensure that design and development activities are properly documented (providing afunctional description of implementation) and updated as necessary.
Participate in the acquisition process as necessary.
Interpret and apply applicable laws, statutes, and regulatory documents and integrate into
policy.
Troubleshoot prototype design and process issues throughout the product design,development, and pre-launch phases.
Identify functional- and security-related features to find opportunities for new capability
development to exploit or mitigate vulnerabilities.
Identify and/or develop reverse engineering tools to enhance capabilities and detect
vulnerabilities.
Conduct import/export reviews for acquiring systems and software.
Develop data management capabilities (e.g., cloud-based, centralized cryptographic key
management) to include support to the mobile workforce.
Develop supply chain, system, network, performance, and cybersecurity requirements.
Ensure that supply chain, system, network, performance, and cybersecurity requirements areincluded in contract language and delivered.

38

NIST SP 800-181

Task ID

T0416

T0417
T0418
T0419
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0420
T0421
T0422
T0423
T0424
T0425
T0426
T0427
T0428
T0429
T0430
T0431

T0432
T0433
T0434
T0435
T0436
T0437
T0438
T0439
T0440
T0441
T0442
T0443

NICE FRAMEWORKTask Description

Enable applications with public keying by leveraging existing public key infrastructure(PKI) libraries and incorporating certificate management and encryption functionalities
when appropriate.
Identify and leverage the enterprise-wide security services while designing and developing
secure applications (e.g., Enterprise PKI, Federated Identity server, Enterprise Antivirus
solution) when appropriate.
Install, update, and troubleshoot systems/servers.
Acquire and maintain a working knowledge of constitutional issues which arise in relevantlaws, regulations, policies, agreements, standards, procedures, or other issuances.
Administer test bed(s), and test and evaluate applications, hardware infrastructure,rules/signatures, access controls, and configurations of platforms managed by service
provider(s).
Manage the indexing/cataloguing, storage, and access of explicit organizational knowledge(e.g., hard copy documents, digital files).
Implement data management standards, requirements, and specifications.
Analyze computer-generated threats for counter intelligence or criminal activity.
Analyze and provide information to stakeholders that will support the development of
security application or modification of an existing security application.
Analyze organizational cyber policy.
Analyze the results of software, hardware, or interoperability testing.
Analyze user needs and requirements to plan architecture.
Analyze security needs and software requirements to determine feasibility of design withintime and cost constraints and security mandates.
Assess policy needs and collaborate with stakeholders to develop policies to govern cyber
activities.
Gather and preserve evidence used on the prosecution of computer crimes.
Check system hardware availability, functionality, integrity, and efficiency.
Collect and analyze intrusion artifacts (e.g., source code, malware, and system
configuration) and use discovered data to enable mitigation of potential cyber defense
incidents within the enterprise.
Conduct analysis of log files, evidence, and other information to determine best methods for
identifying the perpetrator(s) of a network intrusion or other crimes.
Conduct framing of pleadings to properly identify alleged violations of law, regulations, or
policy/guidance.
Conduct periodic system maintenance including cleaning (both physically andelectronically), disk checks, routine reboots, data dumps, and testing.
Conduct trial runs of programs and software applications to ensure that the desired
information is produced and instructions and security levels are correct.
Correlate training and learning to business or mission requirements.
Create, edit, and manage network access control lists on specialized cyber defense systems(e.g., firewalls and intrusion prevention systems).
Detect and analyze encrypted data, stenography, alternate data streams and other forms ofconcealed data.
Capture and integrate essential system capabilities or business functions required for partial
or full system restoration after a catastrophic failure event.
Define and integrate current and future mission environments.
Create training courses tailored to the audience and physical environment.
Deliver training courses tailored to the audience and physical/virtual environments.

39

NIST SP 800-181

Task ID

T0444
T0445
T0446
T0447
T0448
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0449
T0450
T0451
T0452
T0453
T0454
T0455
T0456
T0457
T0458
T0459
T0460
T0461
T0462
T0463
T0464
T0465
T0466
T0467
T0468
T0469
T0470
T0471
T0472
T0473

T0474
T0475
T0476
T0477

NICE FRAMEWORKTask Description

Apply concepts, procedures, software, equipment, and/or technology applications tostudents.
Design/integrate a cyber strategy that outlines the vision, mission, and goals that align withthe organization’s strategic plan.
Design, develop, integrate, and update system security measures that provide
confidentiality, integrity, availability, authentication, and non-repudiation.
Design hardware, operating systems, and software applications to adequately address
requirements.
Develop enterprise architecture or system components required to meet user needs.
Design to security requirements to ensure requirements are met for all systems and/or
applications.
Design training curriculum and course content based on requirements.
Participate in development of training curriculum and course content.
Design, build, implement, and maintain a knowledge management framework that provides
end-users access to the organization’s intellectual capital.
Determine and develop leads and identify sources of information to identify and/or
prosecute the responsible parties to an intrusion or other crimes.
Define baseline security requirements in accordance with applicable guidelines.
Develop software system testing and validation procedures, programming, anddocumentation.
Develop secure software testing and validation procedures.
Develop system testing and validation procedures, programming, and documentation.
Comply with organization systems administration standard operating procedures.
Implement data mining and data warehousing applications.
Develop and implement data mining and data warehousing programs.
Implement and enforce local network usage policies and procedures.
Develop procedures and test fail-over for system operations transfer to an alternate site
based on system availability requirements.
Develop cost estimates for new or modified system(s).
Develop detailed design documentation for component and interface specifications to
support system design and development.
Develop guidelines for implementation.
Develop mitigation strategies to address cost, schedule, performance, and security risks.
Ensure that training meets the goals and objectives for cybersecurity training, education, orawareness.
Diagnose and resolve customer reported system incidents, problems, and events.
Analyze and report organizational security posture trends.
Analyze and report system security posture trends.
Document original condition of digital and/or associated evidence (e.g., via digital
photographs, written reports, hash function checking).
Draft, staff, and publish cyber policy.
Document and update as necessary all definition and architecture activities.
Provide legal analysis and decisions to inspectors general, privacy officers, oversight andcompliance personnel regarding compliance with cybersecurity policies and relevant legal
and regulatory requirements.
Assess adequate access controls based on principles of least privilege and need-to-know.
Evaluate the impact of changes to laws, regulations, policies, standards, or procedures.
Ensure the execution of disaster recovery and continuity of operations.

40

NIST SP 800-181

Task ID

T0478
T0479
T0480
T0481
T0482
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0483
T0484
T0485

T0486
T0487
T0488
T0489
T0490
T0491
T0492
T0493
T0494
T0495
T0496
T0497
T0498
T0499
T0500
T0501
T0502

T0503
T0504
T0505

NICE FRAMEWORKTask Description

Provide guidance on laws, regulations, policies, standards, or procedures to management,
personnel, or clients.
Employ information technology (IT) systems and digital storage media to solve, investigate,
and/or prosecute cybercrimes and fraud committed against people and property.
Identify components or elements, allocate comprehensive functional components to include
security functions, and describe the relationships between the elements.
Identify and address cyber workforce planning and management issues (e.g. recruitment,
retention, and training).
Make recommendations based on trend analysis for enhancements to software and hardware
solutions to enhance customer experience.
Identify potential conflicts with implementation of any cyber defense tools (e.g., tool andsignature testing and optimization).
Determine the protection needs (i.e., security controls) for the information system(s) andnetwork(s) and document appropriately.
Implement security measures to resolve vulnerabilities, mitigate risks, and recommend
security changes to system or system components as needed.
Implement Risk Management Framework (RMF)/Security Assessment and Authorization(SA&A) requirements for dedicated cyber defense systems within the enterprise, anddocument and maintain records for them.
Facilitate implementation of new or revised laws, regulations, executive orders, policies,
standards, or procedures.
Implement designs for new or existing system(s).
Implement system security measures in accordance with established procedures to ensure
confidentiality, integrity, availability, authentication, and non-repudiation.
Install and configure database management systems and software.
Install and configure hardware, software, and peripheral equipment for system users inaccordance with organizational standards.
Ensure the integration and implementation of Cross-Domain Solutions (CDS) in a secureenvironment.
Lead and oversee budget, staffing, and contracting.
Administer accounts, network rights, and access to systems and equipment.
Manage Accreditation Packages (e.g., ISO/IEC 15026-2).
Perform asset management/inventory of information technology (IT) resources.
Manage the information technology (IT) planning process to ensure that developed solutions
meet customer requirements.
Manage system/server resources including performance, capacity, availability,
serviceability, and recoverability.
Mitigate/correct security deficiencies identified during security/certification testing and/or
recommend risk acceptance for the appropriate senior leader or authorized representative.
Modify and maintain existing software to correct errors, to adapt it to new hardware, or to
upgrade interfaces and improve performance.
Monitor and maintain system/server configuration.
Monitor and report client-level computer system performance.
Monitor external data sources (e.g., cyber defense vendor sites, Computer Emergency
Response Teams, Security Focus) to maintain currency of cyber defense threat conditionand determine which security issues may have an impact on the enterprise.
Assess and monitor cybersecurity related to system implementation and testing practices.
Monitor the rigorous application of cyber policies, principles, and practices in the deliveryof planning and management services.

41

NIST SP 800-181

NICE FRAMEWORKThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Task ID

Task Description

T0506
T0507
T0508
T0509
T0510
T0511

Seek consensus on proposed policy changes from stakeholders.
Oversee installation, implementation, configuration, and support of system components.
Verify minimum security requirements are in place for all applications.
Perform an information security risk assessment.
Coordinate incident response functions.
Perform developmental testing on systems under development.
Perform interoperability testing on systems exchanging electronic information with othersystems.
Perform operational testing.
Diagnose faulty system/server hardware.
Perform repairs on faulty system/server hardware.
Perform secure program testing, review, and/or assessment to identify potential flaws incodes and mitigate vulnerabilities.
Integrate results regarding the identification of gaps in security architecture.
Perform security reviews and identify security gaps in architecture.
Plan and coordinate the delivery of classroom techniques and formats (e.g., lectures,
demonstrations, interactive exercises, multimedia presentations) for the most effective
learning environment.
Plan non-classroom educational techniques and formats (e.g., video courses, mentoring,
web-based courses).
Plan implementation strategy to ensure that enterprise components can be integrated andaligned.
Prepare legal and other relevant documents (e.g., depositions, briefs, affidavits, declarations,appeals, pleadings, discovery).
Prepare reports to document the investigation following legal standards and requirements.
Promote knowledge sharing between information owners/users through an organization’s
operational processes and systems.
Provide enterprise cybersecurity and supply chain risk management guidance.
Provides cybersecurity recommendations to leadership based on significant threats andvulnerabilities.
Provide input to implementation plans and standard operating procedures as they relate to
information systems security.
Provide input to implementation plans, standard operating procedures, maintenancedocumentation, and maintenance training materials
Provide policy guidance to cyber management, staff, and users.
Develop a trend analysis and impact report.
Troubleshoot hardware/software interface and interoperability problems.
Review forensic images and other data sources (e.g., volatile data) for recovery ofpotentially relevant information.
Review, conduct, or participate in audits of cyber programs and projects.
Conduct periodic reviews/revisions of course content for accuracy, completeness alignment,
and currency (e.g., course content documents, lesson plans, student texts, examinations,schedules of instruction, and course descriptions).
Recommend revisions to curriculum and course content based on feedback from previous
training sessions.
Serve as an internal consultant and advisor in own area of expertise (e.g., technical,
copyright, print media, electronic media).
Support the CIO in the formulation of cyber-related policies.

T0512
T0513
T0514
T0515
T0516
T0517
T0518

T0519
T0520
T0521
T0522
T0523
T0524
T0525
T0526
T0527
T0528
T0529
T0530
T0531
T0532
T0533

T0534
T0535
T0536
T0537

42

NIST SP 800-181

NICE FRAMEWORKTask ID

Task Description

T0538

Provide support to test and evaluation activities.
Test, evaluate, and verify hardware and/or software to determine compliance with defined
specifications and requirements.
Record and manage test data.
Trace system requirements to design components and perform gap analysis.
Translate proposed capabilities into technical requirements.
Verify stability, interoperability, portability, and/or scalability of system architecture.
Work with stakeholders to resolve computer security incidents and vulnerability
compliance.
Write and publish cyber defense recommendations, reports, and white papers on incident
findings to appropriate constituencies.
Research and evaluate available technologies and standards to meet customer requirements.
Provide advice and input for Disaster Recovery, Contingency, and Continuity of Operations
Plans.
Perform technical (evaluation of technology) and nontechnical (evaluation of people andoperations) risk and vulnerability assessments of relevant technology focus areas (e.g., local
computing environment, network and infrastructure, enclave boundary, supporting
infrastructure, and applications).
Make recommendations regarding the selection of cost-effective security controls to
mitigate risk (e.g., protection of information, systems and processes).
Draft and publish supply chain security and risk management documents.
Review and approve a supply chain security/risk management policy.
Apply cybersecurity functions (e.g., encryption, access control, and identity management) to
reduce exploitation opportunities.
Determine and document software patches or the extent of releases that would leavesoftware vulnerable.
Document how the implementation of a new system or new interface between systems
impacts the current and target environment including but not limited to security posture.
Assess and design security management functions as related to cyberspace.
Integrate key management functions as related to cyberspace.
Analyze user needs and requirements to plan and conduct system development.
Develop designs to meet specific operational needs and environmental factors (e.g., access
controls, automated applications, networked operations.
Collaborate on cybersecurity designs to meet specific operational needs and environmental
factors (e.g., access controls, automated applications, networked operations, high integrity
and availability requirements, multilevel security/processing of multiple classificationlevels, and processing Sensitive Compartmented Information).
Accurately characterize targets.
Adjust collection operations or collection plan to address identified issues/challenges and tosynchronize collections with overall operational requirements.
Provide input to the analysis, design, development or acquisition of capabilities used formeeting objectives.
Analyze feedback to determine extent to which collection products and services are meeting
requirements.
Analyze incoming collection requests.
Analyze internal operational architecture, tools, and procedures for ways to improve
performance.
Analyze target operational architecture for ways to gain access.

T0539
T0540
T0541
T0542
T0544
T0545
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0546
T0547
T0548

T0549
T0550
T0551
T0552
T0553
T0554
T0555
T0556
T0557
T0558
T0559

T0560
T0561
T0562
T0563
T0564
T0565
T0566
T0567

43

NIST SP 800-181

Task ID

T0568
T0569
T0570
T0571
T0572
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0573
T0574
T0575
T0576
T0577
T0578
T0579

T0580
T0581
T0582
T0583
T0584
T0585
T0586
T0587
T0588
T0589
T0590
T0591
T0592
T0593
T0594
T0595
T0596
T0597
T0598
T0599
T0600

NICE FRAMEWORKTask Description

Analyze plans, directives, guidance and policy for factors that would influence collection
management's operational structure and requirement s (e.g., duration, scope, communication
requirements, interagency/international agreements).
Answer requests for information.
Apply and utilize authorized cyber capabilities to enable access to targeted networks.
Apply expertise in policy and processes to facilitate the development, negotiation, andinternal staffing of plans and/or memorandums of agreement.
Apply cyber collection, environment preparation and engagement expertise to enable new
exploitation and/or continued collection operations, or in support of customer requirements.
Assess and apply operational environment factors and risks to collection management
process.
Apply and obey applicable statutes, laws, regulations and policies.
Coordinate for intelligence support to operational planning activities.
Assess all-source intelligence and recommend targets to support cyber operation objectives.
Assess efficiency of existing information exchange and management systems.
Assess performance of collection assets against prescribed specifications.
Assess target vulnerabilities and/or operational capabilities to determine course of action.
Assess the effectiveness of collections in satisfying priority information gaps, using
available capabilities and methods, and adjust collection strategies and collection
requirements accordingly.
Assist and advise interagency partners in identifying and developing best practices forfacilitating operational support to achievement of organization objectives.
Provide expertise to course of action development.
Provide subject matter expertise to the development of a common operational picture.
Maintain a common intelligence picture.
Provide subject matter expertise to the development of cyber operations specific indicators.
Assist in the coordination, validation, and management of all-source collection
requirements, plans, and/or activities.
Assist in the development and refinement of priority information requirements.
Provide expertise to the development of measures of effectiveness and measures of
performance.
Assist in the identification of intelligence collection shortfalls.
Enable synchronization of intelligence support plans across partner organizations as
required.
Perform analysis for target infrastructure exploitation activities.
Provide input to the identification of cyber-related success criteria.
Brief threat and/or target current situations.
Build and maintain electronic target folders.
Classify documents in accordance with classification guidelines.
Close requests for information once satisfied.
Collaborate with intelligence analysts/targeting organizations involved in related areas.
Collaborate with development organizations to create and deploy the tools needed toachieve objectives.
Collaborate with other customer, Intelligence and targeting organizations involved in related
cyber areas.
Collaborate with other internal and external partner organizations on target access andoperational issues.

44

NIST SP 800-181

Task ID

T0601
T0602
T0603
T0604
T0605
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0606
T0607
T0608
T0609
T0610
T0611
T0612
T0613
T0614
T0615
T0616
T0617
T0618
T0619
T0620
T0621
T0622
T0623
T0624
T0625
T0626
T0627
T0628

T0629
T0630
T0631
T0632

NICE FRAMEWORKTask Description

Collaborate with other team members or partner organizations to develop a diverse programof information materials (e.g., web pages, briefings, print materials).
Collaborate with customer to define information requirements.
Communicate new developments, breakthroughs, challenges and lessons learned toleadership, and internal and external customers.
Compare allocated and available assets to collection demand as expressed throughrequirements.
Compile lessons learned from collection management activity's execution of organizationcollection objectives.
Compile, integrate, and/or interpret all-source data for intelligence or vulnerability value
with respect to specific targets.
Identify and conduct analysis of target communications to identify information essential tosupport operations.
Conduct analysis of physical and logical digital technologies (e.g., wireless, SCADA,
telecom) to identify potential avenues of access.
Conduct access enabling of wireless computer and digital networks.
Conduct collection and processing of wireless computer and digital networks.
Conduct end-of-operations assessments.
Conduct exploitation of wireless computer and digital networks.
Conduct formal and informal coordination of collection requirements in accordance withestablished guidelines and procedures.
Conduct independent in-depth target and technical analysis including target-specificinformation (e.g., cultural, organizational, political) that results in access.
Conduct in-depth research and analysis.
Conduct network scouting and vulnerability analyses of systems within a network.
Conduct nodal analysis.
Conduct on-net activities to control and exfiltrate data from deployed technologies.
Conduct on-net and off-net activities to control, and exfiltrate data from deployed,
automated technologies.
Conduct open source data collection via various online tools.
Conduct quality control to determine validity and relevance of information gathered about
networks.
Develop, review and implement all levels of planning guidance in support of cyber
operations.
Conduct survey of computer and digital networks.
Conduct target research and analysis.
Consider efficiency and effectiveness of collection assets and resources if/when applied
against priority information requirements.
Construct collection plans and matrixes using established guidance and procedures.
Contribute to crisis action planning for cyber operations.
Contribute to the development of the organization's decision support tools if necessary.
Contribute to the development, staffing, and coordination of cyber operations policies,
performance standards, plans and approval packages with appropriate internal and/or
external decision makers.
Incorporate intelligence equities into the overall design of cyber operations plans.
Coordinate resource allocation of collection assets against prioritized collection
requirements with collection discipline leads.
Coordinate inclusion of collection plan in appropriate documentation.

45

NIST SP 800-181

NICE FRAMEWORKTask ID

Task Description

T0633
T0634

Coordinate target vetting with appropriate partners.
Re-task or re-direct collection assets and resources.
Coordinate with intelligence and cyber defense partners to obtain relevant essential
information.
Coordinate with intelligence planners to ensure that collection managers receive information
requirements.
Coordinate with the intelligence planning team to assess capability to satisfy assigned
intelligence tasks.
Coordinate, produce, and track intelligence requirements.
Coordinate, synchronize and draft applicable intelligence sections of cyber operations plans.
Use intelligence estimates to counter potential target actions.
Create comprehensive exploitation strategies that identify exploitable technical or
operational vulnerabilities.
Maintain awareness of internal and external cyber organization structures, strengths, andemployments of staffing and technology.
Deploy tools to a target and utilize them once deployed (e.g., backdoors, sniffers).
Detect exploits against targeted networks and hosts and react accordingly.
Determine course of action for addressing changes to objectives, guidance, and operational
environment.
Determine existing collection management webpage databases, libraries and storehouses.
Determine how identified factors affect the tasking, collection, processing, exploitation anddissemination architecture's form and function.
Determine indicators (e.g., measures of effectiveness) that are best suited to specific cyber
operation objectives.
Determine organizations and/or echelons with collection authority over all accessible
collection assets.
Determine what technologies are used by a given target.
Develop a method for comparing collection reports to outstanding requirements to identify
information gaps.
Develop all-source intelligence targeting materials.
Apply analytic techniques to gain more target information.
Develop and maintain deliberate and/or crisis plans.
Develop and review specific cyber operations guidance for integration into broader planning
activities.
Develop and review intelligence guidance for integration into supporting cyber operations
planning and execution.
Develop coordinating instructions by collection discipline for each phase of an operation.
Develop cyber operations plans and guidance to ensure that execution and resource
allocation decisions align with organization objectives.
Develop detailed intelligence support to cyber operations requirements.
Develop information requirements necessary for answering priority information requests.
Develop measures of effectiveness and measures of performance.
Allocate collection assets based on leadership's guidance, priorities, and/or operational
emphasis.
Develop munitions effectiveness assessment or operational assessment materials.
Develop new techniques for gaining and keeping access to target systems.
Develop or participate in the development of standards for providing, requesting, and/or
obtaining support from external partners to synchronize cyber operations.

T0635
T0636

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0637
T0638
T0639
T0640
T0641
T0642
T0643
T0644
T0645
T0646
T0647
T0648
T0649
T0650
T0651
T0652
T0653
T0654
T0655
T0656
T0657
T0658
T0659
T0660
T0661
T0662
T0663
T0664
T0665

46

NIST SP 800-181

Task ID

T0666
T0667
T0668
T0669

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0670
T0671
T0672
T0673
T0674
T0675
T0676
T0677
T0678
T0679
T0680
T0681
T0682
T0683
T0684
T0685
T0686
T0687
T0688
T0689
T0690
T0691
T0692
T0693
T0694
T0695
T0696
T0697
T0698
T0699

NICE FRAMEWORKTask Description

Develop or shape international cyber engagement strategies, policies, and activities to meetorganization objectives.
Develop potential courses of action.
Develop procedures for providing feedback to collection managers, asset managers, andprocessing, exploitation and dissemination centers.
Develop strategy and processes for partner planning, operations, and capability
development.
Develop, implement, and recommend changes to appropriate planning procedures andpolicies.
Develop, maintain, and assess cyber cooperation security agreements with external partners.
Devise, document, and validate cyber operation strategy and planning documents.
Disseminate reports to inform decision makers on collection issues.
Disseminate tasking messages and collection plans.
Conduct and document an assessment of the collection results using established procedures.
Draft cyber intelligence collection and production requirements.
Edit or execute simple scripts (e.g., Perl, VBScript) on Windows and UNIX systems.
Engage customers to understand customers’ intelligence needs and wants.
Ensure operational planning efforts are effectively transitioned to current operations.
Ensure that intelligence planning activities are integrated and synchronized with operational
planning timelines.
Establish alternative processing, exploitation and dissemination pathways to address
identified issues or problems.
Validate the link between collection requests and critical information requirements andpriority intelligence requirements of leadership.
Establish processing, exploitation and dissemination management activity using approved
guidance and/or procedures.
Estimate operational effects generated through cyber activities.
Evaluate threat decision-making processes.
Identify threat vulnerabilities.
Identify threats to Blue Force vulnerabilities.
Evaluate available capabilities against desired effects to recommend efficient solutions.
Evaluate extent to which collected information and/or produced intelligence satisfy
information requests.
Evaluate intelligence estimates to support the planning cycle.
Evaluate the conditions that affect employment of available cyber intelligence capabilities.
Generate and evaluate the effectiveness of network analysis strategies.
Evaluate extent to which collection operations are synchronized with operational
requirements.
Evaluate the effectiveness of collection operations against the collection plan.
Examine intercept-related metadata and content with an understanding of targeting
significance.
Exploit network devices, security devices, and/or terminals or environments using various
methods or tools.
Facilitate access enabling by physical and/or wireless means.
Facilitate continuously updated intelligence, surveillance, and visualization input tocommon operational picture managers.
Facilitate interactions between internal and external partner decision makers to synchronize
and integrate courses of action in support of objectives.

47

NIST SP 800-181

Task ID

T0700
T0701

T0702
T0703
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0704
T0705
T0706
T0707
T0708
T0709
T0710
T0711
T0712
T0713
T0714
T0715
T0716
T0717
T0718
T0719
T0720
T0721
T0722
T0723
T0724
T0725
T0726
T0727
T0728
T0729
T0730

NICE FRAMEWORKTask Description

Facilitate the sharing of “best practices” and “lessons learned” throughout the cyber
operations community.
Collaborate with developers, conveying target and technical knowledge in tool requirements
submissions, to enhance tool development.
Formulate collection strategies based on knowledge of available intelligence discipline
capabilities and gathering methods that align multi-discipline collection capabilities andaccesses with targets and their observables.
Gather and analyze data (e.g., measures of effectiveness) to determine effectiveness, andprovide reporting for follow-on activities.
Incorporate cyber operations and communications security support plans into organization
objectives.
Incorporate intelligence and counterintelligence to support plan development.
Gather information about networks through traditional and alternative techniques, (e.g.,social network analysis, call-chaining, traffic analysis.)
Generate requests for information.
Identify threat tactics, and methodologies.
Identify all available partner intelligence capabilities and limitations supporting cyber
operations.
Identify and evaluate threat critical capabilities, requirements, and vulnerabilities.
Identify, draft, evaluate, and prioritize relevant intelligence or information requirements.
Identify and manage security cooperation priorities with external partners.
Identify and submit intelligence requirements for the purposes of designating priority
information requirements.
Identify collaboration forums that can serve as mechanisms for coordinating processes,
functions, and outputs with specified organizations and functional groups.
Identify collection gaps and potential collection strategies against targets.
Identify coordination requirements and procedures with designated collection authorities.
Identify critical target elements.
Identify intelligence gaps and shortfalls.
Identify cyber intelligence gaps and shortfalls for cyber operational planning.
Identify gaps in our understanding of target technology and developing innovativecollection approaches.
Identify issues or problems that can disrupt and/or degrade processing, exploitation anddissemination architecture effectiveness.
Identify network components and their functionality to enable analysis and target
development.
Identify potential collection disciplines for application against priority information
requirements.
Identify potential points of strength and vulnerability within a network.
Identify and mitigate risks to collection management ability to support the plan, operations
and target cycle.
Identify the need, scope, and timeframe for applicable intelligence environment preparation
derived production.
Identify, locate, and track targets via geospatial analysis techniques.
Provide input to or develop courses of action based on threat factors.
Inform external partners of the potential effects of new or revised policy and guidance on
cyber operations partnering activities.
Inform stakeholders (e.g., collection managers, asset managers, processing, exploitation anddissemination centers) of evaluation results using established procedures.

48

NIST SP 800-181

NICE FRAMEWORKTask ID

Task Description

T0731
T0732
T0733
T0734
T0735

Initiate requests to guide tasking and assist with collection management.
Integrate cyber planning/targeting efforts with other organizations.
Interpret environment preparations assessments to determine a course of action.
Issue requests for information.
Lead and coordinate intelligence support to operational planning.
Lead or enable exploitation operations in support of organization objectives and target
requirements.
Link priority collection requirements to optimal assets and resources.
Maintain awareness of advancements in hardware and software technologies (e.g., attend
training or conferences, reading) and their potential implications.
Maintain relationships with internal and external partners involved in cyber planning or
related areas.
Maintain situational awareness and functionality of organic operational infrastructure.
Maintain situational awareness of cyber-related intelligence requirements and associatedtasking.
Maintain situational awareness of partner capabilities and activities.
Maintain situational awareness to determine if changes to the operating environment require
review of the plan.
Maintain target lists (i.e., RTL, JTL, CTL, etc.).
Make recommendations to guide collection in support of customer requirements.
Modify collection requirements as necessary.
Monitor and evaluate integrated cyber operations to identify opportunities to meetorganization objectives.
Monitor and report changes in threat dispositions, activities, tactics, capabilities, objectives,
etc. as related to designated cyber operations warning problem sets.
Monitor and report on validated threat activities.
Monitor completion of reallocated collection efforts.
Monitor open source websites for hostile content directed towards organizational or partnerinterests.
Monitor operational environment and report on adversarial activities which fulfill
leadership’s priority information requirements.
Monitor operational status and effectiveness of the processing, exploitation anddissemination architecture.
Monitor target networks to provide indications and warning of target communications
changes or processing failures.
Monitor the operational environment for potential factors and risks to the collection
operation management process.
Operate and maintain automated systems for gaining and maintaining access to target
systems.
Optimize mix of collection assets and resources to increase effectiveness and efficiency
against essential information associated with priority intelligence requirements.
Produce timely, fused, all-source cyber operations intelligence and/or indications andwarnings intelligence products (e.g., threat assessments, briefings, intelligence studies,country studies).
Contribute to the review and refinement of policy, to include assessments of theconsequences of endorsing or not endorsing such policy.
Provide subject matter expertise to planning teams, coordination groups, and task forces asnecessary.

T0736
T0737
T0738
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0739
T0740
T0741
T0742
T0743
T0744
T0745
T0746
T0747
T0748
T0749
T0750
T0751
T0752
T0753
T0754
T0755
T0756
T0757

T0758
T0759
T0760

49

NIST SP 800-181

Task ID

T0761
T0763
T0764
T0765
T0766
T0767
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0768
T0769
T0770
T0771
T0772
T0773
T0774
T0775
T0776
T0777
T0778
T0779
T0780
T0781
T0782
T0783
T0784
T0785

T0786
T0787
T0788
T0789
T0790
T0791
T0792
T0793
T0794
T0795
T0796
T0797
T0798

NICE FRAMEWORKTask Description

Provide subject-matter expertise and support to planning/developmental forums andworking groups as appropriate.
Conduct long-range, strategic planning efforts with internal and external partners in cyber
activities.
Provide subject matter expertise to planning efforts with internal and external cyber
operations partners.
Provide subject matter expertise to development of exercises.
Propose policy which governs interactions with external coordination groups.
Perform content and/or metadata analysis to meet organization objectives.
Conduct cyber activities to degrade/remove information resident in computers and computer
networks.
Perform targeting automation activities.
Characterize websites.
Provide subject matter expertise to website characterizations.
Prepare for and provide subject matter expertise to exercises.
Prioritize collection requirements for collection platforms based on platform capabilities.
Process exfiltrated data for analysis and/or dissemination to customers.
Produce network reconstructions.
Produce target system analysis products.
Profile network or system administrators and their activities.
Profile targets and their activities.
Provide advice/assistance to operations and intelligence decision makers with reassignmentof collection assets and resources in response to dynamic operational situations.
Provide advisory and advocacy support to promote collection planning as an integrated
component of the strategic campaign plans and other adaptive plans.
Provide aim point and reengagement recommendations.
Provide analyses and support for effectiveness assessment.
Provide current intelligence support to critical internal/external stakeholders as appropriate.
Provide cyber focused guidance and advice on intelligence support plan inputs.
Provide evaluation and feedback necessary for improving intelligence production,
intelligence reporting, collection requirements, and operations.
Provide information and assessments for the purposes of informing leadership andcustomers; developing and refining objectives; supporting operation planning andexecution; and assessing the effects of operations.
Provide input for the development and refinement of the cyber operations objectives,priorities, strategies, plans, and programs.
Provide input and assist in post-action effectiveness assessments.
Provide input and assist in the development of plans and guidance.
Provide input for targeting effectiveness assessments for leadership acceptance.
Provide input to the administrative and logistical elements of an operational support plan.
Provide intelligence analysis and support to designated exercises, planning activities, andtime sensitive operations.
Provide effectiveness support to designated exercises, and/or time sensitive operations.
Provide operations and reengagement recommendations.
Provide planning support between internal and external partners.
Provide real-time actionable geolocation information.
Provide target recommendations which meet leadership objectives.
Provide targeting products and targeting support as designated.

50

NIST SP 800-181

NICE FRAMEWORKTask ID

Task Description

T0799

Provide time sensitive targeting support.
Provide timely notice of imminent or hostile intentions or activities which may impact
organization objectives, resources, or capabilities.
Recommend refinement, adaption, termination, and execution of operational plans as
appropriate.
Review appropriate information sources to determine validity and relevance of information
gathered.
Reconstruct networks in diagram or report format.
Record information collection and/or environment preparation activities against targets
during operations designed to achieve cyber effects.
Report intelligence-derived significant network events and intrusions.
Request discipline-specific processing, exploitation, and disseminate information collectedusing discipline's collection assets and resources in accordance with approved guidance
and/or procedures.
Research communications trends in emerging technologies (in computer and telephony
networks, satellite, cable, and wireless) in both open and classified sources.
Review and comprehend organizational leadership objectives and guidance for planning.
Review capabilities of allocated collection assets.
Review intelligence collection guidance for accuracy/applicability.
Review list of prioritized collection requirements and essential information.
Review and update overarching collection plan, as required.
Review, approve, prioritize, and submit operational requirements for research, development,
and/or acquisition of cyber capabilities.
Revise collection matrix based on availability of optimal assets and resources.
Sanitize and minimize information to protect sources and methods.
Scope the cyber intelligence planning effort.
Serve as a conduit of information from partner teams by identifying subject matter experts
who can assist in the investigation of complex or unusual situations.
Serve as a liaison with external partners.
Solicit and manage to completion feedback from requestors on quality, timeliness, andeffectiveness of collection against collection requirements.
Specify changes to collection plan and/or operational environment that necessitate retasking or re-directing of collection assets and resources.
Specify discipline-specific collections and/or taskings that must be executed in the nearterm.
Submit information requests to collection requirement management section for processing
as collection requests.
Submit or respond to requests for deconfliction of cyber operations.
Support identification and documentation of collateral effects.
Synchronize cyber international engagement activities and associated resource requirements
as appropriate.
Synchronize cyber portions of security cooperation plans.
Synchronize the integrated employment of all available organic and partner intelligencecollection assets using available collaboration capabilities and techniques.
Test and evaluate locally developed tools for operational use.
Test internal developed tools and techniques against target tools.
Track status of information requests, including those processed as collection requests andproduction requirements, using established procedures.

T0800
T0801
T0802
T0803

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0804
T0805

T0806
T0807
T0808
T0809
T0810
T0811
T0812
T0813
T0814
T0815
T0816
T0817
T0818
T0819
T0820
T0821
T0822
T0823
T0824
T0825
T0826
T0827
T0828
T0829
T0830

51

NIST SP 800-181

NICE FRAMEWORKTask ID

Task Description

T0831

Translate collection requests into applicable discipline-specific collection requirements.
Use feedback results (e.g., lesson learned) to identify opportunities to improve collection
management efficiency and effectiveness.
Validate requests for information according to established criteria.
Work closely with planners, intelligence analysts, and collection managers to ensure
intelligence requirements and collection plans are accurate and up-to-date.
Work closely with planners, analysts, and collection managers to identify intelligence gaps
and ensure intelligence requirements are accurate and up-to-date.
Document lessons learned that convey the results of events and/or exercises.
Advise managers and operators on language and cultural issues that impact organization
objectives.
Analyze and process information using language and/or cultural expertise.
Assess, document, and apply a target's motivation and/or frame of reference to facilitate
analysis, targeting and collection opportunities.
Collaborate across internal and/or external organizational lines to enhance collection,
analysis and dissemination.
Conduct all-source target research to include the use of open source materials in the target
language.
Conduct analysis of target communications to identify essential information in support oforganization objectives.
Perform quality review and provide feedback on transcribed or translated materials.
Evaluate and interpret metadata to look for patterns, anomalies, or events, thereby
optimizing targeting, analysis and processing.
Identify cyber threat tactics and methodologies.
Identify target communications within the global network.
Maintain awareness of target communication tools, techniques, and the characteristics oftarget communication networks (e.g., capacity, functionality, paths, critical nodes) and theirpotential implications for targeting, collection, and analysis.
Provide feedback to collection managers to enhance future collection and analysis.
Perform foreign language and dialect identification in initial source data.
Perform or support technical network analysis and mapping.
Provide requirements and feedback to optimize the development of language processing
tools.
Perform social network analysis and document as appropriate.
Scan, identify and prioritize target graphic (including machine-to-machine communications)
and/or voice language material.
Tip critical or time-sensitive information to appropriate customers.
Transcribe target voice materials in the target language.
Translate (e.g., verbatim, gist, and/or summaries) target graphic material.
Translate (e.g., verbatim, gist, and/or summaries) target voice material.
Identify foreign language terminology within computer programs (e.g., comments, variablenames).
Provide near-real time language analysis support (e.g., live operations).
Identify cyber/technology-related terminology in the target language.
Work with the general counsel, external affairs and businesses to ensure both existing andnew services comply with privacy and data security obligations.
Work with legal counsel and management, key departments and committees to ensure theorganization has and maintains appropriate privacy and confidentiality consent,

T0832
T0833
T0834
T0835
T0836
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0837
T0838
T0839
T0840
T0841
T0842
T0843
T0844
T0845
T0846

T0847
T0848
T0849
T0850
T0851
T0852
T0853
T0854
T0855
T0856
T0857
T0858
T0859
T0860
T0861
T0862

52

NIST SP 800-181

Task ID

T0863
T0864
T0865

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0866
T0867
T0868
T0869
T0870
T0871
T0872

T0873
T0874
T0875
T0876
T0877
T0878
T0879

T0880

T0881
T0882

T0883

T0884
T0885

NICE FRAMEWORKTask Description

authorization forms and information notices and materials reflecting current organizationand legal practices and requirements.
Coordinate with the appropriate regulating bodies to ensure that programs, policies andprocedures involving civil rights, civil liberties and privacy considerations are addressed in
an integrated and comprehensive manner.
Liaise with regulatory and accrediting bodies.
Work with external affairs to develop relationships with regulators and other government
officials responsible for privacy and data security issues.
Maintain current knowledge of applicable federal and state privacy laws and accreditation
standards, and monitor advancements in information privacy technologies to ensureorganizational adaptation and compliance.
Ensure all processing and/or databases are registered with the local privacy/data protection
authorities where required.
Work with business teams and senior management to ensure awareness of “best practices”
on privacy and data security issues.
Work with organization senior management to establish an organization-wide Privacy
Oversight Committee
Serve in a leadership role for Privacy Oversight Committee activities
Collaborate on cyber privacy and security policies and procedures
Collaborate with cybersecurity personnel on the security risk assessment process to addressprivacy compliance and risk mitigation
Interface with Senior Management to develop strategic plans for the collection, use andsharing of information in a manner that maximizes its value while complying withapplicable privacy regulations
Provide strategic guidance to corporate officers regarding information resources andtechnology
Assist the Security Officer with the development and implementation of an information
infrastructure
Coordinate with the Corporate Compliance Officer regarding procedures for documenting
and reporting self-disclosures of any evidence of privacy violations.
Work cooperatively with applicable organization units in overseeing consumer information
access rights
Serve as the information privacy liaison for users of technology systems
Act as a liaison to the information systems department
Develop privacy training materials and other communications to increase employee
understanding of company privacy policies, data handling practices and procedures andlegal obligations
Oversee, direct, deliver or ensure delivery of initial privacy training and orientation to all
employees, volunteers, contractors, alliances, business associates and other appropriate third
parties
Conduct on-going privacy training and awareness activities
Work with external affairs to develop relationships with consumer organizations and otherNGOs with an interest in privacy and data security issues—and to manage company
participation in public events related to privacy and data security
Work with organization administration, legal counsel and other related parties to represent
the organization’s information privacy interests with external parties, including government
bodies, which undertake to adopt or amend privacy legislation, regulation or standard.
Report on a periodic basis regarding the status of the privacy program to the Board, CEO orother responsible individual or committee

53

NIST SP 800-181

Task ID

T0886
T0887
T0888

T0889
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0890
T0891
T0892
T0893
T0894
T0895

T0896
T0897
T0898
T0899

T0900
T0901
T0902

T0903

T0904
T0905

T0906
T0907
T0908

NICE FRAMEWORKTask Description

Work with External Affairs to respond to press and other inquiries regarding concern overconsumer and employee data
Provide leadership for the organization’s privacy program
Direct and oversee privacy specialists and coordinate privacy and data security programswith senior executives globally to ensure consistency across the organization
Ensure compliance with privacy practices and consistent application of sanctions for failure
to comply with privacy policies for all individuals in the organization’s workforce, extended
workforce and for all business associates in cooperation with Human Resources, theinformation security officer, administration and legal counsel as applicable
Develop appropriate sanctions for failure to comply with the corporate privacy policies andprocedures
Resolve allegations of noncompliance with the corporate privacy policies or notice of
information practices
Develop and coordinate a risk management and compliance framework for privacy
Undertake a comprehensive review of the company’s data and privacy projects and ensurethat they are consistent with corporate privacy and data security goals and policies.
Develop and manage enterprise-wide procedures to ensure the development of new products
and services is consistent with company privacy policies and legal obligations
Establish a process for receiving, documenting, tracking, investigating and acting on allcomplaints concerning the organization’s privacy policies and procedures
Establish with management and operations a mechanism to track access to protected healthinformation, within the purview of the organization and as required by law and to allow
qualified individuals to review or receive a report on such activity
Provide leadership in the planning, design and evaluation of privacy and security related
projects
Establish an internal privacy audit program
Periodically revise the privacy program considering changes in laws, regulatory or company
policyProvide development guidance and assist in the identification, implementation andmaintenance of organization information privacy policies and procedures in coordination
with organization management and administration and legal counsel
Assure that the use of technologies maintains, and does not erode, privacy protections onuse, collection and disclosure of personal information
Monitor systems development and operations for security and privacy compliance
Conduct privacy impact assessments of proposed rules on the privacy of personal
information, including the type of personal information collected and the number of people
affected
Conduct periodic information privacy impact assessments and ongoing compliancemonitoring activities in coordination with the organization’s other compliance andoperational assessment functions
Review all system-related information security plans to ensure alignment between security
and privacy practices
Work with all organization personnel involved with any aspect of release of protected
information to ensure coordination with the organization’s policies, procedures and legal
requirements
Account for and administer individual requests for release or disclosure of personal and/or
protected information
Develop and manage procedures for vetting and auditing vendors for compliance with theprivacy and data security policies and legal requirements

54

NIST SP 800-181

Task ID

T0909
T0910
T0911
T0912

T0913
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0914
T0915
T0916
T0917
T0918
T0919

T0920
T0921

T0922
T0923
T0924
T0925

T0926
T0927
T0928
T0929
T0930
T0931
T0932

NICE FRAMEWORKTask Description

Participate in the implementation and ongoing compliance monitoring of all trading partnerand business associate agreements, to ensure all privacy concerns, requirements andresponsibilities are addressed
Act as, or work with, counsel relating to business partner contracts
Mitigate effects of a use or disclosure of personal information by employees or business
partners
Develop and apply corrective action procedures
Administer action on all complaints concerning the organization’s privacy policies andprocedures in coordination and collaboration with other similar functions and, whennecessary, legal counsel
Support the organization’s privacy compliance program, working closely with the Privacy
Officer, Chief Information Security Officer, and other business leaders to ensure compliancewith federal and state privacy laws and regulations
Identify and correct potential company compliance gaps and/or areas of risk to ensure fullcompliance with privacy regulations
Manage privacy incidents and breaches in conjunction with the Privacy Officer, Chief
Information Security Officer, legal counsel and the business units
Coordinate with the Chief Information Security Officer to ensure alignment between
security and privacy practices
Establish, implement and maintains organization-wide policies and procedures to comply
with privacy regulations
Ensure that the company maintains appropriate privacy and confidentiality notices, consent
and authorization forms, and materials
Develop and maintain appropriate communications and training to promote and educate all
workforce members and members of the Board regarding privacy compliance issues andrequirements, and the consequences of noncompliance
Determine business partner requirements related to the organization’s privacy program.
Establish and administer a process for receiving, documenting, tracking, investigating andtaking corrective action as appropriate on complaints concerning the company’s privacy
policies and procedures.
Cooperate with the relevant regulatory agencies and other legal entities, and organization
officers, in any compliance reviews or investigations.
Perform ongoing privacy compliance monitoring activities.
Monitor advancements in information privacy technologies to ensure organization adoption
and compliance.
Develop or assist with the development of privacy training materials and othercommunications to increase employee understanding of company privacy policies, data
handling practices and procedures and legal obligations.
Appoint and guide a team of IT security experts.
Collaborate with key stakeholders to establish a cybersecurity risk management program.
Identify and assign individuals to specific roles associated with the execution of the Risk
Management Framework.
Establish a risk management strategy for the organization that includes a determination ofrisk tolerance.
Identify the missions, business functions, and mission/business processes the system will
support.
Identify stakeholders who have a security interest in the development, implementation,
operation, or sustainment of a system.

55

NIST SP 800-181

Task ID

T0933
T0934
T0935
T0936
T0937
T0938
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0939
T0940
T0941
T0942
T0943
T0944
T0945
T0946
T0947
T0948
T0949
T0950
T0951
T0952
T0953
T0954
T0955
T0956
T0957
T0958
T0959
T0960
T0961
T0962

NICE FRAMEWORKTask Description

Identify stakeholders who have a security interest in the development, implementation,
operation, or sustainment of a system.
Identify stakeholder assets that require protection.
Conduct an initial risk assessment of stakeholder assets and update the risk assessment on
an ongoing basis.
Define the stakeholder protection needs and stakeholder security requirements.
Determine the placement of a system within the enterprise architecture.
Identify organization-wide common controls that are available for inheritance byorganizational systems.
Conduct a second-level security categorization for organizational systems with the same
impact level.
Determine the boundary of a system.
Identify the security requirements allocated to a system and to the organization.
Identify the types of information to be processed, stored, or transmitted by a system.
Categorize the system and document the security categorization results as part of system
requirements.
Describe the characteristics of a system.
Register the system with appropriate organizational program/management offices.
Select the security controls for a system and document the functional description of theplanned control implementations in a security plan.
Develop a strategy for monitoring security control effectiveness; coordinate the systemlevel strategy with the organization and mission/business process-level monitoring strategy.
Review and approve security plans.
Implement the security controls specified in a security plan or other system documentation.
Document changes to planned security control implementation and establish theconfiguration baseline for a system.
Develop, review, and approve a plan to assess the security controls in a system and theorganization.
Assess the security controls in accordance with the assessment procedures defined in asecurity assessment plan.
Prepare a security assessment report documenting the issues, findings, andrecommendations from the security control assessment.
Conduct initial remediation actions on security controls based on the findings andrecommendations of a security assessment report; reassess remediated controls.
Prepare a plan of action and milestones based on the findings and recommendations of asecurity assessment report excluding any remediation actions taken.
Assemble an authorization package and submit the package to an authorizing official for
adjudication.
Determine the risk from the operation or use of a system or the provision or use of common
controls.
Identify and implement a preferred course of action in response to the risk determined.
Determine if the risk from the operation or use of the system or the provision or use ofcommon controls, is acceptable.
Monitor changes to a system and its environment of operation.
Assess the security controls employed within and inherited by the system in accordancewith an organization-defined monitoring strategy.
Respond to risk based on the results of ongoing monitoring activities, assessment of risk,
and outstanding items in a plan of action and milestones.

56

NIST SP 800-181

Task ID

T0963
T0964
T0965

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0966
T0967
T0968
T0969
T0970
T0971
T0972
T0973
T0974
T0975
T0976
T0977
T0978
T0980
T0981
T0982
T0983
T0984
T0985
T0986
T0987
T0988
T0989
T0990

NICE FRAMEWORKTask Description

Update a security plan, security assessment report, and plan of action and milestones basedon the results of a continuous monitoring process.
Report the security status of a system (including the effectiveness of security controls) to an
authorizing official on an ongoing basis in accordance with the monitoring strategy.
Review the security status of a system (including the effectiveness of security controls) on
an ongoing basis to determine whether the risk remains acceptable.
Implement a system disposal strategy which executes required actions when a system isremoved from service.
Sponsor and promote continuous monitoring within the organization.
Assign staff as needed to appropriate continuous monitoring working groups.
Identify reporting requirements to support continuous monitoring activities.
Establish scoring and grading metrics to measure effectiveness of continuous monitoring
program.
Determine how to integrate a continuous monitoring program into the organization’s
broader information security governance structures and policies.
Use continuous monitoring scoring and grading metrics to make information security
investment decisions to address persistent issues.
Ensure that the continuous monitoring staff have the training and resources (e.g., staff andbudget) needed to perform assigned duties.
Work with organizational risk analysts to ensure that continuous monitoring reporting
covers appropriate levels of the organization.
Work with the organizational risk analysts to ensure risk metrics are defining realistically tosupport continuous monitoring.
Work with organizational officials to ensure continuous monitoring tool data provides
situation awareness of risk levels.
Establish triggers for unacceptable risk thresholds for continuous monitoring data.
Work with organizational officials to establish system level reporting categories that can beused by the organization’s continuous monitoring program.
Designate a qualified person to be responsible for the management and implementation of
the continuous monitoring program.
Identify the continuous monitoring stakeholders and establish a process to keep theminformed about the program.
Identify security oriented organization reporting requirements that are fulfilled by thecontinuous monitoring program.
Use the continuous monitoring data to make information security investment decisions toaddress persistent issues.
Define triggers within the continuous monitoring program that can be used to define
unacceptable risk and result in action being taken to resolve.
Establish scoring and grading metrics to measure effectiveness of continuous monitoring
program.
Work with security managers to establish appropriate continuous monitoring reporting
requirements at the system level.
Use the continuous monitoring tools and technologies to assess risk on an ongoing basis.
Establish appropriate reporting requirements in adherence to the criteria identified in thecontinuous monitoring program for use in automated control assessment.
Use non-automated assessment methods where the data from the continuous monitoring
tools and technologies is not yet of adequate sufficiency or quality.
Develop processes with the external audit group on how to share information regarding thecontinuous monitoring program and its impact on security control assessment.

57

NIST SP 800-181

Task ID

T0991
T0992
T0993
T0994
T0995
T0996
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

T0997
T0998
T0999
T1000
T1001
T1002

T1003
T1004
T1005
T1006
T1007

NICE FRAMEWORKTask Description

Identify reporting requirements for use in automated control assessment to support
continuous monitoring.
Determine how the continuous monitoring results will be used in ongoing authorization.
Establish continuous monitoring tools and technologies access control process andprocedures.
Ensure that continuous monitoring tools and technologies access control is managed
adequately.
Establish a process to provide technical help to continuous monitoring mitigators.
Coordinate continuous monitoring reporting requirements across various users.
Establish responsibilities for supporting implementation of each continuous monitoring toolor technology.
Establish liaison with scoring and metrics working group to support continuous monitoring.
Establish and operate a process to manage introduction of new risk to support continuous
monitoring.
Establish continuous monitoring configuration settings issues and coordination sub-group.
Establish continuous monitoring tools and technologies performancemeasurement/management requirements.
Using scores and grades to motivate and assess performance while addressing concerns to
support continuous monitoring
Work with security managers (i.e., system owners, information system security managers,
information system security officers, etc.) to establish appropriate reporting requirements
for continuous monitoring at the system level.
Use continuous monitoring tools to assess risk on an ongoing basis.
Use the continuous monitoring data to make information security investment decisions toaddress persistent issues.
Respond to issues flagged during continuous monitoring, escalate and coordinate a
response.
Review findings from the continuous monitoring program and mitigate risks on a timely
basis.

58

NIST SP 800-181

A.5

NICE FRAMEWORKNICE Framework Knowledge Descriptions

Table 5 provides a listing of the various kinds of information applied directly to the performanceof a function. Selected knowledge ID/descriptions from this list are included for every work rolein the Detailed work role Listing in Appendix B. The first six are common to all thecybersecurity work roles. This listing will be updated periodically [1]. The definitive source forthe most current version of this material can be found in the Reference Spreadsheet for NIST
Special Publication 800-181 [4].
Table 5 - NICE Framework Knowledge Descriptions
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

KSA ID
K0001
K0002
K0003
K0004
K0005
K0006
K0007
K0008
K0009
K0010
K0011
K0012
K0013
K0014
K0015
K0016
K0017
K0018
K0019
K0020
K0021
K0022
K0023
K0024
K0025
K0026
K0027
K0028
K0029
K0030
K0031

Description
Knowledge of computer networking concepts and protocols, and network security
methodologies.
Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity andprivacy.
Knowledge of cybersecurity and privacy principles.
Knowledge of cyber threats and vulnerabilities.
Knowledge of specific operational impacts of cybersecurity lapses.
Knowledge of authentication, authorization, and access control methods.
Knowledge of applicable business processes and operations of customer organizations.
Knowledge of application vulnerabilities.
Knowledge of communication methods, principles, and concepts that support the network
infrastructure.
Knowledge of capabilities and applications of network equipment including routers,
switches, bridges, servers, transmission media, and related hardware.
Knowledge of capabilities and requirements analysis.
Knowledge of cyber defense and vulnerability assessment tools and their capabilities.
Knowledge of complex data structures.
Knowledge of computer algorithms.
Knowledge of computer programming principles
Knowledge of concepts and practices of processing digital forensic data.
Knowledge of encryption algorithms
Knowledge of cryptography and cryptographic key management concepts
Knowledge of data administration and data standardization policies.
Knowledge of data backup and recovery.
Knowledge of data mining and data warehousing principles.
Knowledge of database management systems, query languages, table relationships, andviews.
Knowledge of database systems.
Knowledge of digital rights management.
Knowledge of business continuity and disaster recovery continuity of operations plans.
Knowledge of organization's enterprise information security architecture.
Knowledge of organization's evaluation and validation requirements.
Knowledge of organization's Local and Wide Area Network connections.
Knowledge of electrical engineering as applied to computer architecture (e.g., circuitboards, processors, chips, and computer hardware).
Knowledge of enterprise messaging systems and associated software.

59

NIST SP 800-181

KSA ID
K0032
K0033
K0034
K0035
K0036
K0037
K0038
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0039
K0040
K0041
K0042
K0043
K0044
K0045
K0046
K0047
K0048
K0049
K0050
K0051
K0052
K0053

K0054
K0055
K0056
K0057
K0058
K0059
K0060

K0061
K0062

NICE FRAMEWORKDescription
Knowledge of resiliency and redundancy.
Knowledge of host/network access control mechanisms (e.g., access control list, capabilities
lists).
Knowledge of network services and protocols interactions that provide network
communications.
Knowledge of installation, integration, and optimization of system components.
Knowledge of human-computer interaction principles.
Knowledge of Security Assessment and Authorization process.
Knowledge of cybersecurity and privacy principles used to manage risks related to the use,
processing, storage, and transmission of information or data.
Knowledge of cybersecurity and privacy principles and methods that apply to softwaredevelopment.
Knowledge of vulnerability information dissemination sources (e.g., alerts, advisories,
errata, and bulletins).
Knowledge of incident categories, incident responses, and timelines for responses.
Knowledge of incident response and handling methodologies.
Knowledge of industry-standard and organizationally accepted analysis principles andmethods.
Knowledge of cybersecurity and privacy principles and organizational requirements(relevant to confidentiality, integrity, availability, authentication, non-repudiation).
Knowledge of information security systems engineering principles (NIST SP 800-160).
Knowledge of intrusion detection methodologies and techniques for detecting host andnetwork-based intrusions.
Knowledge of information technology (IT) architectural concepts and frameworks.
Knowledge of Risk Management Framework (RMF) requirements.
Knowledge of information technology (IT) security principles and methods (e.g., firewalls,
demilitarized zones, encryption).
Knowledge of local area and wide area networking principles and concepts including
bandwidth management.
Knowledge of low-level computer languages (e.g., assembly languages).
Knowledge of mathematics (e.g. logarithms, trigonometry, linear algebra, calculus,
statistics, and operational analysis).
Knowledge of measures or indicators of system performance and availability.
Knowledge of current industry methods for evaluating, implementing, and disseminating
information technology (IT) security assessment, monitoring, detection, and remediation
tools and procedures utilizing standards-based concepts and capabilities.
Knowledge of microprocessors.
Knowledge of network access, identity, and access management (e.g., public key
infrastructure, Oauth, OpenID, SAML, SPML).
Knowledge of network hardware devices and functions.
Knowledge of network traffic analysis methods.
Knowledge of new and emerging information technology (IT) and cybersecurity
technologies.
Knowledge of operating systems.
Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol[TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information
Technology Infrastructure Library, current version [ITIL]).
Knowledge of packet-level analysis.

60

NIST SP 800-181

KSA ID
K0063
K0064
K0065
K0066
K0067
K0068
K0069

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0070
K0071
K0072
K0073
K0074
K0075
K0076
K0077
K0078
K0079
K0080
K0081
K0082
K0083
K0084
K0086

K0087
K0088
K0089
K0090
K0091
K0092
K0093
K0094
K0095
K0096
K0097

NICE FRAMEWORKDescription
Knowledge of parallel and distributed computing concepts.
Knowledge of performance tuning tools and techniques.
Knowledge of policy-based and risk adaptive access controls.
Knowledge of Privacy Impact Assessments.
Knowledge of process engineering concepts.
Knowledge of programming language structures and logic.
Knowledge of query languages such as SQL (structured query language).
Knowledge of system and application security threats and vulnerabilities (e.g., buffer
overflow, mobile code, cross-site scripting, Procedural Language/Structured Query
Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented
attacks, malicious code).
Knowledge of remote access technology concepts.
Knowledge of resource management principles and techniques.
Knowledge of secure configuration management techniques. (e.g., Security Technical
Implementation Guides (STIGs), cybersecurity best practices on cisecurity.org).
Knowledge of key concepts in security management (e.g., Release Management, PatchManagement).
Knowledge of security system design tools, methods, and techniques.
Knowledge of server administration and systems engineering theories, concepts, andmethods.
Knowledge of server and client operating systems.
Knowledge of server diagnostic tools and fault identification techniques.
Knowledge of software debugging principles.
Knowledge of software design tools, methods, and techniques.
Knowledge of software development models (e.g., Waterfall Model, Spiral Model).
Knowledge of software engineering.
Knowledge of sources, characteristics, and uses of the organization’s data assets.
Knowledge of structured analysis principles and methods.
Knowledge of system design tools, methods, and techniques, including automated systems
analysis and design tools.
Knowledge of system software and organizational design standards, policies, and authorized
approaches (e.g., International Organization for Standardization [ISO] guidelines) relating
to system design.
Knowledge of systems administration concepts.
Knowledge of systems diagnostic tools and fault identification techniques.
Knowledge of system life cycle management principles, including software security andusability.
Knowledge of systems testing and evaluation methods.
Knowledge of technology integration processes.
Knowledge of telecommunications concepts (e.g., Communications channel, Systems Link
Budgeting, Spectral efficiency, Multiplexing).
Knowledge of the capabilities and functionality associated with content creation
technologies (e.g., wikis, social networking, content management systems, blogs).
Knowledge of the capabilities and functionality associated with various technologies fororganizing and managing information (e.g., databases, bookmarking engines).
Knowledge of the capabilities and functionality of various collaborative technologies (e.g.,groupware, SharePoint).
Knowledge of the characteristics of physical and virtual data storage media.

61

NIST SP 800-181

KSA ID
K0098
K0100
K0101
K0102
K0103
K0104
K0105
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0106
K0107
K0108
K0109
K0110
K0111
K0112
K0113

K0114
K0115
K0116
K0117
K0118
K0119
K0120
K0121
K0122
K0123
K0124
K0125
K0126
K0127
K0128

NICE FRAMEWORKDescription
Knowledge of the cyber defense Service Provider reporting structure and processes within
one’s own organization.
Knowledge of the enterprise information technology (IT) architecture.
Knowledge of the organization’s enterprise information technology (IT) goals andobjectives.
Knowledge of the systems engineering process.
Knowledge of the type and frequency of routine hardware maintenance.
Knowledge of Virtual Private Network (VPN) security.
Knowledge of web services (e.g., service-oriented architecture, Simple Object AccessProtocol, and web service description language).
Knowledge of what constitutes a network attack and a network attack’s relationship to boththreats and vulnerabilities.
Knowledge of Insider Threat investigations, reporting, investigative tools andlaws/regulations.
Knowledge of concepts, terminology, and operations of a wide range of communications
media (computer and telephone networks, satellite, fiber, wireless).
Knowledge of physical computer components and architectures, including the functions ofvarious components and peripherals (e.g., CPUs, Network Interface Cards, data storage).
Knowledge of adversarial tactics, techniques, and procedures.
Knowledge of network tools (e.g., ping, traceroute, nslookup)
Knowledge of defense-in-depth principles and network security architecture.
Knowledge of different types of network communication (e.g., LAN, WAN, MAN, WLAN,
WWAN).
Knowledge of electronic devices (e.g., computer systems/components, access control
devices, digital cameras, digital scanners, electronic organizers, hard drives, memory cards,
modems, network components, networked appliances, networked home control devices,
printers, removable storage devices, telephones, copiers, facsimile machines, etc.).
Knowledge that technology that can be exploited.
Knowledge of file extensions (e.g., .dll, .bat, .zip, .pcap, .gzip).
Knowledge of file system implementations (e.g., New Technology File System [NTFS],
File Allocation Table [FAT], File Extension [EXT]).
Knowledge of processes for seizing and preserving digital evidence.
Knowledge of hacking methodologies.
Knowledge of how information needs and collection requirements are translated, tracked,
and prioritized across the extended enterprise.
Knowledge of information security program management and project management
principles and techniques.
Knowledge of investigative implications of hardware, Operating Systems, and network
technologies.
Knowledge of legal governance related to admissibility (e.g. Rules of Evidence).
Knowledge of multiple cognitive domains and tools and methods applicable for learning ineach domain.
Knowledge of processes for collecting, packaging, transporting, and storing electronic
evidence while maintaining chain of custody.
Knowledge of Supply Chain Risk Management Practices (NIST SP 800-161)
Knowledge of the nature and function of the relevant information structure (e.g., National
Information Infrastructure).
Knowledge of types and collection of persistent data.

62

NIST SP 800-181

KSA ID
K0129
K0130
K0131
K0132
K0133
K0134
K0135
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0136
K0137
K0138
K0139
K0140
K0141
K0142
K0143
K0144
K0145
K0146
K0147
K0148
K0149
K0150
K0151
K0152
K0153
K0154
K0155
K0156
K0157
K0158
K0159
K0160
K0161
K0162
K0163
K0164
K0165
K0167

NICE FRAMEWORKDescription
Knowledge of command-line tools (e.g., mkdir, mv, ls, passwd, grep).
Knowledge of virtualization technologies and virtual machine development andmaintenance.
Knowledge of web mail collection, searching/analyzing techniques, tools, and cookies.
Knowledge of which system files (e.g., log files, registry files, configuration files) containrelevant information and where to find those system files.
Knowledge of types of digital forensics data and how to recognize them.
Knowledge of deployable forensics.
Knowledge of web filtering technologies.
Knowledge of the capabilities of different electronic communication systems and methods(e.g., e-mail, VOIP, IM, web forums, Direct Video Broadcasts).
Knowledge of the range of existing networks (e.g., PBX, LANs, WANs, WIFI, SCADA).
Knowledge of Wi-Fi.
Knowledge of interpreted and compiled computer languages.
Knowledge of secure coding techniques.
Withdrawn – Integrated into K0420
Knowledge of collection management processes, capabilities, and limitations.
Knowledge of front-end collection systems, including traffic collection, filtering, andselection.
Knowledge of social dynamics of computer attackers in a global context.
Knowledge of security event correlation tools.
Knowledge of the organization's core business/mission processes.
Knowledge of emerging security issues, risks, and vulnerabilities.
Knowledge of import/export control regulations and responsible agencies for the purposesof reducing supply chain risk.
Knowledge of organization's risk tolerance and/or risk management approach.
Knowledge of enterprise incident response program, roles, and responsibilities.
Knowledge of current and emerging threats/threat vectors.
Knowledge of software related information technology (IT) security principles and methods(e.g., modularization, layering, abstraction, data hiding, simplicity/minimization).
Knowledge of software quality assurance process.
Knowledge of supply chain risk management standards, processes, and practices.
Knowledge of electronic evidence law.
Knowledge of legal rules of evidence and court procedure.
Knowledge of cyber defense and information security policies, procedures, and regulations.
Knowledge of organizational information technology (IT) user security policies (e.g.,
account creation, password rules, access control).
Knowledge of Voice over IP (VoIP).
Knowledge of the common attack vectors on the network layer.
Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution
attacks).
Knowledge of cyber attackers (e.g., script kiddies, insider threat, non-nation state
sponsored, and nation sponsored).
Knowledge of critical information technology (IT) procurement requirements.
Knowledge of functionality, quality, and security requirements and how these will apply to
specific items of supply (i.e., elements and processes).
Knowledge of risk/threat assessment.
Knowledge of system administration, network, and operating system hardening techniques.

63

NIST SP 800-181

KSA ID

K0168
K0169
K0170
K0171
K0172
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0174
K0175
K0176
K0177
K0178
K0179
K0180
K0182
K0183
K0184
K0185
K0186
K0187
K0188

K0189
K0190
K0191
K0192
K0193
K0194
K0195
K0196
K0197

K0198
K0199

NICE FRAMEWORKDescription
Knowledge of applicable laws, statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code),
Presidential Directives, executive branch guidelines, and/or administrative/criminal legal
guidelines and procedures.
Knowledge of information technology (IT) supply chain security and supply chain risk
management policies, requirements, and procedures.
Knowledge of critical infrastructure systems with information communication technologythat were designed without system security considerations.
Knowledge of hardware reverse engineering techniques.
Knowledge of middleware (e.g., enterprise service bus and message queuing).
Knowledge of networking protocols.
Knowledge of software reverse engineering techniques.
Knowledge of Extensible Markup Language (XML) schemas.
Knowledge of cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining
access, escalation of privileges, maintaining access, network exploitation, covering tracks).
Knowledge of secure software deployment methodologies, tools, and practices.
Knowledge of network security architecture concepts including topology, protocols,
components, and principles (e.g., application of defense-in-depth).
Knowledge of network systems management principles, models, methods (e.g., end-to-end
systems performance monitoring), and tools.
Knowledge of data carving tools and techniques (e.g., Foremost).
Knowledge of reverse engineering concepts.
Knowledge of anti-forensics tactics, techniques, and procedures.
Knowledge of forensics lab design configuration and support applications (e.g., VMWare,
Wireshark).
Knowledge of debugging procedures and tools.
Knowledge of file type abuse by adversaries for anomalous behavior.
Knowledge of malware analysis tools (e.g., Oily Debug, Ida Pro).
Knowledge of malware with virtual machine detection (e.g. virtual aware malware,
debugger aware malware, and unpacked malware that looks for VM-related strings in yourcomputer’s display device).
Knowledge of encryption methodologies.
Signature implementation impact for viruses, malware, and attacks.
Knowledge of Windows/Unix ports and services.
Knowledge of advanced data remediation security features in databases.
Knowledge of Cloud-based knowledge management technologies and concepts related tosecurity, governance, procurement, and administration.
Knowledge of data classification standards and methodologies based on sensitivity andother risk factors.
Knowledge of Import/Export Regulations related to cryptography and other security
technologies.
Knowledge of database access application programming interfaces (e.g., Java Database
Connectivity [JDBC]).
Knowledge of organizational process improvement concepts and process maturity models(e.g., Capability Maturity Model Integration (CMMI) for Development, CMMI for Services,
and CMMI for Acquisitions).
Knowledge of security architecture concepts and enterprise architecture reference models(e.g., Zachman, Federal Enterprise Architecture [FEA]).

64

NIST SP 800-181

KSA ID
K0200
K0201

K0202

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0203
K0204
K0205
K0206
K0207
K0208
K0209
K0210
K0211
K0212
K0213
K0214
K0215
K0216
K0217
K0218
K0220
K0221
K0222
K0223
K0224
K0226
K0227
K0228
K0229
K0230
K0231
K0233
K0234
K0235
K0236
K0237
K0238

NICE FRAMEWORKDescription
Knowledge of service management concepts for networks and related standards (e.g.,
Information Technology Infrastructure Library, current version [ITIL]).
Knowledge of symmetric key rotation techniques and concepts.
Knowledge of the application firewall concepts and functions (e.g., Single point ofauthentication/audit/policy enforcement, message scanning for malicious content, data
anonymization for PCI and PII compliance, data loss protection scanning, accelerated
cryptographic operations, SSL security, REST/JSON processing).
Knowledge of security models (e.g., Bell-LaPadula model, Biba integrity model, ClarkWilson integrity model).
Knowledge of learning assessment techniques (rubrics, evaluation plans, tests, quizzes).
Knowledge of basic system, network, and OS hardening techniques.
Knowledge of ethical hacking principles and techniques.
Knowledge of circuit analysis.
Knowledge of computer based training and e-learning services.
Knowledge of covert communication techniques.
Knowledge of data backup and restoration concepts.
Knowledge of confidentiality, integrity, and availability requirements.
Knowledge of cybersecurity-enabled software products.
Knowledge of instructional design and evaluation models (e.g., ADDIE, Smith/Ragan
model, Gagne’s Events of Instruction, Kirkpatrick’s model of evaluation).
Knowledge of the Risk Management Framework Assessment Methodology.
Knowledge of organizational training policies.
Knowledge of learning levels (i.e., Bloom’s Taxonomy of learning).
Knowledge of Learning Management Systems and their use in managing learning.
Knowledge of learning styles (e.g., assimilator, auditory, kinesthetic).
Knowledge of modes of learning (e.g., rote learning, observation).
Knowledge of OSI model and underlying network protocols (e.g., TCP/IP).
Knowledge of relevant laws, legal authorities, restrictions, and regulations pertaining tocyber defense activities.
Withdrawn – integrated into K0073
Knowledge of system administration concepts for operating systems such as but not limited
to Unix/Linux, IOS, Android, and Windows operating systems.
Knowledge of organizational training systems.
Knowledge of various types of computer architectures.
Knowledge of taxonomy and semantic ontology theory.
Knowledge of applications that can log errors, exceptions, and application faults andlogging.
Knowledge of cloud service models and how those models can limit incident response.
Knowledge of crisis management protocols, processes, and techniques.
Knowledge of the National Cybersecurity Workforce Framework, work roles, andassociated tasks, knowledge, skills, and abilities.
Knowledge of full spectrum cyber capabilities (e.g., defense, attack, exploitation).
Knowledge of how to leverage research and development centers, think tanks, academic
research, and industry systems.
Knowledge of how to utilize Hadoop, Java, Python, SQL, Hive, and Pig to explore data.
Knowledge of industry best practices for service desk.
Knowledge of machine learning theory and principles.

65

NIST SP 800-181

KSA ID
K0239
K0240
K0241
K0242
K0243
K0244
K0245
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0246
K0247
K0248
K0249
K0250
K0251

K0252
K0253
K0254
K0255
K0257
K0258
K0259
K0260
K0261
K0262
K0263
K0264
K0265
K0266
K0267
K0268
K0269
K0270
K0271
K0272

NICE FRAMEWORKDescription
Knowledge of media production, communication, and dissemination techniques andmethods, including alternative ways to inform via written, oral, and visual media.
Knowledge of multi-level security systems and cross domain solutions.
Knowledge of organizational human resource policies, processes, and procedures.
Knowledge of organizational security policies.
Knowledge of organizational training and education policies, processes, and procedures.
Knowledge of physical and physiological behaviors that may indicate suspicious orabnormal activity.
Knowledge of principles and processes for conducting training and education needs
assessment.
Knowledge of relevant concepts, procedures, software, equipment, and technology
applications.
Knowledge of remote access processes, tools, and capabilities related to customer support.
Knowledge of strategic theory and practice.
Knowledge of sustainment technologies, processes and strategies.
Knowledge of Test & Evaluation processes for learners.
Knowledge of the judicial process, including the presentation of facts and evidence.
Knowledge of training and education principles and methods for curriculum design,
teaching and instruction for individuals and groups, and the measurement of training andeducation effects.
Withdrawn – Integrated into K0227
Knowledge of binary analysis.
Knowledge of network architecture concepts including topology, protocols, andcomponents.
Knowledge of information technology (IT) acquisition/procurement requirements.
Knowledge of test procedures, principles, and methodologies (e.g., Capabilities andMaturity Model Integration (CMMI)).
Knowledge of malware analysis concepts and methodologies.
Knowledge of Personally Identifiable Information (PII) data security standards.
Knowledge of Payment Card Industry (PCI) data security standards.
Knowledge of Personal Health Information (PHI) data security standards.
Knowledge of information technology (IT) risk management policies, requirements, andprocedures.
Knowledge of program protection planning (e.g. information technology (IT) supply chain
security/risk management policies, anti-tampering techniques, and requirements).
Knowledge of infrastructure supporting information technology (IT) for safety,
performance, and reliability.
Knowledge of how to evaluate the trustworthiness of the supplier and/or product.
Knowledge of laws, policies, procedures, or governance relevant to cybersecurity for criticalinfrastructures.
Knowledge of forensic footprint identification.
Knowledge of mobile communications architecture.
Knowledge of the acquisition/procurement life cycle process.
Knowledge of operating system structures and internals (e.g., process management,
directory structure, installed applications).
Knowledge of network analysis tools used to identify software communications
vulnerabilities.

66

NIST SP 800-181

KSA ID

K0274
K0275
K0276

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0277
K0278
K0280
K0281
K0282
K0283
K0284
K0285
K0286
K0287
K0288
K0289
K0290
K0291
K0292
K0293
K0294
K0295

K0296
K0297
K0298

K0299
K0300
K0301
K0302
K0303
K0304
K0305
K0308
K0309

NICE FRAMEWORKDescription
Knowledge of transmission records (e.g., Bluetooth, Radio Frequency Identification(RFID), Infrared Networking (IR), Wireless Fidelity (Wi-Fi). paging, cellular, satellite
dishes, Voice over Internet Protocol (VoIP)), and jamming techniques that enabletransmission of undesirable information, or prevent installed systems from operatingcorrectly.
Knowledge of configuration management techniques.
Knowledge of security management.
Knowledge of current and emerging data encryption (e.g., Column and Tablespace
Encryption, file and disk encryption) security features in databases (e.g. built-in
cryptographic key management features).
Knowledge of current and emerging data remediation security features in databases.
Knowledge of systems engineering theories, concepts, and methods.
Knowledge of information technology (IT) service catalogues.
Withdrawn – Integrated into K0200
Knowledge of use cases related to collaboration and content synchronization acrossplatforms (e.g., Mobile, PC, Cloud).
Knowledge of developing and applying user credential management system.
Knowledge of implementing enterprise key escrow systems to support data-at-rest
encryption.
Knowledge of N-tiered typologies (e.g. including server and client operating systems).
Knowledge of an organization's information classification program and procedures for
information compromise.
Knowledge of industry standard security models.
Knowledge of system/server diagnostic tools and fault identification techniques.
Knowledge of systems security testing and evaluation methods.
Knowledge of the enterprise information technology (IT) architectural concepts and patterns(e.g., baseline, validated design, and target architectures.)
Knowledge of the operations and processes for incident, problem, and event management.
Knowledge of integrating the organization’s goals and objectives into the architecture.
Knowledge of IT system operation, maintenance, and security needed to keep equipment
functioning properly.
Knowledge of confidentiality, integrity, and availability principles.
Knowledge of capabilities, applications, and potential vulnerabilities of network equipment
including hubs, routers, switches, bridges, servers, transmission media, and related
hardware.
Knowledge of countermeasure design for identified security risks.
Knowledge of countermeasures for identified security risks.
Knowledge in determining how a security system should work (including its resilience anddependability capabilities) and how changes in conditions, operations, or the environment
will affect these outcomes.
Knowledge of network mapping and recreating network topologies.
Knowledge of packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
Knowledge of the basic operation of computers.
Knowledge of the use of sub-netting tools.
Knowledge of concepts and practices of processing digital forensic data.
Knowledge of data concealment (e.g. encryption algorithms and stenography).
Knowledge of cryptology.
Knowledge of emerging technologies that have potential for exploitation.

67

NIST SP 800-181

KSA ID
K0310
K0311
K0312
K0313
K0314
K0315
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0316
K0317
K0318
K0319
K0320
K0321
K0322
K0323
K0324
K0325
K0326
K0330
K0332
K0333
K0334
K0335
K0336
K0337
K0338
K0339
K0341
K0342
K0343
K0344
K0346
K0347
K0349
K0350

NICE FRAMEWORKDescription
Knowledge of hacking methodologies.
Knowledge of industry indicators useful for identifying technology trends.
Knowledge of intelligence gathering principles, policies, and procedures including legal
authorities and restrictions.
Knowledge of external organizations and academic institutions with cyber focus (e.g., cybercurriculum/training and Research & Development).
Knowledge of industry technologies’ potential cybersecurity vulnerabilities.
Knowledge of the principal methods, procedures, and techniques of gathering informationand producing, reporting, and sharing information.
Knowledge of business or military operation plans, concept operation plans, orders,
policies, and standing rules of engagement.
Knowledge of procedures used for documenting and querying reported incidents, problems,and events.
Knowledge of operating system command-line tools.
Knowledge of technical delivery capabilities and their limitations.
Knowledge of organization's evaluation and validation criteria.
Knowledge of engineering concepts as applied to computer architecture and associatedcomputer hardware/software.
Knowledge of embedded systems.
Knowledge of system fault tolerance methodologies.
Knowledge of Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools
and applications.
Knowledge of Information Theory (e.g., source coding, channel coding, algorithm
complexity theory, and data compression).
Knowledge of demilitarized zones.
Knowledge of successful capabilities to identify the solutions to less common and more
complex system problems.
Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain
Name System (DNS), and directory services.
Knowledge of network design processes, to include understanding of security objectives,operational objectives, and trade-offs.
Knowledge of network traffic analysis (tools, methodologies, processes).
Knowledge of current and emerging cyber technologies.
Knowledge of access authentication methods.
Withdrawn – Integrated into K0007
Knowledge of data mining techniques.
Knowledge of how to use network analysis tools to identify vulnerabilities.
Knowledge of foreign disclosure policies and import/export control regulations as related tocybersecurity.
Knowledge of penetration testing principles, tools, and techniques.
Knowledge of root cause analysis techniques.
Knowledge of an organization’s threat environment.
Knowledge of principles and methods for integrating system components.
Knowledge and understanding of operational design.
Knowledge of website types, administration, functions, and content management system(CMS).
Knowledge of accepted organization planning systems.

68

NIST SP 800-181

KSA ID
K0351
K0352

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0353
K0354
K0355
K0356
K0357
K0358
K0359
K0361
K0362
K0363
K0364
K0367
K0368
K0371
K0372
K0373
K0375
K0376
K0377
K0379
K0380
K0381
K0382
K0383
K0384
K0385
K0386
K0387
K0388
K0389
K0390
K0391
K0392
K0393

NICE FRAMEWORKDescription
Knowledge of applicable statutes, laws, regulations and policies governing cyber targetingand exploitation.
Knowledge of forms of intelligence support needs, topics, and focus areas.
Knowledge of possible circumstances that would result in changing collection management
authorities.
Knowledge of relevant reporting and dissemination procedures.
Knowledge of all-source reporting and dissemination procedures.
Knowledge of analytic tools and techniques for language, voice and/or graphic material.
Knowledge of analytical constructs and their use in assessing the operational environment.
Knowledge of analytical standards and the purpose of intelligence confidence levels.
Knowledge of approved intelligence dissemination processes.
Knowledge of asset availability, capabilities and limitations.
Knowledge of attack methods and techniques (DDoS, brute force, spoofing, etc.).
Knowledge of auditing and logging procedures (including server-based logging).
Knowledge of available databases and tools necessary to assess appropriate collection
tasking.
Knowledge of penetration testing.
Knowledge of implants that enable cyber collection and/or preparation activities.
Knowledge of principles of the collection development processes (e.g., Dialed Number
Recognition, Social Network Analysis).
Knowledge of programming concepts (e.g., levels, structures, compiled vs. interpreted
languages).
Knowledge of basic software applications (e.g., data storage and backup, databaseapplications) and the types of vulnerabilities that have been found in those applications.
Knowledge of wireless applications vulnerabilities.
Knowledge of internal and external customers and partner organizations, including
information needs, objectives, structure, capabilities, etc.
Knowledge of classification and control markings standards, policies and procedures.
Knowledge of client organizations, including information needs, objectives, structure,capabilities, etc.
Knowledge of collaborative tools and environments.
Knowledge of collateral damage and estimating impact(s).
Knowledge of collection capabilities and limitations.
Knowledge of collection capabilities, accesses, performance specifications, and constraints
utilized to satisfy collection plan.
Knowledge of collection management functionality (e.g., positions, functions,
responsibilities, products, reporting requirements).
Withdrawn – Integrated into K0142
Knowledge of collection management tools.
Knowledge of collection planning process and collection plan.
Knowledge of collection searching/analyzing techniques and tools for chat/buddy list,
emerging technologies, VOIP, Media Over IP, VPN, VSAT/wireless, web mail and cookies.
Knowledge of collection sources including conventional and non-conventional sources.
Knowledge of collection strategies.
Knowledge of collection systems, capabilities, and processes.
Knowledge of common computer/network infections (virus, Trojan, etc.) and methods ofinfection (ports, attachments, etc.).
Knowledge of common networking devices and their configurations.

69

NIST SP 800-181

KSA ID
K0394
K0395
K0396
K0397

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0398
K0399
K0400
K0401
K0402
K0403
K0404
K0405
K0406
K0407
K0408
K0409
K0410
K0411
K0412
K0413
K0414
K0415
K0416
K0417
K0418
K0419
K0420
K0421
K0422
K0423
K0424
K0425
K0426
K0427
K0428
K0429
K0430
K0431
K0432
K0433

NICE FRAMEWORKDescription
Knowledge of common reporting databases and tools.
Knowledge of computer networking fundamentals (i.e., basic computer components of a
network, types of networks, etc.).
Knowledge of computer programming concepts, including computer languages,
programming, testing, debugging, and file types.
Knowledge of security concepts in operating systems (e.g., Linux, Unix.)
Knowledge of concepts related to websites (e.g., web servers/pages, hosting, DNS,
registration, web languages such as HTML).
Knowledge of crisis action planning and time sensitive planning procedures.
Knowledge of crisis action planning for cyber operations.
Knowledge of criteria for evaluating collection products.
Knowledge of criticality and vulnerability factors (e.g., value, recuperation, cushion,countermeasures) for target selection and applicability to the cyber domain.
Knowledge of cryptologic capabilities, limitations, and contributions to cyber operations.
Knowledge of current collection requirements.
Knowledge of current computer-based intrusion sets.
Knowledge of current software and methodologies for active defense and system hardening.
Knowledge of customer information needs.
Knowledge of cyber actions (i.e. cyber defense, information gathering, environment
preparation, cyber-attack) principles, capabilities, limitations, and effects.
Knowledge of cyber intelligence/information collection capabilities and repositories.
Knowledge of cyber laws and their effect on Cyber planning.
Knowledge of cyber laws and legal considerations and their effect on cyber planning.
Knowledge of cyber lexicon/terminology
Knowledge of cyber operation objectives, policies, and legalities.
Knowledge of cyber operations support or enabling processes.
Knowledge of cyber operations terminology/lexicon.
Knowledge of cyber operations.
Knowledge of data communications terminology (e.g., networking protocols, Ethernet, IP,
encryption, optical devices, removable media).
Knowledge of data flow process for terminal or environment collection.
Knowledge of database administration and maintenance.
Knowledge of database theory.
Knowledge of databases, portals and associated dissemination vehicles.
Knowledge of deconfliction processes and procedures.
Knowledge of deconfliction reporting to include external organization interaction.
Knowledge of denial and deception techniques.
Knowledge of different organization objectives at all levels, including subordinate, lateraland higher.
Knowledge of dynamic and deliberate targeting.
Knowledge of encryption algorithms and cyber capabilities/tools (e.g., SSL, PGP).
Knowledge of encryption algorithms and tools for wireless local area networks (WLANs).
Knowledge of enterprise-wide information management.
Knowledge of evasion strategies and techniques.
Knowledge of evolving/emerging communications technologies.
Knowledge of existing, emerging, and long-range issues related to cyber operations
strategy, policy, and organization.
Knowledge of forensic implications of operating system structure and operations.

70

NIST SP 800-181

KSA ID
K0435

K0436
K0437
K0438
K0439
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0440
K0442
K0443
K0444
K0445
K0446
K0447
K0448
K0449
K0450
K0451
K0452
K0453
K0454
K0455
K0456
K0457
K0458
K0459
K0460
K0461

K0462
K0463
K0464
K0465
K0466
K0467
K0468
K0469

NICE FRAMEWORKDescription
Knowledge of fundamental cyber concepts, principles, limitations, and effects.
Knowledge of fundamental cyber operations concepts, terminology/lexicon (i.e.,environment preparation, cyber-attack, cyber defense), principles, capabilities, limitations,and effects.
Knowledge of general Supervisory control and data acquisition (SCADA) systemcomponents.
Knowledge of mobile cellular communications architecture (e.g., LTE, CDMA,
GSM/EDGE and UMTS/HSPA).
Knowledge of governing authorities for targeting.
Knowledge of host-based security products and how those products affect exploitation andreduce vulnerability.
Knowledge of how converged technologies impact cyber operations (e.g., digital, telephony,wireless).
Knowledge of how hubs, switches, routers work together in the design of a network.
Knowledge of how Internet applications work (SMTP email, web-based email, chat clients,
VOIP).
Knowledge of how modern digital and telephony networks impact cyber operations.
Knowledge of how modern wireless communications systems impact cyber operations.
Knowledge of how to collect, view, and identify essential information on targets of interest
from metadata (e.g., email, http).
Knowledge of how to establish priorities for resources.
Knowledge of how to extract, analyze, and use metadata.
Withdrawn – Integrated into K0036
Knowledge of identification and reporting processes.
Knowledge of implementing Unix and Windows systems that provide radius authenticationand logging, DNS, mail, web service, FTP server, DHCP, firewall, and SNMP.
Knowledge of indications and warning.
Knowledge of information needs.
Knowledge of information security concepts, facilitating technologies and methods.
Knowledge of intelligence capabilities and limitations.
Knowledge of intelligence confidence levels.
Knowledge of intelligence disciplines.
Knowledge of intelligence employment requirements (i.e., logistical, communications
support, maneuverability, legal restrictions, etc.).
Knowledge of intelligence preparation of the environment and similar processes.
Knowledge of intelligence production processes.
Knowledge of intelligence reporting principles, policies, procedures, and vehicles, including
report formats, reportability criteria (requirements and priorities), dissemination practices,and legal authorities and restrictions.
Knowledge of intelligence requirements tasking systems.
Knowledge of intelligence support to planning, execution, and assessment.
Knowledge of internal and external partner cyber operations capabilities and tools.
Knowledge of internal and external partner intelligence processes and the development of
information requirements and essential information.
Knowledge of internal and external partner organization capabilities and limitations (thosewith tasking, collection, processing, exploitation and dissemination responsibilities).
Knowledge of internal and external partner reporting.
Knowledge of internal tactics to anticipate and/or emulate threat capabilities and actions.

71

NIST SP 800-181

KSA ID
K0470

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0471
K0472
K0473
K0474
K0475
K0476
K0477
K0478
K0479
K0480
K0481
K0482
K0483
K0484
K0485
K0486
K0487
K0488
K0489
K0490

K0491
K0492
K0493
K0494
K0495
K0496
K0497
K0498
K0499
K0500
K0501
K0502
K0503
K0504
K0505
K0506
K0507

NICE FRAMEWORKDescription
Knowledge of Internet and routing protocols.
Knowledge of Internet network addressing (IP addresses, classless inter-domain routing,
TCP/UDP port numbering).
Knowledge of intrusion detection systems and signature development.
Knowledge of intrusion sets.
Knowledge of key cyber threat actors and their equities.
Knowledge of key factors of the operational environment and threat.
Knowledge of language processing tools and techniques.
Knowledge of leadership's Intent and objectives.
Knowledge of legal considerations in targeting.
Knowledge of malware analysis and characteristics.
Knowledge of malware.
Knowledge of methods and techniques used to detect various exploitation activities.
Knowledge of methods for ascertaining collection asset posture and availability.
Knowledge of methods to integrate and summarize information from any potential sources.
Knowledge of midpoint collection (process, objectives, organization, targets, etc.).
Knowledge of network administration.
Knowledge of network construction and topology.
Knowledge of network security (e.g., encryption, firewalls, authentication, honey pots,
perimeter protection).
Knowledge of network security implementations (e.g., host-based IDS, IPS, access control
lists), including their function and placement in a network.
Knowledge of network topology.
Withdrawn – Integrated into K0058
Knowledge of networking and Internet communications fundamentals (i.e. devices, device
configuration, hardware, software, applications, ports/protocols, addressing, networkarchitecture and infrastructure, routing, operating systems, etc.).
Knowledge of non-traditional collection methodologies.
Knowledge of obfuscation techniques (e.g., TOR/Onion/anonymizers, VPN/VPS,
encryption).
Knowledge of objectives, situation, operational environment, and the status and dispositionof internal and external partner collection capabilities available to support planning.
Knowledge of ongoing and future operations.
Knowledge of operational asset constraints.
Knowledge of operational effectiveness assessment.
Knowledge of operational planning processes.
Knowledge of operations security.
Knowledge of organization and/or partner collection systems, capabilities, and processes(e.g., collection and protocol processors).
Knowledge of organization cyber operations programs, strategies, and resources.
Knowledge of organization decision support tools and/or methods.
Knowledge of organization formats of resource and asset readiness reporting, its operational
relevance and intelligence collection impact.
Knowledge of organization issues, objectives, and operations in cyber as well as regulations
and policy directives governing cyber operations.
Knowledge of organization objectives and associated demand on collection management.
Knowledge of organization objectives, leadership priorities, and decision-making risks.
Knowledge of organization or partner exploitation of digital networks.

72

NIST SP 800-181

KSA ID
K0508
K0509
K0510
K0511
K0512
K0513
K0514
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0516
K0517
K0518
K0519
K0520
K0521
K0522

K0523
K0524
K0525
K0526
K0527
K0528
K0529
K0530
K0531
K0532
K0533
K0534
K0535

K0536
K0538
K0539
K0540
K0541
K0542

NICE FRAMEWORKDescription
Knowledge of organization policies and planning concepts for partnering with internal
and/or external organizations.
Knowledge of organizational and partner authorities, responsibilities, and contributions toachieving objectives.
Knowledge of organizational and partner policies, tools, capabilities, and procedures.
Knowledge of organizational hierarchy and cyber decision-making processes.
Knowledge of organizational planning concepts.
Knowledge of organizational priorities, legal authorities and requirements submission
processes.
Knowledge of organizational structures and associated intelligence capabilities.
Knowledge of physical and logical network devices and infrastructure to include hubs,
switches, routers, firewalls, etc.
Knowledge of post implementation review (PIR) approval process.
Knowledge of planning activity initiation.
Knowledge of planning timelines adaptive, crisis action, and time-sensitive planning.
Knowledge of principles and practices related to target development such as target
knowledge, associations, communication systems, and infrastructure.
Knowledge of priority information, how it is derived, where it is published, how to access,etc.
Knowledge of production exploitation and dissemination needs and architectures.
Knowledge of products and nomenclature of major vendors (e.g., security suites - Trend
Micro, Symantec, McAfee, Outpost, and Panda) and how those products affect exploitation
and reduce vulnerabilities.
Knowledge of relevant laws, regulations, and policies.
Knowledge of required intelligence planning products associated with cyber operational
planning.
Knowledge of research strategies and knowledge management.
Knowledge of risk management and mitigation strategies.
Knowledge of satellite-based communication systems.
Knowledge of scripting
Knowledge of security hardware and software options, including the network artifacts they
induce and their effects on exploitation.
Knowledge of security implications of software configurations.
Knowledge of specialized target language (e.g., acronyms, jargon, technical terminology,
code words).
Knowledge of specific target identifiers, and their usage.
Knowledge of staff management, assignment, and allocation processes.
Knowledge of strategies and tools for target research.
Knowledge of structure, approach, and strategy of exploitation tools (e.g., sniffers,
keyloggers) and techniques (e.g., gaining backdoor access, collecting/exfiltrating data,
conducting vulnerability analysis of other systems in the network).
Knowledge of target and threat organization structures, critical capabilities, and criticalvulnerabilities
Knowledge of target communication profiles and their key elements (e.g., target
associations, activities, communication infrastructure).
Knowledge of target communication tools and techniques.
Knowledge of target cultural references, dialects, expressions, idioms, and abbreviations.
Knowledge of target development (i.e., concepts, roles, responsibilities, products, etc.).

73

NIST SP 800-181

KSA ID
K0543
K0544
K0545
K0546
K0547
K0548
K0549

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0550
K0551
K0552
K0553
K0554
K0555
K0556
K0557
K0558
K0559
K0560
K0561
K0562
K0563
K0564
K0565
K0566
K0567
K0568
K0569
K0570
K0571
K0572
K0573
K0574
K0575
K0576
K0577

NICE FRAMEWORKDescription
Knowledge of target estimated repair and recuperation times.
Knowledge of target intelligence gathering and operational preparation techniques and life
cycles.
Knowledge of target language(s).
Knowledge of target list development (i.e. Restricted, Joint, Candidate, etc.).
Knowledge of target methods and procedures.
Knowledge of target or threat cyber actors and procedures.
Knowledge of target vetting and validation procedures.
Knowledge of target, including related current events, communication profile, actors, andhistory (language, culture) and/or frame of reference.
Knowledge of targeting cycles.
Knowledge of tasking mechanisms.
Knowledge of tasking processes for organic and subordinate collection assets.
Knowledge of tasking, collection, processing, exploitation and dissemination.
Knowledge of TCP/IP networking protocols.
Knowledge of telecommunications fundamentals.
Knowledge of terminal or environmental collection (process, objectives, organization,
targets, etc.).
Knowledge of the available tools and applications associated with collection requirements
and collection management.
Knowledge of the basic structure, architecture, and design of converged applications.
Knowledge of the basic structure, architecture, and design of modern communication
networks.
Knowledge of the basics of network security (e.g., encryption, firewalls, authentication,
honey pots, perimeter protection).
Knowledge of the capabilities and limitations of new and emerging collection capabilities,
accesses and/or processes.
Knowledge of the capabilities, limitations and tasking methodologies of internal andexternal collections as they apply to planned cyber activities.
Knowledge of the characteristics of targeted communication networks (e.g., capacity,
functionality, paths, critical nodes).
Knowledge of the common networking and routing protocols (e.g. TCP/IP), services (e.g.,web, mail, DNS), and how they interact to provide network communications.
Knowledge of the critical information requirements and how they're used in planning.
Knowledge of the data flow from collection origin to repositories and tools.
Knowledge of the definition of collection management and collection management
authority.
Knowledge of the existent tasking, collection, processing, exploitation and disseminationarchitecture.
Knowledge of the factors of threat that could impact collection operations.
Knowledge of the feedback cycle in collection processes.
Knowledge of the functions and capabilities of internal teams that emulate threat activities
to benefit the organization.
Knowledge of the fundamentals of digital forensics to extract actionable intelligence.
Knowledge of the impact of language analysis on on-net operator functions.
Knowledge of the impacts of internal and external partner staffing estimates.
Knowledge of the information environment.
Knowledge of the intelligence frameworks, processes, and related systems.

74

NIST SP 800-181

KSA ID
K0578
K0579
K0580
K0581
K0582
K0583
K0584
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0585
K0586
K0587
K0588
K0589
K0590
K0591
K0592
K0593
K0594
K0595
K0596
K0597
K0598
K0599
K0600
K0601
K0602
K0603
K0604
K0605
K0606
K0607

NICE FRAMEWORKDescription
Knowledge of the intelligence requirements development and request for information
processes.
Knowledge of the organization, roles and responsibilities of higher, lower and adjacent subelements.
Knowledge of the organization’s established format for collection plan.
Knowledge of the organization’s planning, operations and targeting cycles.
Knowledge of the organizational planning and staffing process.
Knowledge of the organizational plans/directives/guidance that describe objectives.
Knowledge of the organizational policies/procedures for temporary transfer of collection
authority.
Knowledge of the organizational structure as it pertains to full spectrum cyber operations,
including the functions, responsibilities, and interrelationships among distinct internal
elements.
Knowledge of the outputs of course of action and exercise analysis.
Knowledge of the POC’s, databases, tools and applications necessary to establish
environment preparation and surveillance products.
Knowledge of the priority information requirements from subordinate, lateral and higher
levels of the organization.
Knowledge of the process used to assess the performance and impact of operations.
Knowledge of the processes to synchronize operational assessment procedures with thecritical information requirement process.
Knowledge of the production responsibilities and organic analysis and production
capabilities.
Knowledge of the purpose and contribution of target templates.
Knowledge of the range of cyber operations and their underlying intelligence support needs,
topics, and focus areas.
Knowledge of the relationships between end states, objectives, effects, lines of operation,etc.
Knowledge of the relationships of operational objectives, intelligence requirements, andintelligence production tasks.
Knowledge of the request for information process.
Knowledge of the role of network operations in supporting and facilitating otherorganization operations.
Knowledge of the structure and intent of organization specific plans, guidance andauthorizations.
Knowledge of the structure, architecture, and design of modern digital and telephony
networks.
Knowledge of the structure, architecture, and design of modern wireless communications
systems.
Knowledge of the systems/architecture/communications used for coordination.
Knowledge of collection disciplines and capabilities.
Knowledge of the ways in which targets or threats use the Internet.
Knowledge of threat and/or target systems.
Knowledge of tipping, cueing, mixing, and redundancy.
Knowledge of transcript development processes and techniques (e.g., verbatim, gist,
summaries).
Knowledge of translation processes and techniques.

75

NIST SP 800-181

KSA ID
K0608
K0609
K0610
K0611
K0612
K0613

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

K0614
K0615
K0616
K0617

K0618

K0619
K0620
K0621
K0622
K0623
K0624
K0625
K0626
K0627
K0628
K0629
K0630

NICE FRAMEWORKDescription
Knowledge of Unix/Linux and Windows operating systems structures and internals (e.g.,
process management, directory structure, installed applications).
Knowledge of virtual machine technologies.
Knowledge of virtualization products (VMware, Virtual PC).
Withdrawn – Integrated into K0131
Knowledge of what constitutes a “threat” to a network.
Knowledge of who the organization’s operational planners are, how and where they can becontacted, and what are their expectations.
Knowledge of wireless technologies (e.g., cellular, satellite, GSM) to include the basic
structure, architecture, and design of modern wireless communications systems.
Knowledge of privacy disclosure statements based on current laws.
Knowledge of continuous monitoring, its processes, and Continuous Diagnostics and
Mitigation (CDM) program activities.
Knowledge of Automated security control assessments
Knowledge of hardware asset management and the value of tracking the location andconfiguration of networked devices and software across departments, locations, facilities
and, potentially, supporting business functions.
Knowledge of software asset management and the value of tracking the location andconfiguration of networked devices and software across departments, locations, facilities
and, potentially, supporting business functions.
Knowledge of continuous monitoring technologies and tools.
Knowledge of risk scoring.
Knowledge of controls related to the use, processing, storage, and transmission of data.
Knowledge of risk assessment methodologies.
Knowledge of Application Security Risks (e.g. Open Web Application Security Project Top
10 list)Knowledge that patching and software updates are impractical for some networked devices.
Knowledge of secure update mechanisms.
Knowledge of the importance of ingress filtering to protect against automated threats that
rely on spoofed network addresses.
Knowledge of cyber competitions as a way of developing skills by providing hands-on
experience in simulated, real-world situations.
Knowledge of white/black listing
Knowledge of the latest intrusion techniques, methods and documented intrusions external
to the organization.

76

NIST SP 800-181

A.6

NICE FRAMEWORKNICE Framework Skills Descriptions

Table 6 provides a listing of cybersecurity skills. A skill is the observable competence toperform a learned psychomotor act. Selected skills descriptions from this list are included foreach work role in the Detailed work role Listing in Appendix B. This listing will be updated
periodically [1]. The definitive source for the most current version of this material can be foundin the Reference Spreadsheet for NIST Special Publication 800-181 [4].
Table 6 - NICE Framework Skills Descriptions

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Skill ID
S0001
S0002
S0003
S0004
S0005
S0006
S0007
S0008
S0009
S0010
S0011
S0012
S0013
S0014
S0015
S0016
S0017
S0018
S0019
S0020
S0021
S0022
S0023
S0024
S0025
S0026

S0027
S0028
S0029
S0030
S0031
S0032

Description
Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.
Skill in allocating storage capacity in the design of data management systems.
Skill of identifying, capturing, containing, and reporting malware.
Skill in analyzing network traffic capacity and performance characteristics.
Skill in applying and incorporating information technologies into proposed solutions.
Skill in applying confidentiality, integrity, and availability principles.
Skill in applying host/network access controls (e.g., access control list).
Skill in applying organization-specific systems analysis principles and techniques.
Skill in assessing the robustness of security systems and designs.
Skill in conducting capabilities and requirements analysis.
Skill in conducting information searches.
Skill in conducting knowledge mapping (e.g., map of knowledge repositories).
Skill in conducting queries and developing algorithms to analyze data structures.
Skill in conducting software debugging.
Skill in conducting test events.
Skill in configuring and optimizing software.
Skill in creating and utilizing mathematical or statistical models.
Skill in creating policies that reflect system security objectives.
Skill in creating programs that validate and process multiple inputs including commandline arguments, environmental variables, and input streams.
Skill in developing and deploying signatures.
Skill in designing a data analysis structure (i.e., the types of data a test must generate andhow to analyze that data).
Skill in designing countermeasures to identified security risks.
Skill in designing security controls based on cybersecurity principles and tenets.
Skill in designing the integration of hardware and software solutions.
Skill in detecting host and network based intrusions via intrusion detection technologies(e.g., Snort).
Skill in determining an appropriate level of test rigor for a given system.
Skill in determining how a security system should work (including its resilience anddependability capabilities) and how changes in conditions, operations, or the environment
will affect these outcomes.
Skill in developing data dictionaries.
Skill in developing data models.
Skill in developing operations-based testing scenarios.
Skill in developing and applying security system access controls.
Skill in developing, testing, and implementing network infrastructure contingency andrecovery plans.

77

NIST SP 800-181

Skill ID
S0033
S0034
S0035
S0036
S0037
S0038

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0039
S0040
S0041
S0042
S0043
S0044
S0045
S0046
S0047
S0048
S0049
S0050
S0051
S0052
S0053
S0054
S0055
S0056
S0057
S0058
S0059
S0060
S0061
S0062
S0063
S0064
S0065
S0066
S0067
S0068
S0069

NICE FRAMEWORKDescription
Skill in diagnosing connectivity problems.
Skill in discerning the protection needs (i.e., security controls) of information systems andnetworks.
Skill in establishing a routing schema.
Skill in evaluating the adequacy of security designs.
Skill in generating queries and reports.
Skill in identifying measures or indicators of system performance and the actions needed to
improve or correct performance, relative to the goals of the system.
Skill in identifying possible causes of degradation of system performance or availability
and initiating actions needed to mitigate this degradation.
Skill in implementing, maintaining, and improving established network security practices.
Skill in installing, configuring, and troubleshooting LAN and WAN components such asrouters, hubs, and switches.
Skill in maintaining databases. (i.e., backup, restore, delete data, transaction log files, etc.).
Skill in maintaining directory services. (e.g., Microsoft Active Directory, LDAP, etc.).
Skill in mimicking threat behaviors.
Skill in optimizing database performance.
Skill in performing packet-level analysis using appropriate tools (e.g., Wireshark,
tcpdump).
Skill in preserving evidence integrity according to standard operating procedures or
national standards.
Skill in systems integration testing.
Skill in the measuring and reporting of intellectual capital.
Skill in design modeling and building use cases (e.g., unified modeling language).
Skill in the use of penetration testing tools and techniques.
Skill in the use of social engineering techniques. (e.g., phishing, baiting, tailgating, etc.).
Skill in tuning sensors.
Skill in using incident handling methodologies.
Skill in using knowledge management technologies.
Skill in using network management tools to analyze network traffic patterns (e.g., simple
network management protocol).
Skill in using protocol analyzers.
Skill in using the appropriate tools for repairing software, hardware, and peripheral
equipment of a system.
Skill in using Virtual Private Network (VPN) devices and encryption.
Skill in writing code in a currently supported programming language (e.g., Java, C++).
Skill in writing test plans.
Skill in analyzing memory dumps to extract information.
Skill in collecting data from a variety of cyber defense resources.
Skill in developing and executing technical training programs and curricula.
Skill in identifying and extracting data of forensic interest in diverse media (i.e., media
forensics).
Skill in identifying gaps in technical capabilities.
Skill in identifying, modifying, and manipulating applicable system components within
Windows, Unix, or Linux (e.g., passwords, user accounts, files).
Skill in collecting, processing, packaging, transporting, and storing electronic evidence to
avoid alteration, loss, physical damage, or destruction of data.
Skill in setting up a forensic workstation.

78

NIST SP 800-181

Skill ID
S0070
S0071
S0072
S0073
S0074
S0075

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0076
S0077
S0078
S0079
S0080
S0081
S0082
S0083
S0084
S0085
S0086
S0087
S0088
S0089
S0090
S0091
S0092
S0093
S0094

S0095
S0096
S0097
S0100
S0101
S0102
S0103
S0104
S0106
S0107
S0108

NICE FRAMEWORKDescription
Skill in talking to others to convey information effectively.
Skill in using forensic tool suites (e.g., EnCase, Sleuthkit, FTK).
Skill in using scientific rules and methods to solve problems.
Skill in using virtual machines. (e.g., Microsoft Hyper-V, VMWare vSphere, Citrix
XenDesktop/Server, Amazon Elastic Compute Cloud, etc.).
Skill in physically disassembling PCs.
Skill in conducting forensic analyses in multiple operating system environments (e.g.,mobile device systems).
Skill in configuring and utilizing software-based computer protection tools (e.g., software
firewalls, antivirus software, anti-spyware).
Skill in securing network communications.
Skill in recognizing and categorizing types of vulnerabilities and associated attacks.
Skill in protecting a network against malware. (e.g., NIPS, anti-malware, restrict/prevent
external devices, spam filters).
Skill in performing damage assessments.
Skill in using network analysis tools to identify vulnerabilities. (e.g., fuzzing, nmap, etc.).
Skill in evaluating test plans for applicability and completeness.
Skill in integrating black box security testing tools into quality assurance process ofsoftware releases.
Skill in configuring and utilizing network protection components (e.g., Firewalls, VPNs,
network intrusion detection systems).
Skill in conducting audits or reviews of technical systems.
Skill in evaluating the trustworthiness of the supplier and/or product.
Skill in deep analysis of captured malicious code (e.g., malware forensics).
Skill in using binary analysis tools (e.g., Hexedit, command code xxd, hexdump).
Skill in one-way hash functions (e.g., Secure Hash Algorithm [SHA], Message Digest
Algorithm [MD5]).
Skill in analyzing anomalous code as malicious or benign.
Skill in analyzing volatile data.
Skill in identifying obfuscation techniques.
Skill in interpreting results of debugger to ascertain tactics, techniques, and procedures.
Skill in reading Hexadecimal data.
Skill in identifying common encoding techniques (e.g., Exclusive Disjunction [XOR],
American Standard Code for Information Interchange [ASCII], Unicode, Base64,
Uuencode, Uniform Resource Locator [URL] encode).
Skill in reading and interpreting signatures (e.g., snort).
Skill in applying security controls.
Skill in utilizing or developing learning activities (e.g., scenarios, instructional games,
interactive exercises).
Skill in utilizing technologies (e.g., SmartBoards, websites, computers, projectors) for
instructional purposes.
Skill in applying technical delivery capabilities.
Skill in assessing the predictive power and subsequent generalizability of a model.
Skill in conducting Test Readiness Reviews.
Skill in data pre-processing (e.g., imputation, dimensionality reduction, normalization,transformation, extraction, filtering, smoothing).
Skill in designing and documenting overall program Test & Evaluation strategies.
Skill in developing workforce and position qualification standards.

79

NIST SP 800-181

Skill ID
S0109
S0110
S0111

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0112
S0113
S0114
S0115
S0116
S0117
S0118
S0119
S0120
S0121
S0122
S0123
S0124
S0125
S0126
S0127
S0128
S0129
S0130
S0131
S0132
S0133
S0134
S0135
S0136
S0137
S0138
S0139
S0140
S0141
S0142
S0143
S0144
S0145

NICE FRAMEWORKDescription
Skill in identifying hidden patterns or relationships.
Skill in identifying Test & Evaluation infrastructure (people, ranges, tools,
instrumentation) requirements.
Skill in interfacing with customers.
Skill in managing test assets, test resources, and test personnel to ensure effective
completion of test events.
Skill in performing format conversions to create a standard representation of the data.
Skill in performing sensitivity analysis.
Skill in preparing Test & Evaluation reports.
Skill in designing multi-level security/cross domain solutions.
Skill in providing Test & Evaluation resource estimate.
Skill in developing machine understandable semantic ontologies.
Skill in Regression Analysis (e.g., Hierarchical Stepwise, Generalized Linear Model,
Ordinary Least Squares, Tree-Based Methods, Logistic).
Skill in reviewing logs to identify evidence of past intrusions.
Skill in system, network, and OS hardening techniques. (e.g., remove unnecessary services,password policies, network segmentation, enable logging, least privilege, etc.).
Skill in the use of design methods.
Skill in transformation analytics (e.g., aggregation, enrichment, processing).
Skill in troubleshooting and diagnosing cyber defense infrastructure anomalies and workthrough resolution.
Skill in using basic descriptive statistics and techniques (e.g., normality, model
distribution, scatter plots).
Skill in using data analysis tools (e.g., Excel, STATA SAS, SPSS).
Skill in using data mapping tools.
Skill in using manpower and personnel IT systems.
Skill in using outlier identification and removal techniques.
Skill in writing scripts using R, Python, PIG, HIVE, SQL, etc.
Skill in analyzing malware.
Skill in conducting bit-level analysis.
Skill in processing digital evidence, to include protecting and making legally sound copies
of evidence.
Skill in conducting reviews of systems.
Skill in secure test plan design (e. g. unit, integration, system, acceptance).
Skill in network systems management principles, models, methods (e.g., end-to-end
systems performance monitoring), and tools.
Skill in conducting application vulnerability assessments.
Skill in using Public-Key Infrastructure (PKI) encryption and digital signature capabilities
into applications (e.g., S/MIME email, SSL traffic).
Skill in applying security models (e.g., Bell-LaPadula model, Biba integrity model, ClarkWilson integrity model).
Skill in applying the systems engineering process.
Skill in assessing security systems designs.
Skill in conducting research for troubleshooting novel client-level problems.
Skill in conducting system/server planning, management, and maintenance.
Skill in correcting physical and technical problems that impact system/server performance.
Skill in integrating and applying policies that meet system security objectives.

80

NIST SP 800-181

Skill ID
S0146
S0147
S0148

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0149
S0150
S0151
S0152
S0153
S0154
S0155
S0156
S0157
S0158
S0159
S0160
S0161
S0162
S0163
S0164
S0166
S0167
S0168
S0169
S0170
S0171
S0172
S0173
S0174
S0175
S0176
S0177
S0178
S0179
S0180

NICE FRAMEWORKDescription
Skill in creating policies that enable systems to meet performance objectives (e.g. trafficrouting, SLA's, CPU specifications).
Skill in assessing security controls based on cybersecurity principles and tenets. (e.g., CIS
CSC, NIST SP 800-53, Cybersecurity Framework, etc.).
Skill in designing the integration of technology processes and solutions, including legacy
systems and modern programming languages.
Skill in developing applications that can log and handle errors, exceptions, and application
faults and logging.
Skill in implementing and testing network infrastructure contingency and recovery plans.
Skill in troubleshooting failed system components (i.e., servers)
Skill in translating operational requirements into protection needs (i.e., security controls).
Skill in identifying and anticipating system/server performance, availability, capacity, or
configuration problems.
Skill in installing system and component upgrades. (i.e., servers, appliances, network
devices).
Skill in monitoring and optimizing system/server performance.
Skill in performing packet-level analysis.
Skill in recovering failed systems/servers. (e.g., recovery software, failover clusters,
replication, etc.).
Skill in operating system administration. (e.g., account maintenance, data backups,
maintain system performance, install and configure new hardware/software).
Skill in configuring and validating network workstations and peripherals in accordancewith approved standards and/or specifications.
Skill in the use of design modeling (e.g., unified modeling language).
Withdrawn – Integrated into S0160
Skill in sub-netting.
Withdrawn – Integrated into S0060
Skill in assessing the application of cryptographic standards.
Skill in identifying gaps in technical delivery capabilities.
Skill in recognizing vulnerabilities in security systems. (e.g., vulnerability and compliancescanning).
Skill in setting up physical or logical sub-networks that separate an internal local area
network (LAN) from other untrusted networks.
Skill in conducting trend analysis.
Skill in configuring and utilizing computer protection components (e.g., hardware
firewalls, servers, routers, as appropriate).
Skill in performing impact/risk assessments.
Skill in applying secure coding techniques.
Skill in using security event correlation tools.
Skill in using code analysis tools.
Skill in performing root cause analysis.
Skill in administrative planning activities, to include preparation of functional and specificsupport plans, preparing and managing correspondence, and staffing procedures.
Skill in analyzing a target's communication networks.
Skill in analyzing essential network data (e.g., router configuration files, routing protocols).
Skill in analyzing language processing tools to provide feedback to enhance tool
development.
Withdrawn – Integrated into S0062

81

NIST SP 800-181

Skill ID
S0181
S0182
S0183
S0184
S0185
S0186

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0187
S0188
S0189
S0190
S0191
S0192
S0193
S0194
S0195
S0196
S0197
S0198
S0199
S0200
S0201
S0202
S0203
S0204
S0205
S0206
S0207
S0208
S0209
S0210
S0211
S0212
S0213
S0214
S0215

NICE FRAMEWORKDescription
Skill in analyzing midpoint collection data.
Skill in analyzing target communications internals and externals collected from wireless
LANs.
Skill in analyzing terminal or environment collection data.
Skill in analyzing traffic to identify network devices.
Skill in applying analytical methods typically employed to support planning and to justify
recommended strategies and courses of action.
Skill in applying crisis planning procedures.
Skill in applying various analytical methods, tools, and techniques (e.g., competing
hypotheses; chain of reasoning; scenario methods; denial and deception detection; highimpact-low probability; network/association or link analysis; Bayesian, Delphi, and Patternanalyses).
Skill in assessing a target's frame of reference (e.g., motivation, technical capability,
organizational structure, sensitivities).
Skill in assessing and/or estimating effects generated during and after cyber operations.
Skill in assessing current tools to identify needed improvements.
Skill in assessing the applicability of available analytical tools to various situations.
Skill in auditing firewalls, perimeters, routers, and intrusion detection systems.
Skill in complying with the legal restrictions for targeted information.
Skill in conducting non-attributable research.
Skill in conducting research using all available sources.
Skill in conducting research using deep web.
Skill in conducting social network analysis, buddy list analysis, and/or cookie analysis.
Skill in conducting social network analysis.
Skill in creating and extracting important information from packet captures.
Skill in creating collection requirements in support of data acquisition activities.
Skill in creating plans in support of remote operations. (i.e., hot/warm/cold/alternative
sites, disaster recovery).
Skill in data mining techniques (e.g., searching file systems) and analysis.
Skill in defining and characterizing all pertinent aspects of the operational environment.
Skill in depicting source or collateral data on a network map.
Skill in determining appropriate targeting options through the evaluation of available
capabilities against desired effects.
Skill in determining installed patches on various operating systems and identifying patch
signatures.
Skill in determining the effect of various router and firewall configurations on traffic
patterns and network performance in both LAN and WAN environments.
Skill in determining the physical location of network devices.
Skill in developing and executing comprehensive cyber operations assessment programs
for assessing and validating operational performance characteristics.
Skill in developing intelligence reports.
Skill in developing or recommending analytic approaches or solutions to problems andsituations for which information is incomplete or for which no precedent exists.
Skill in disseminating items of highest intelligence value in a timely manner.
Skill in documenting and communicating complex technical and programmatic
information.
Skill in evaluating accesses for intelligence value.
Skill in evaluating and interpreting metadata.

82

NIST SP 800-181

Skill ID

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0216
S0217
S0218
S0219
S0220
S0221
S0222
S0223
S0224
S0225
S0226
S0227
S0228
S0229
S0230
S0231
S0232
S0233
S0234
S0235
S0236
S0237
S0238
S0239
S0240
S0241
S0242
S0243
S0244
S0245
S0246
S0247
S0248
S0249
S0250
S0251
S0252
S0253
S0254

NICE FRAMEWORKDescription
Skill in evaluating available capabilities against desired effects to provide effective coursesof action.
Skill in evaluating data sources for relevance, reliability, and objectivity.
Skill in evaluating information for reliability, validity, and relevance.
Skill in evaluating information to recognize relevance, priority, etc.
Skill in exploiting/querying organizational and/or partner collection databases.
Skill in extracting information from packet captures.
Skill in fusion analysis
Skill in generating operation plans in support of mission and target requirements.
Skill in gisting target communications.
Skill in identifying a target’s communications networks.
Skill in identifying a target's network characteristics.
Skill in identifying alternative analytical interpretations to minimize unanticipatedoutcomes.
Skill in identifying critical target elements, to include critical target elements for the cyberdomain.
Skill in identifying cyber threats which may jeopardize organization and/or partnerinterests.
Withdrawn – Integrated into S0066
Skill in identifying how a target communicates.
Skill in identifying intelligence gaps and limitations.
Skill in identifying language issues that may have an impact on organization objectives.
Skill in identifying leads for target development.
Skill in identifying non-target regional languages and dialects
Skill in identifying the devices that work at each level of protocol models.
Skill in identifying, locating, and tracking targets via geospatial analysis techniques
Skill in information prioritization as it relates to operations.
Skill in interpreting compiled and interpretive programming languages.
Skill in interpreting metadata and content as applied by collection systems.
Skill in interpreting traceroute results, as they apply to network analysis and reconstruction.
Skill in interpreting vulnerability scanner results to identify vulnerabilities.
Skill in knowledge management, including technical documentation techniques (e.g., Wikipage).
Skill in managing client relationships, including determining client needs/requirements,
managing client expectations, and demonstrating commitment to delivering quality results.
Skill in navigating network visualization software.
Skill in number normalization.
Skill in performing data fusion from existing intelligence for enabling new and continued
collection.
Skill in performing target system analysis.
Skill in preparing and presenting briefings.
Skill in preparing plans and related correspondence.
Skill in prioritizing target language material.
Skill in processing collected data for follow-on analysis.
Skill in providing analysis on target-related matters (e.g., language, cultural,communications).
Skill in providing analysis to aid writing phased after action reports.

83

NIST SP 800-181

Skill ID
S0255
S0256

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0257
S0258
S0259
S0260
S0261
S0262
S0263

S0264
S0265
S0266
S0267
S0268
S0269
S0270
S0271
S0272
S0273
S0274
S0275
S0276
S0277
S0278
S0279
S0280
S0281
S0282
S0283
S0284
S0285
S0286
S0287
S0288
S0289
S0290

NICE FRAMEWORKDescription
Skill in providing real-time, actionable geolocation information utilizing target
infrastructures.
Skill in providing understanding of target or threat systems through the identification andlink analysis of physical, functional, or behavioral relationships.
Skill in reading, interpreting, writing, modifying, and executing simple scripts (e.g., PERL,
VBS) on Windows and Unix systems (e.g., those that perform tasks like parsing large data
files, automating manual tasks, and fetching/processing remote data).
Skill in recognizing and interpreting malicious network activity in traffic.
Skill in recognizing denial and deception techniques of the target.
Skill in recognizing midpoint opportunities and essential information.
Skill in recognizing relevance of information.
Skill in recognizing significant changes in a target’s communication patterns.
Skill in recognizing technical information that may be used for leads for metadata analysis.
Skill in recognizing technical information that may be used for leads to enable remote
operations (data includes users, passwords, email addresses, IP ranges of the target,
frequency in DNI behavior, mail servers, domain servers, SMTP header information).
Skill in recognizing technical information that may be used for target development
including intelligence development.
Skill in relevant programming languages (e.g., C++, Python, etc.).
Skill in remote command line and Graphic User Interface (GUI) tool usage.
Skill in researching essential information.
Skill in researching vulnerabilities and exploits utilized in traffic.
Skill in reverse engineering (e.g., hex editing, binary packaging utilities, debugging, andstrings analysis) to identify function and ownership of remote tools.
Skill in reviewing and editing assessment products.
Skill in reviewing and editing intelligence products from various sources for cyber
operations.
Skill in reviewing and editing plans.
Skill in reviewing and editing target materials.
Skill in server administration.
Skill in survey, collection, and analysis of wireless LAN metadata.
Skill in synthesizing, analyzing, and prioritizing meaning across data sets.
Skill in tailoring analysis to the necessary levels (e.g., classification and organizational).
Skill in target development in direct support of collection operations.
Skill in target network anomaly identification (e.g., intrusions, dataflow or processing,target implementation of new technologies).
Skill in technical writing.
Skill in testing and evaluating tools for implementation.
Skill in transcribing target language communications.
Skill in translating target graphic and/or voice language materials.
Skill in using Boolean operators to construct simple and complex queries.
Skill in using databases to identify target-relevant information.
Skill in using geospatial data and applying geospatial resources.
Skill in using multiple analytic tools, databases, and techniques (e.g., Analyst’s Notebook,
A-Space, Anchory, M3, divergent/convergent thinking, link charts, matrices, etc.).
Skill in using multiple search engines (e.g., Google, Yahoo, LexisNexis, DataStar) andtools in conducting open-source searches.
Skill in using non-attributable networks.

84

NIST SP 800-181

Skill ID
S0291
S0292
S0293
S0294
S0295
S0296
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0297
S0298
S0299
S0300
S0301
S0302
S0303
S0304
S0305
S0306
S0307
S0308
S0309
S0310
S0311
S0312
S0313
S0314
S0315
S0316
S0317
S0318
S0319
S0320
S0321
S0322
S0323
S0324
S0325

NICE FRAMEWORKDescription
Skill in using research methods including multiple, different sources to reconstruct a target
network.
Skill in using targeting databases and software packages.
Skill in using tools, techniques, and procedures to remotely exploit and establish
persistence on a target.
Skill in using trace route tools and interpreting the results as they apply to network analysis
and reconstruction.
Skill in using various open source data collection tools (online trade, DNS, mail, etc.).
Skill in utilizing feedback to improve processes, products, and services.
Skill in utilizing virtual collaborative workspaces and/or tools (e.g., IWS, VTCs, chatrooms, SharePoint).
Skill in verifying the integrity of all files. (e.g., checksums, Exclusive OR, secure hashes,check constraints, etc.).
Skill in wireless network target analysis, templating, and geolocation.
Skill in writing (and submitting) requirements to meet gaps in technical capabilities.
Skill in writing about facts and ideas in a clear, convincing, and organized manner.
Skill in writing effectiveness reports.
Skill in writing, reviewing and editing cyber-related Intelligence/assessment products frommultiple sources.
Skill to access information on current assets available, usage.
Skill to access the databases where plans/directives/guidance are maintained.
Skill to analyze strategic guidance for issues requiring clarification and/or additional
guidance.
Skill to analyze target or threat sources of strength and morale.
Skill to anticipate intelligence capability employment requirements.
Skill to anticipate key target or threat activities which are likely to prompt a leadershipdecision.
Skill to apply analytical standards to evaluate intelligence products.
Skill to apply the capabilities, limitations and tasking methodologies of available
platforms, sensors, architectures and apparatus as they apply to organization objectives.
Skill to apply the process used to assess the performance and impact of cyber operations.
Skill to articulate a needs statement/requirement and integrate new and emerging collection
capabilities, accesses and/or processes into collection operations.
Skill to articulate intelligence capabilities available to support execution of the plan.
Skill to articulate the needs of joint planners to all-source analysts.
Skill to associate Intelligence gaps to priority information requirements and observables.
Skill to compare indicators/observables with requirements.
Skill to conceptualize the entirety of the intelligence process in the multiple domains anddimensions.
Skill to convert intelligence requirements into intelligence production tasks.
Skill to coordinate the development of tailored intelligence products.
Skill to correlate intelligence priorities to the allocation of intelligence resources/assets.
Skill to craft indicators of operational progress/success.
Skill to create and maintain up-to-date planning documents and tracking ofservices/production.
Skill to determine feasibility of collection.
Skill to develop a collection plan that clearly shows the discipline that can be used tocollect the information needed.

85

NIST SP 800-181

Skill ID
S0326
S0327
S0328
S0329
S0330
S0331
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0332
S0333
S0334
S0335
S0336
S0337
S0338
S0339
S0340
S0341
S0342
S0343
S0344
S0345
S0346
S0347
S0348
S0349
S0350
S0351
S0352
S0353
S0354
S0355

NICE FRAMEWORKDescription
Skill to distinguish between notional and actual resources and their applicability to the planunder development.
Skill to ensure that the collection strategy leverages all available resources.
Skill to evaluate factors of the operational environment to objectives, and information
requirements.
Skill to evaluate requests for information to determine if response information exists.
Skill to evaluate the capabilities, limitations and tasking methodologies of organic, theater,
national, coalition and other collection capabilities.
Skill to express orally and in writing the relationship between intelligence capability
limitations and decision-making risk and impacts on the overall operation.
Skill to extract information from available tools and applications associated with collection
requirements and collection operations management.
Skill to graphically depict decision support materials containing intelligence and partner
capability estimates.
Skill to identify and apply tasking, collection, processing, exploitation and dissemination toassociated collection disciplines.
Skill to identify Intelligence gaps.
Skill to identify when priority information requirements are satisfied.
Skill to implement established procedures for evaluating collection management andoperations activities.
Skill to interpret planning guidance to discern level of analytical support required.
Skill to interpret readiness reporting, its operational relevance and intelligence collection
impact.
Skill to monitor target or threat situation and environmental factors.
Skill to monitor threat effects to partner capabilities and maintain a running estimate.
Skill to optimize collection system performance through repeated adjustment, testing, andre-adjustment.
Skill to orchestrate intelligence planning teams, coordinate collection and production
support, and monitor status.
Skill to prepare and deliver reports, presentations and briefings, to include using visual aidsor presentation technology.
Skill to relate intelligence resources/assets to anticipated intelligence requirements.
Skill to resolve conflicting collection requirements.
Skill to review performance specifications and historical information about collection
assets.
Skill to specify collections and/or taskings that must be conducted in the near term.
Skill to synchronize operational assessment procedures with the critical information
requirement process.
Skill to synchronize planning activities and required intelligence support.
Skill to translate the capabilities, limitations and tasking methodologies of organic, theater,
national, coalition and other collection capabilities.
Skill to use collaborative tools and environments for collection operations.
Skill to use systems and/or tools to track collection requirements and determine if they aresatisfied.
Skill in creating policies that reflect the business’s core privacy objectives.
Skill in negotiating vendor agreements and evaluating vendor privacy practices.

86

NIST SP 800-181

Skill ID

S0356
S0357
S0358
S0359
S0360
S0361
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

S0362
S0363
S0364
S0365
S0366
S0367
S0368
S0369
S0370
S0371
S0372
S0373
S0374

NICE FRAMEWORKDescription
Skill in communicating with all levels of management including Board members (e.g.,interpersonal skills, approachability, effective listening skills, appropriate use of style andlanguage for the audience).
Skill to anticipate new security threats.
Skill to remain aware of evolving technical infrastructures.
Skill to use critical thinking to analyze organizational patterns and relationships.
Skill to analyze and assess internal and external partner cyber operations capabilities andtools.
Skill to analyze and assess internal and external partner intelligence processes and thedevelopment of information requirements and essential information.
Skill to analyze and assess internal and external partner organization capabilities andlimitations (those with tasking, collection, processing, exploitation and dissemination
responsibilities).
Skill to analyze and assess internal and external partner reporting.
Skill to develop insights about the context of an organization’s threat environment
Skill to design incident response for cloud service models.
Skill to identify successful capabilities to find solutions to less common and more complex
system problems.
Skill to apply cybersecurity and privacy principles to organizational requirements (relevant
to confidentiality, integrity, availability, authentication, non-repudiation).
Skill to use risk scoring to inform performance-based and cost-effective approaches to helporganizations to identify, assess, and manage cybersecurity risk.
Skill to identify sources, characteristics, and uses of the organization’s data assets.
Skill to use cyber defense Service Provider reporting structure and processes within one’s
own organization.
Skill to respond and take local actions in response to threat sharing alerts from service
providers.
Skill to translate, track, and prioritize information needs and intelligence collection
requirements across the extended enterprise.
Skill to ensure that accountability information is collected for information system andinformation and communications technology supply chain infrastructure components.
Skill to identify cybersecurity and privacy issues that stem from connections with internaland external customers and partner organizations.

87

NIST SP 800-181

A.7

NICE FRAMEWORKNICE Framework Ability Descriptions

Table 7 provides a listing of cybersecurity abilities. Ability is competence to perform anobservable behavior or a behavior that results in an observable product. Selected ability
descriptions from this list are included in each work role in the Detailed work role Listing inAppendix B. This listing will be updated periodically [1]. The definitive source for the mostcurrent version of this material can be found in the Reference Spreadsheet for NIST Special
Publication 800-181 [4].
Table 7 - NICE Framework Ability Descriptions

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Ability
ID

A0001
A0002
A0003
A0004
A0005
A0006
A0007

A0008
A0009
A0010
A0011
A0012
A0013
A0014
A0015
A0016
A0017
A0018
A0019
A0020
A0021
A0022
A0023
A0024
A0025
A0026
A0027
A0028
A0029

Description

Ability to identify systemic security issues based on the analysis of vulnerability andconfiguration data.
Ability to match the appropriate knowledge repository technology for a given application orenvironment.
Ability to determine the validity of technology trend data.
Ability to develop curriculum that speaks to the topic at the appropriate level for the target
audience.
Ability to decrypt digital data collections.
Ability to prepare and deliver education and awareness briefings to ensure that systems,
network, and data users are aware of and adhere to systems security policies and procedures.
Ability to tailor code analysis for application-specific concerns.
Ability to apply the methods, standards, and approaches for describing, analyzing, anddocumenting an organization's enterprise information technology (IT) architecture (e.g.,Open Group Architecture Framework [TOGAF], Department of Defense Architecture
Framework [DoDAF], Federal Enterprise Architecture Framework [FEAF]).
Ability to apply supply chain risk management standards.
Ability to analyze malware.
Ability to answer questions in a clear and concise manner.
Ability to ask clarifying questions.
Ability to communicate complex information, concepts, or ideas in a confident and wellorganized manner through verbal, written, and/or visual means.
Ability to communicate effectively when writing.
Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.
Ability to facilitate small group discussions.
Ability to gauge learner understanding and knowledge level.
Ability to prepare and present briefings.
Ability to produce technical documentation.
Ability to provide effective feedback to students for improving learning.
Ability to use and understand complex mathematical concepts (e.g., discrete math).
Ability to apply principles of adult learning.
Ability to design valid and reliable assessments.
Ability to develop clear directions and instructional materials.
Ability to accurately define incidents, problems, and events in the trouble ticketing system.
Ability to analyze test data.
Ability to apply an organization's goals and objectives to develop and maintain architecture.
Ability to assess and forecast manpower requirements to meet organizational objectives.
Ability to build complex data structures and high-level programming languages.

88

NIST SP 800-181

NICE FRAMEWORK

AbilityID

Description

A0030

Ability to collect, verify, and validate test data.
Ability to conduct and implement market research to understand government and industry
capabilities and appropriate pricing.
Ability to develop curriculum for use within a virtual environment.
Ability to develop policy, plans, and strategy in compliance with laws, regulations, policies,
and standards in support of organizational cyber activities.
Ability to develop, update, and/or maintain standard operating procedures (SOPs).
Ability to dissect a problem and examine the interrelationships between data that may appear
unrelated.
Ability to identify basic common coding flaws at a high level.
Ability to leverage best practices and lessons learned of external organizations and academic
institutions dealing with cyber issues.
Ability to optimize systems to meet enterprise performance requirements.
Ability to oversee the development and update of the life cycle cost estimate.
Ability to translate data and test results into evaluative conclusions.
Ability to use data visualization tools (e.g., Flare, HighCharts, AmCharts, D3.js, Processing,Google Visualization API, Tableau, Raphael.js).
Ability to develop career path opportunities.
Ability to conduct forensic analyses in and for both Windows and Unix/Linux environments.
Ability to apply programming language structures (e.g., source code review) and logic.
Ability to evaluate/ensure the trustworthiness of the supplier and/or product.
Ability to monitor and assess the potential impact of emerging technologies on laws,
regulations, and/or policies.
Ability to develop secure software according to secure software deployment methodologies,
tools, and practices.
Ability to apply network security architecture concepts including topology, protocols,
components, and principles (e.g., application of defense-in-depth).
Ability to apply secure system design tools, methods and techniques.
Ability to apply system design tools, methods, and techniques, including automated systems
analysis and design tools.
Ability to execute technology integration processes.
Ability to operate network equipment including hubs, routers, switches, bridges, servers,
transmission media, and related hardware.
Ability to determine the validity of workforce trend data.
Ability to apply the Instructional System Design (ISD) methodology.
Ability to operate common network tools (e.g., ping, traceroute, nslookup).
Ability to ensure security practices are followed throughout the acquisition process.
Ability to tailor curriculum that speaks to the topic at the appropriate level for the target
audience.
Ability to execute OS command line (e.g., ipconfig, netstat, dir, nbtstat).
Ability to operate the organization's LAN/WAN pathways.
Ability to build architectures and frameworks.
Ability to design architectures and frameworks.
Ability to monitor measures or indicators of system performance and availability.
Ability to operate different electronic communication systems and methods (e.g., e-mail,
VOIP, IM, web forums, Direct Video Broadcasts).
Ability to interpret and translate customer requirements into operational capabilities.

A0031
A0032
A0033
A0034

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

A0035
A0036
A0037
A0038
A0039
A0040
A0041
A0042
A0043
A0044
A0045
A0046
A0047
A0048
A0049
A0050
A0051
A0052
A0053
A0054
A0055
A0056
A0057
A0058
A0059
A0060
A0061
A0062
A0063
A0064

89

NIST SP 800-181

NICE FRAMEWORK

AbilityID

Description

A0065

Ability to monitor traffic flows across the network.
Ability to accurately and completely source all data used in intelligence, assessment and/or
planning products.
Ability to adjust to and operate in a diverse, unpredictable, challenging, and fast-paced work
environment.
Ability to apply approved planning development and staffing processes.
Ability to apply collaborative skills and strategies.
Ability to apply critical reading/thinking skills.
Ability to apply language and cultural expertise to analysis.
Ability to clearly articulate intelligence requirements into well-formulated research questions
and data tracking variables for inquiry tracking purposes.
Ability to clearly articulate intelligence requirements into well-formulated research questions
and requests for information.
Ability to collaborate effectively with others.
Ability to coordinate and collaborate with analysts regarding surveillance requirements andessential information development.
Ability to coordinate cyber operations with other organization functions or support activities.
Ability to coordinate, collaborate and disseminate information to subordinate, lateral andhigher-level organizations.
Ability to correctly employ each organization or element into the collection plan and matrix.
Ability to develop or recommend analytic approaches or solutions to problems and situations
for which information is incomplete or for which no precedent exists.
Ability to develop or recommend planning solutions to problems and situations for which noprecedent exists.
Ability to effectively collaborate via virtual teams.
Ability to evaluate information for reliability, validity, and relevance.
Ability to evaluate, analyze, and synthesize large quantities of data (which may be
fragmented and contradictory) into high quality, fused targeting/intelligence products.
Ability to exercise judgment when policies are not well-defined.
Ability to expand network access by conducting target analysis and collection to identify
targets of interest.
Ability to focus research efforts to meet the customer’s decision-making needs.
Ability to function effectively in a dynamic, fast-paced environment.
Ability to function in a collaborative environment, seeking continuous consultation withother analysts and experts—both internal and external to the organization—to leverage
analytical and technical expertise.
Ability to identify external partners with common cyber operations interests.
Ability to identify intelligence gaps.
Ability to identify/describe target vulnerability.
Ability to identify/describe techniques/methods for conducting technical exploitation of thetarget.
Ability to interpret and apply laws, regulations, policies, and guidance relevant toorganization cyber objectives.
Ability to interpret and translate customer requirements into operational action.
Ability to interpret and understand complex and rapidly evolving concepts.
Ability to monitor system operations and react to events in response to triggers and/or
observation of trends or unusual activity.

A0066
A0067
A0068
A0069
A0070
A0071
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

A0072
A0073
A0074
A0076
A0077
A0078
A0079
A0080
A0081
A0082
A0083
A0084
A0085
A0086
A0087
A0088

A0089
A0090
A0091
A0092
A0093
A0094
A0095
A0096
A0097

90

NIST SP 800-181

AbilityID

A0098

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

A0099
A0100
A0101
A0102
A0103
A0104
A0105
A0106
A0107
A0108
A0109
A0110
A0111
A0112
A0113
A0114
A0115
A0116
A0117
A0118
A0119
A0120
A0121
A0122
A0123
A0124
A0125
A0126
A0127
A0128

NICE FRAMEWORKDescription

Ability to participate as a member of planning teams, coordination groups, and task forces asnecessary.
Ability to perform network collection tactics, techniques, and procedures to include
decryption capabilities/tools.
Ability to perform wireless collection procedures to include decryption capabilities/tools.
Ability to recognize and mitigate cognitive biases which may affect analysis.
Ability to recognize and mitigate deception in reporting and analysis.
Ability to review processed target language materials for accuracy and completeness.
Ability to select the appropriate implant to achieve operational goals.
Ability to tailor technical and planning information to a customer’s level of understanding.
Ability to think critically.
Ability to think like threat actors.
Ability to understand objectives and effects.
Ability to utilize multiple intelligence sources across all intelligence disciplines.
Ability to monitor advancements in information privacy laws to ensure organizational
adaptation and compliance.
Ability to work across departments and business units to implement organization’s privacy
principles and programs, and align privacy objectives with security objectives.
Ability to monitor advancements in information privacy technologies to ensureorganizational adaptation and compliance.
Ability to determine whether a security incident violates a privacy principle or legal standard
requiring specific legal action.
Ability to develop or procure curriculum that speaks to the topic at the appropriate level forthe target.
Ability to work across departments and business units to implement organization’s privacy
principles and programs, and align privacy objectives with security objectives.
Ability to prioritize and allocate cybersecurity resources correctly and efficiently.
Ability to relate strategy, business, and technology in the context of organizational dynamics.
Ability to understand technology, management, and leadership issues related to organization
processes and problem solving.
Ability to understand the basic concepts and issues related to cyber and its organizational
impact.
Ability to share meaningful insights about the context of an organization’s threat

environment that improve its risk management posture.
Ability to design incident response for cloud service models.
Ability to design capabilities to find solutions to less common and more complex systemproblems.
Ability to apply cybersecurity and privacy principles to organizational requirements (relevant
to confidentiality, integrity, availability, authentication, non-repudiation).
Ability to establish and maintain automated security control assessments
Ability to author a privacy disclosure statement based on current laws.
Ability to track the location and configuration of networked devices and software acrossdepartments, locations, facilities and, potentially, supporting business functions.
Ability to deploy continuous monitoring technologies and tools.
Ability to apply techniques for detecting host and network-based intrusions using intrusion
detection technologies.

91

NIST SP 800-181

Ability
ID

A0129
A0130

A0131

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

A0132

A0133

A0134

A0135
A0136

A0137

A0138

A0139

A0140

A0141

A0142

A0143

A0144
A0145

NICE FRAMEWORKDescription

Ability to ensure information security management processes are integrated with strategicand operational planning processes.
Ability to ensure that senior officials within the organization provide information security forthe information and systems that support the operations and assets under their control.
Ability to ensure the organization has adequately trained personnel to assist in complying
with security requirements in legislation, Executive Orders, policies, directives, instructions,standards, and guidelines.
Ability to coordinate with senior leadership of an organization to provide a comprehensive,organization-wide, holistic approach for addressing risk—an approach that provides a greater
understanding of the integrated operations of the organization.
Ability to coordinate with senior leadership of an organization to develop a risk management
strategy for the organization providing a strategic view of security-related risks for theorganization.
Ability to coordinate with senior leadership of an organization to facilitate the sharing of riskrelated information among authorizing officials and other senior leaders within theorganization.
Ability to coordinate with senior leadership of an organization to provide oversight for allrisk management-related activities across the organization to help ensure consistent andeffective risk acceptance decisions.
Ability to coordinate with senior leadership of an organization to ensure that authorization
decisions consider all factors necessary for mission and business success.
Ability to coordinate with senior leadership of an organization to provide an organizationwide forum to consider all sources of risk (including aggregated risk) to organizational
operations and assets, individuals, other organizations, and the Nation.
Ability to coordinate with senior leadership of an organization to promote cooperation andcollaboration among authorizing officials to include authorization actions requiring shared
responsibility.
Ability to coordinate with senior leadership of an organization to ensure that the shared
responsibility for supporting organizational mission/business functions using external
providers of systems, services, and applications receives the needed visibility and is elevatedto the appropriate decision-making authorities.
Ability to coordinate with senior leadership of an organization to identify the organizationalrisk posture based on the aggregated risk from the operation and use of the systems for which
the organization is responsible.
Ability to work closely with authorizing officials and their designated representatives to help
ensure that an organization-wide security program is effectively implemented resulting in
adequate security for all organizational systems and environments of operation.
Ability to work closely with authorizing officials and their designated representatives to help
ensure that security considerations are integrated into programming/planning/budgeting
cycles, enterprise architectures, and acquisition/system development life cycles.
Ability to work closely with authorizing officials and their designated representatives to help
ensure that organizational systems and common controls are covered by approved security
plans and possess current authorizations.
Ability to work closely with authorizing officials and their designated representatives to help
ensure that security-related activities required across the organization are accomplished in an
efficient, cost-effective, and timely manner.
Ability to work closely with authorizing officials and their designated representatives to help
ensure that there is centralized reporting of security-related activities.

92

NIST SP 800-181

Ability
ID

A0146

A0147

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

A0148

A0149
A0150

A0151

A0152

A0153

A0154

A0155
A0156
A0157

A0158
A0159
A0160

NICE FRAMEWORKDescription

Ability to establish the rules for appropriate use and protection of the information and retains
that responsibility even when the information is shared with or provided to otherorganizations.
Ability to approve security plans, memorandums of agreement or understanding, plans ofaction and milestones, and determine whether significant changes in the systems orenvironments of operation require reauthorization.
Ability to serve as the primary liaison between the enterprise architect and the systems
security engineer and coordinates with system owners, common control providers, andsystem security officers on the allocation of security controls as system-specific, hybrid, orcommon controls.
Ability, in close coordination with system security officers, advise authorizing officials, chief
information officers, senior information security officers, and the senior accountable official
for risk management/risk executive (function), on a range of security-related issues (e.g.
establishing system boundaries; assessing the severity of weaknesses and deficiencies in thesystem; plans of action and milestones; risk mitigation approaches; security alerts; andpotential adverse effects of identified vulnerabilities).
Ability to conduct systems security engineering activities (NIST SP 800-16).
Ability to capture and refine security requirements and ensure that the requirements are
effectively integrated into the component products and systems through purposeful security
architecting, design, development, and configuration.
Ability to employ best practices when implementing security controls within a system
including software engineering methodologies; system and security engineering principles;
secure design, secure architecture, and secure coding techniques.
Ability to coordinate their security-related activities with security architects, senior
information security officers, system owners, common control providers, and system security
officers.
Ability to conduct a comprehensive assessment of the management, operational, andtechnical security controls and control enhancements employed within or inherited by asystem to determine the effectiveness of the controls (i.e., the extent to which the security
controls are implemented correctly, operating as intended, and producing the desired
outcome with respect to meeting the security requirements for the system).
Ability to provide an assessment of the severity of weaknesses or deficiencies discovered in
the system and its environment of operation and recommend corrective actions to address
identified vulnerabilities.
Ability to prepare the final security assessment report containing the results and findings
from the assessment.
Ability to assesses a security plan to help ensure that the plan provides a set of security
controls for the system that meet the stated security requirements.
Ability to ensure that functional and security requirements are appropriately addressed in acontract and that the contractor meets the functional and security requirements as stated in thecontract.
Ability to interpret the information collected by network tools (e.g. Nslookup, Ping, andTraceroute).
Ability to translate, track, and prioritize information needs and intelligence collection
requirements across the extended enterprise.

93

NIST SP 800-181

Ability
ID

A0161

A0162
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

A0162
A0163
A0164
A0165
A0166
A0167
A0168
A0170
A0171
A0172
A0173
A0174
A0175
A0176

NICE FRAMEWORKDescription

Ability to integrate information security requirements into the acquisition process; using
applicable baseline security controls as one of the sources for security requirements; ensuringa robust software quality control process; and establishing multiple sources (e.g., delivery
routes, for critical system elements).
Ability to ensure information system security, acquisition personnel, legal counsel, and otherappropriate advisors and stakeholders are participating in decision making from system
concept definition/review and are involved in, or approve of, each milestone decision throughthe entire system life cycle for systems.
Ability to recognize the unique aspects of the Communications Security (COMSEC)
environment and hierarchy.
Ability to interpret Communications Security (COMSEC) terminology, guidelines andprocedures.
Ability to identify the roles and responsibilities for appointed Communications Security(COMSEC) personnel.
Ability to manage Communications Security (COMSEC) material accounting, control anduse procedure.
Ability to identify types of Communications Security (COMSEC) Incidents and how they’rereported
Ability to recognize the importance of auditing Communications Security (COMSEC)
material and accounts.
Ability to Identify the requirements of In-Process accounting for Communications Security(COMSEC)
Ability to identify critical infrastructure systems with information communication technologythat were designed without system security considerations.
Ability to conduct training and education needs assessment.
Ability to set up a physical or logical sub-networks that separates an internal local area
network (LAN) from other untrusted networks.
Ability to recognize that changes to systems or environment can change residual risks inrelation to risk appetite.
Ability to Find and navigate the dark web using the TOR network to locate markets andforums.
Ability to examine digital media on multiple operating system platforms.
Ability to maintain databases. (i.e., backup, restore, delete data, transaction log files, etc.).

94

NIST SP 800-181

NICE FRAMEWORKAppendix B – Work Role Detail ListingThis appendix provides a detailed description of each NICE Framework work role. For eachwork role, the listing below provides the following information:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181•

The work role name;•

A unique NICE Framework work role ID, based upon abbreviations of the NICE
Framework Category and Specialty Area to which that work role belongs;•

The Specialty Area in which the work role resides;•

The Category in which the work role resides;•

A description of the work role;•

A list of the NICE Framework Tasks that a person in a cybersecurity position that
includes the work role might be expected to perform;•

A list of the NICE Framework Knowledge areas that a person in a cybersecurity position
that includes the work role might be expected to exhibit;•

A list of the NICE Framework Skills that a person in a cybersecurity position that
includes the work role might be expected to possess; and•A list of the NICE Framework Abilities that a person in a cybersecurity position that
includes the work role might be expected to demonstrate.

The following tables describe the NICE Framework work roles with a simple listing of tasks,
knowledge, skills, and abilities. The definitive source for the most current version of thismaterial can be found in the Reference Spreadsheet for NIST Special Publication 800-181 [4].
The Reference Spreadsheet provide more verbose listings of the tasks, knowledge, skills,
abilities. The work roles will be updated periodically [1].
B.1

Securely Provision (SP)Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks
Knowledge

SkillsAbilities

Authorizing Official
SP-RSK-001
Risk Management (RSK)
Securely Provision (SP)Senior official or executive with the authority to formally assume responsibility for
operating an information system at an acceptable level of risk to organizational
operations (including mission, functions, image, or reputation), organizational
assets, individuals, other organizations, and the Nation (CNSSI 4009).
T0145, T0221, T0371, T0495
K0001, K0002, K0003, K0004, K0005, K0006, K0013, K0019, K0027, K0028,
K0037, K0038, K0040, K0044, K0048, K0049, K0054, K0059, K0070, K0084,
K0089, K0101, K0126, K0146, K0168, K0169, K0170, K0179, K0199, K0203,
K0260, K0261, K0262, K0267, K0295, K0322, K0342, K0622, K0624
S0034, S0367
A0028, A0033, A0077, A0090, A0094, A0111, A0117, A0118, A0119, A0123,
A0170

95

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORKSecurity Control Assessor
SP-RSK-002
Risk Management (RSK)
Securely Provision (SP)Conducts independent comprehensive assessments of the management, operational,
and technical security controls and control enhancements employed within or
inherited by an information technology (IT) system to determine the overall
effectiveness of the controls (as defined in NIST 800-37).
T0145, T0184, T0221, T0244, T0251, T0371, T0495, T0177, T0178, T0181,
T0205, T0243, T0255, T0264, T0265, T0268, T0272, T0275, T0277, T0309,
T0344
K0001, K0002, K0003, K0004, K0005, K0006, K0007, K0008, K0009, K0010,
K0011, K0013, K0018, K0019, K0018, K0021, K0024, K0026, K0027, K0028,
K0029, K0037, K0038, K0040, K0044, K0048, K0049, K0054, K0056, K0059,
K0070, K0084, K0089, K0098, K0100, K0101, K0126, K0146, K0168, K0169,
K0170, K0179, K0199, K0203, K0260, K0261, K0262, K0267, K0287, K0322,
K0342, K0622, K0624
S0001, S0006, S0027, S0034, S0038, S0073, S0078, S0097, S0100, S0110, S0111,
S0112, S0115, S0120, S0124, S0128, S0134, S0135, S0136, S0137, S0138, S0141,
S0145, S0147, S0171, S0172, S0173, S0174, S0175, S0176, S0177, S0184, S0232,
S0233, S0234, S0235, S0236, S0237, S0238, S0239, S0240, S0241, S0242, S0243,
S0244, S0248, S0249, S0250, S0251, S0252, S0254, S0271, S0273, S0278, S0279,
S0280, S0281, S0296, S0304, S0305, S0306, S0307, S0325, S0329, S0332, S0367,
S0370, S0374
A0001, A0011, A0012, A0013, A0014, A0015, A0016, A0018, A0019, A0023,
A0026, A0030, A0035, A0036, A0040, A0056, A0069, A0070, A0082, A0083,
A0084, A0085, A0086, A0087, A0088, A0089, A0090, A0091, A0092, A0093,
A0094, A0095, A0096, A0098, A0101, A0106, A0108, A0109, A0117, A0118,
A0119, A0111, A0112, A0114, A0115, A0116, A0119, A0123, A0170

Software Developer
SP-DEV-001
Software Development (DEV)
Securely Provision (SP)Develops, creates, maintains, and writes/codes new (or modifies existing)computer applications, software, or specialized utility programs.
T0009, T0011, T0013, T0014, T0022, T0026, T0034, T0040, T0046, T0057,
T0077, T0100, T0111, T0117, T0118, T0171, T0176, T0181, T0189, T0217,
T0228, T0236, T0267, T0303, T0311, T0324, T0337, T0416, T0417, T0436,
T0455, T0500, T0553, T0554
K0001, K0002, K0003, K0004, K0005, K0006, K0014, K0016, K0027, K0028,
K0039, K0044, K0050, K0051, K0060, K0066, K0068, K0070, K0073, K0079,
K0080, K0081, K0082, K0084, K0086, K0105, K0139, K0140, K0152, K0153,
K0154, K0170, K0179, K0199, K0202, K0260, K0261, K0262, K0263, K0322,
K0332, K0342, K0343, K0624
S0001, S0014, S0017, S0019, S0022, S0031, S0034, S0060, S0135, S0138, S0149,
S0174, S0175, S0367
A0007, A0021, A0047, A0123, A0170

96

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORKSecure Software Assessor
SP-DEV-002
Software Development (DEV)
Securely Provision (SP)Analyzes the security of new or existing computer applications, software, or
specialized utility programs and provides actionable results.
T0013, T0014, T0022, T0038, T0040, T0100, T0111, T0117, T0118, T0171,
T0181, T0217, T0228, T0236, T0266, T0311, T0324, T0337, T0424, T0428,
T0436, T0456, T0457, T0516, T0554
K0001, K0002, K0003, K0004, K0005, K0006, K0014, K0016, K0027, K0028,
K0039, K0044, K0050, K0051, K0060, K0066, K0068, K0070, K0073, K0079,
K0080, K0081, K0082, K0084, K0086, K0105, K0139, K0140, K0152, K0153,
K0154, K0170, K0178, K0179, K0199, K0202, K0260, K0261, K0262, K0263,
K0322, K0342, K0343, K0624
S0001, S0022, S0031, S0034, S0083, S0135, S0138, S0174, S0175, S0367
A0021, A0123, A0170

Enterprise Architect
SP-ARC-001
Systems Architecture (ARC)
Securely Provision (SP)Develops and maintains business, systems, and information processes to support
enterprise mission needs; develops information technology (IT) rules andrequirements that describe baseline and target architectures.
T0051, T0084, T0090, T0108, T0196, T0205, T0307, T0314, T0328, T0338,
T0427, T0440, T0448, T0473, T0517, T0521, T0542, T0555, T0557
K0001, K0002, K0003, K0004, K0005, K0006, K0024, K0027, K0028, K0030,
K0035, K0037, K0043, K0044, K0052, K0056, K0060, K0061, K0063, K0074,
K0075, K0082, K0091, K0093, K0102, K0170, K0179, K0180, K0198, K0200,
K0203, K0207, K0211, K0212, K0214, K0227, K0240, K0264, K0275, K0286,
K0287, K0291, K0293, K0299, K0322, K0323, K0325, K0326, K0332, K0333,
K0487, K0516
S0005, S0024, S0027, S0050, S0060, S0122, S0367, S0374
A0008, A0015, A0027, A0038, A0051, A0060, A0123, A0170

97

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORKSecurity Architect
SP-ARC-002
Systems Architecture (ARC)
Securely Provision (SP)Ensures that the stakeholder security requirements necessary to protect theorganization’s mission and business processes are adequately addressed in all
aspects of enterprise architecture including reference models, segment and solutionarchitectures, and the resulting systems supporting those missions and businessprocesses.
T0050, T0051, T0071, T0082, T0084, T0090, T0108, T0177, T0196, T0203,
T0205, T0268, T0307, T0314, T0328, T0338, T0427, T0448, T0473, T0484,
T0542, T0556
K0001, K0002, K0003, K0004, K0005, K0006, K0007, K0008, K0009, K0010,
K0011, K0012, K0013, K0015, K0018, K0019, K0024, K0026, K0027, K0030,
K0035, K0036, K0037, K0043, K0044, K0052, K0055, K0056, K0057, K0059,
K0060, K0061, K0063, K0071, K0074, K0082, K0091, K0092, K0093, K0102,
K0170, K0180, K0198, K0200, K0202, K0211, K0212, K0214, K0227, K0240,
K0260, K0261, K0262, K0264, K0275, K0277, K0286, K0287, K0291, K0293,
K0320, K0322, K0323, K0325, K0326, K0332, K0333, K0336, K0374, K0565
S0005, S0022, S0024, S0027, S0050, S0059, S0061, S0076, S0116, S0122, S0138,
S0139, S0152, S0168, S0170, S367, S0374
A0008, A0014, A0015, A0027, A0038, A0048, A0049, A0050, A0061, A0123,
A0148, A0149, A0170, A0172

Research and Development Specialist
SP-TRD-001
Technology R&D (TRD)
Securely Provision (SP)Conducts software and systems engineering and software systems research todevelop new capabilities, ensuring cybersecurity is fully integrated. Conducts
comprehensive technology research to evaluate potential vulnerabilities incyberspace systems.
T0064, T0249, T0250, T0283, T0284, T0327, T0329, T0409, T0410, T0411,
T0413, T0547
K0001, K0002, K0003, K0004, K0005, K0006, K0009, K0019, K0059, K0090,
K0126, K0169, K0170, K0171, K0172, K0174, K0175, K0176, K0179, K0202,
K0209, K0267, K0268, K0269, K0271, K0272, K0288, K0296, K0310, K0314,
K0321, K0342, K0499
S0005, S0017, S0072, S0140, S0148, S0172
A0001, A0018, A0019, A0170

98

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORK

Systems Requirements Planner
SP-SRP-001
Systems Requirements Planning (SRP)
Securely Provision (SP)Consults with customers to evaluate functional requirements and translatefunctional requirements into technical solutions.
T0033, T0039, T0045, T0052, T0062, T0127, T0156, T0174, T0191, T0235,
T0273, T0300, T0313, T0325, T0334, T0454, T0463, T0497
K0001, K0002, K0003, K0004, K0005, K0006, K0008, K0012, K0018, K0019,
K0032, K0035, K0038, K0043, K0044, K0045, K0047, K0055, K0056, K0059,
K0060, K0061, K0063, K0066, K0067, K0073, K0074, K0086, K0087, K0090,
K0091, K0093, K0101, K0102, K0126, K0163, K0164, K0168, K0169, K0170,
K0180, K0200, K0267, K0287, K0325, K0332, K0333, K0622
S0005, S0006, S0008, S0010, S0050, S0134, S0367
A0064, A0123, A0170

System Test & Evaluation Specialist
SP-TST-001
Test and Evaluation (TST)
Securely Provision (SP)
Plans, prepares, and executes tests of systems to evaluate results against
specifications and requirements as well as analyze/report test results.
T0058, T0080, T0125, T0143, T0257, T0274, T0393, T0426, T0511, T0512,
T0513, T0539, T0540
K0001, K0002, K0003, K0004, K0005, K0006, K0027, K0028, K0037, K0044,
K0057, K0088, K0091, K0102, K0139, K0126, K0169, K0170, K0179, K0199,
K0203, K0212, K0250, K0260, K0261, K0262, K0287, K0332
S0015, S0021, S0026, S0030, S0048, S0060, S0061, S0082, S0104, S0107, S0110,
S0112, S0115, S0117, S0367
A0026, A0030, A0040, A0123

99

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORKInformation Systems Security Developer
SP-SYS-001
Systems Development (SYS)
Securely Provision (SP)Designs, develops, tests, and evaluates information system security throughout thesystems development life cycle.
T0012, T0015, T0018, T0019, T0021, T0032, T0053, T0055, T0056, T0061,
T0069, T0070, T0076, T0078, T0105, T0107, T0109, T0119, T0122, T0124,
T0181, T0201, T0205, T0228, T0231, T0242, T0269, T0270, T0271, T0272,
T0304, T0326, T0359, T0446, T0449, T0466, T0509, T0518, T0527, T0541,
T0544
K0001, K0002, K0003, K0004, K0005, K0006, K0015, K0018, K0024, K0027,
K0028, K0030, K0032, K0035, K0036, K0044, K0045, K0049, K0050, K0052,
K0055, K0056, K0060, K0061, K0063, K0065, K0066, K0067, K0073, K0081,
K0082, K0084, K0086, K0087, K0090, K0091, K0093, K0102, K0126, K0139,
K0169, K0170, K0179, K0180, K0200, K0203, K0260, K0261, K0262, K0276,
K0287, K0297, K0308, K0322, K0325, K0332, K0333, K0336
S0001, S0022, S0023, S0024, S0031, S0034, S0036, S0085, S0145, S0160, S0367
A0001, A0008, A0012, A0013, A0015, A0019, A0026, A0040, A0048, A0049,
A0050, A0056, A0061, A0074, A0089, A0098, A0108, A0119, A0123, A0170

Systems Developer
SP-SYS-002
Systems Development (SYS)
Securely Provision (SP)Designs, develops, tests, and evaluates information systems throughout the systems
development life cycle.
T0012, T0021, T0053, T0056, T0061, T0067, T0070, T0107, T0109, T0119,
T0181, T0201, T0205, T0228, T0242, T0304, T0326, T0350, T0358, T0359,
T0378, T0406, T0447, T0449, T0464, T0466, T0480, T0488, T0518, T0528,
T0538, T0541, T0544, T0558, T0559, T0560
K0001, K0002, K0003, K0004, K0005, K0006, K0015, K0018, K0024, K0027,
K0028, K0030, K0032, K0035, K0036, K0044, K0045, K0049, K0050, K0052,
K0055, K0056, K0060, K0061, K0063, K0065, K0066, K0067, K0073, K0081,
K0082, K0084, K0086, K0087, K0090, K0091, K0093, K0102, K0126, K0139,
K0169, K0170, K0179, K0180, K0200, K0203, K0207, K0212, K0227, K0260,
K0261, K0262, K0276, K0287, K0297, K0308, K0322, K0325, K0332, K0333,
K0336
S0018, S0022, S0023, S0024, S0025, S0031, S0034, S0036, S0060, S0085, S0097,
S0136, S0145, S0146, S0160, S0367
A0123, A0170

100

NIST SP 800-181

B.2

Operate and Maintain (OM)

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORK

Database Administrator
OM-DTA-001
Data Administration (DTAA)
Operate and Maintain (OM)
Administers databases and/or data management systems that allow for the securestorage, query, and utilization of data.
T0008, T0137, T0139, T0140, T0146, T0152, T0162, T0210, T0305, T0306,
T0330, T0422, T0459, T0490
K0001, K0002, K0003, K0004, K0005, K0006, K0020, K0021, K0022, K0023,
K0025, K0031, K0056, K0060, K0065, K0069, K0083, K0097, K0197, K0260,
K0261, K0262, K0277, K0278, K0287, K0420
S0002, S0013, S0037, S0042, S0045
A0176

Data Analyst
OM-DTA-002
Data Administration (DTA)
Operate and Maintain (OM)
Examines data from multiple disparate sources with the goal of providing security
and privacy insight. Designs and implements custom algorithms, workflow
processes and layouts for complex, enterprise-scale data sets used for modeling,data mining, and research purposes.
T0007, T0008, T0068, T0146, T0195, T0210, T0342, T0347, T0349, T0351,
T0353, T0361, T0366, T0381, T0382, T0383, T0385, T0392, T0402, T0403,
T0404, T0405, T0460
K0001, K0002, K0003, K0004, K0005, K0006, K0015, K0016, K0020, K0022,
K0023, K0025, K0031, K0051, K0052, K0056, K0060, K0065, K0068, K0069,
K0083, K0095, K0129, K0139, K0140, K0193, K0197, K0229, K0236, K0238,
K0325, K0420
S0013, S0017, S0202, S0028, S0029, S0037, S0060, S0088, S0089, S0094, S0095,
S0103, S0106, S0109, S0113, S0114, S0118, S0119, S0123, S0125, S0126, S0127,
S0129, S0130, S0160, S0369
A0029, A0035, A0036, A0041, A0066

101

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORK

Knowledge Manager
OM-KMG-001
Knowledge Management (KMG)
Operate and Maintain (OM)
Responsible for the management and administration of processes and tools thatenable the organization to identify, document, and access intellectual capital andinformation content.
T0037, T0060, T0154, T0185, T0209, T0339, T0421, T0452, T0524
K0001, K0002, K0003, K0004, K0005, K0006, K0013, K0094, K0095, K0096,
K0146, K0194, K0195, K0228, K0260, K0261, K0262, K0283, K0287, K0315,
K0338, K0420
S0011, S0012, S0049, S0055
A0002

Technical Support Specialist
OM-STS-001
Customer Service and Technical Support (STS)Operate and Maintain (OM)
Provides technical support to customers who need assistance utilizing client level
hardware and software in accordance with established or approved organizational
process components. (i.e., Master Incident Management Plan, when applicable).
T0125, T0237, T0308, T0315, T0331, T0468, T0482, T0491, T0494, T0496,
T0502, T0530
K0001, K0002, K0003, K0004, K0005, K0006, K0053, K0088, K0109, K0114,
K0116, K0194, K0224, K0237, K0242, K0247, K0260, K0261, K0262, K0287,
K0292, K0294, K0302, K0317, K0330
S0039, S0058, S0142, S0159, S0365
A0025, A0034, A0122

Network Operations Specialist
OM-NET-001
Network Services (NET)Operate and Maintain (OM)
Plans, implements, and operates network services/systems, to include hardware andvirtual environments.
T0035, T0065, T0081, T0121, T0125, T0126, T0129, T0153, T0160, T0200,
T0232
K0001, K0002, K0003, K0004, K0005, K0006, K0010, K0011, K0029, K0038,
K0049, K0050, K0053, K0061, K0071, K0076, K0093, K0104, K0108, K0111,
K0113, K0135, K0136, K0137, K0138, K0159, K0160, K0179, K0180, K0200,
K0201, K0203, K0260, K0261, K0262, K0274, K0287, K0332, K0622
S0004, S0035, S0040, S0041, S0056, S0077, S0079, S0084, S0150, S0162, S0170
A0052, A0055, A0058, A0059, A0062, A0063, A0065, A0159

102

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORK

System Administrator
OM-ADM-001
Systems Administration (ADM)
Operate and Maintain (OM)
Responsible for setting up and maintaining a system or specific components of asystem (e.g. for example, installing, configuring, and updating hardware andsoftware; establishing and managing user accounts; overseeing or conducting
backup and recovery tasks; implementing operational and technical security
controls; and adhering to organizational security policies and procedures).
T0029, T0054, T0063, T0136, T0144, T0186, T0207, T0418, T0431, T0435,
T0458, T0461, T0498, T0501, T0507, T0514, T0515, T0531
K0001, K0002, K0003, K0004, K0005, K0006, K0049, K0050, K0053, K0064,
K0077, K0088, K0100, K0103, K0104, K0117, K0130, K0158, K0167, K0179,
K0260, K0261, K0262, K0274, K0280, K0289, K0318, K0332, K0346
S0016, S0033, S0043, S0073, S0076, S0111, S0143, S0144, S0151, S0153, S0154,
S0155, S0157, S0158
A0025, A0027, A0034, A0055, A0062, A0074, A0088, A0123, A0124

Systems Security Analyst
OM-ANA-001
Systems Analysis (ANA)
Operate and Maintain (OM)
Responsible for the analysis and development of the integration, testing,operations, and maintenance of systems security.
T0015, T0016, T0017, T0085, T0086, T0088, T0123, T0128, T0169, T0177,
T0187, T0194, T0202, T0205, T0243, T0309, T0344, T0462, T0469, T0470,
T0475, T0477, T0485, T0489, T0492, T0499, T0504, T0508, T0526, T0545,
T0548
K0001, K0002, K0003, K0004, K0005, K0006, K0015, K0018, K0019, K0024,
K0035, K0036, K0040, K0044, K0049, K0052, K0056, K0060, K0061, K0063,
K0075, K0082, K0093, K0102, K0179, K0180, K0200, K0203, K0227, K0260,
K0261, K0262, K0263, K0266, K0267, K0275, K0276, K0281, K0284, K0285,
K0287, K0290, K0297, K0322, K0333, K0339
S0024, S0027, S0031, S0036, S0060, S0141, S0147, S0167, S0367
A0015, A0123

103

NIST SP 800-181

B.3

Oversee and Govern (OV)Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge
SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge
SkillsAbilities

NICE FRAMEWORKCyber Legal Advisor
OV-LGA-001
Legal Advice and Advocacy (LGA)
Oversee and Govern (OV)
Provides legal advice and recommendations on relevant topics related to cyber law.
T0006, T0098, T0102, T0131, T0220, T0419, T0434, T0465, T0474, T0476,
T0478, T0487, T0522
K0001, K0002, K0003, K0004, K0005, K0006, K0017, K0059, K0107, K0157,
K0261, K0262, K0267, K0312, K0316, K0341, K0615
S0356
A0046

Privacy Officer/Privacy Compliance Manager
OV-LGA-002
Legal Advice and Advocacy (LGA)
Oversee and Govern (OV)
Develops and oversees privacy compliance program and privacy program staff,
supporting privacy compliance, governance/policy, and incident response needs ofprivacy and security executives and their teams.
T0003, T0004, T0029, T0930, T0032, T0066, T0098, T0099, T0131, T0133,
T0188, T0381, T0384, T0478, T0861, T0862, T0863, T0864, T0865, T0866,
T0867, T0868, T0869, T0870, T0871, T0872, T0873, T0874, T0875, T0876,
T0877, T0878, T0879, T0880, T0881, T0882, T0883, T0884, T0885, T0886,
T0887, T0888, T0889, T0890, T0891, T0892, T0893, T0894, T0895, T0896,
T0897, T0898, T0899, T0900, T0901, T0902, T0903, T0904, T0905, T0906,
T0907, T0908, T0909, T0910, T0911, T0912, T0913, T0914, T0915, T0916,
T0917, T0918, T0919
K0001, K0002, K0003, K0004, K0005, K0006, K0008, K0066, K0168, K0612,
K0613, K0614, K0615
S0354, S0355, S0356
A0024, A0033, A0034, A0104, A0105, A0110, A0111, A0112, A0113, A0114,
A0115, A0125

104

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORKCyber Instructional Curriculum Developer
OV-TEA-001
Training, Education, and Awareness (TEA)
Oversee and Govern (OV)
Develops, plans, coordinates, and evaluates cyber training/education courses,
methods, and techniques based on instructional needs.
T0230, T0247, T0248, T0249, T0345, T0352, T0357, T0365, T0367, T0380,
T0437, T0442, T0450, T0451, T0534, T0536, T0926
K0001, K0002, K0003, K0004, K0005, K0006, K0059, K0124, K0146, K0147,
K0204, K0208, K0213, K0216, K0217, K0220, K0243, K0239, K0245, K0246,
K0250, K0252, K0287, K0628
S0064, S0066, S0070, S0102, S0166, S0296
A0004, A0013, A0015, A0018, A0019, A0022, A0024, A0032, A0054, A0057,
A0055, A0057, A0058, A0063, A0070, A0083, A0089, A0105, A0106, A0112,
A0114, A0118, A0119, A0171

Cyber Instructor
OV-TEA-002
Training, Education, and Awareness (TEA)
Oversee and Govern (OV)
Develops and conducts training or education of personnel within cyber domain.
T0030, T0073, T0101, T0224, T0230, T0247, T0316, T0317, T0318, T0319,
T0320, T0321, T0322, T0323, T0352, T0365, T0367, T0381, T0382, T0395,
T0443, T0444, T0450, T0451, T0467, T0519, T0520, T0535, T0536, T0926
K0001, K0002, K0003, K0004, K0005, K0006, K0007, K0059, K0115, K0124,
K0130, K0146, K0147, K0204, K0208, K0213, K0215, K0216, K0217, K0218,
K0220, K0226, K0239, K0245, K0246, K0250, K0252, K0287, K0313, K0319,
K0628
S0001, S0004, S0006, S0051, S0052, S0053, S0055, S0056, S0057, S0060, S0064,
S0070, S0073, S0075, S0076, S0081, S0084, S0097, S0098, S0100, S0101, S0121,
S0131, S0156, S0184, S0270, S0271, S0281, S0293, S0301, S0356, S0358
A0006, A0011, A0012, A0013, A0014, A0015, A0016, A0017, A0018, A0019,
A0020, A0022, A0023, A0024, A0032, A0055, A0057, A0057, A0058, A0063,
A0066, A0070, A0083, A0089, A0105, A0106, A0112, A0114, A0118, A0119,
A0171

105

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge
SkillsAbilities

NICE FRAMEWORKInformation Systems Security Manager
OV-MGT-001
Cybersecurity Management (MGT)Oversee and Govern (OV)
Responsible for the cybersecurity of a program, organization, system, or enclave.
T0001, T0002, T0003, T0004, T0005, T0024, T0025, T0044, T0089, T0091,
T0092, T0093, T0095, T0097, T0099, T0106, T0115, T0130, T0132, T0133,
T0134, T0135, T0147, T0148, T0149, T0151, T0157, T0158, T0159, T0192,
T0199, T0206, T0211, T0213, T0215, T0219, T0227, T0229, T0234, T0239,
T0248, T0254, T0255, T0256, T0263, T0264, T0265, T0275, T0276, T0277,
T0280, T0281, T0282
K0001, K0002, K0003, K0004, K0005, K0006, K0008, K0018, K0021, K0026,
K0033, K0038, K0040, K0042, K0043, K0046, K0048, K0053, K0054, K0058,
K0059, K0061, K0070, K0072, K0076, K0077, K0087, K0090, K0092, K0101,
K0106, K0121, K0126, K0149, K0150, K0151, K0163, K0167, K0168, K0169,
K0170, K0179, K0180, K0199, K0260, K0261, K0262, K0267, K0287, K0332,
K0342, K0622, K0624
S0018, S0027, S0086
A0128, A0161, A0170

Communications Security (COMSEC) Manager
OV-MGT-002
Cybersecurity Management (MGT)Oversee and Govern (OV)
Individual who manages the Communications Security (COMSEC) resources of anorganization (CNSSI 4009) or key custodian for a Crypto Key Management
System (CKMS).
T0003, T0004, T0025, T0044, T0089, T0095, T0099, T0215, T0229
K0001, K0002, K0003, K0004, K0005, K0006, K0018, K0026, K0038, K0042,
K0090, K0101, K0121, K0126, K0163, K0267, K0285, K0287, K0622
S0027, S0059, S0138
A0162, A0163, A0164, A0165, A0166, A0167, A0168

106

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge
SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge
SkillsAbilities

NICE FRAMEWORKCyber Workforce Developer and Manager
OV-SPP-001
Strategic Planning and Policy (SPP)
Oversee and Govern (OV)
Develops cyberspace workforce plans, strategies and guidance to support
cyberspace workforce manpower, personnel, training and education requirements
and to address changes to cyberspace policy, doctrine, materiel, force structure, andeducation and training requirements.
T0001, T0004, T0025, T0044, T0074, T0094, T0099, T0116, T0222, T0226,
T0341, T0352, T0355, T0356, T0362, T0363, T0364, T0365, T0368, T0369,
T0372, T0373, T0374, T0375, T0376, T0384, T0387, T0388, T0390, T0391,
T0408, T0425, T0429, T0437, T0441, T0445, T0472, T0481, T0505, T0506,
T0529, T0533, T0536, T0537, T0552
K0001, K0002, K0003, K0004, K0005, K0006, K0072, K0101, K0127, K0146,
K0147, K0168, K0169, K0204, K0215, K0233, K0234, K0241, K0243, K0309,
K0311, K0313, K0335
S0108, S0128
A0023, A0028, A0033, A0037, A0042, A0053

Cyber Policy and Strategy Planner
OV-SPP-002
Strategic Planning and Policy Development (SPP)
Oversee and Govern (OV)
Develops and maintains cybersecurity plans, strategy and policy to support andalign with organizational cybersecurity initiatives and regulatory compliance.
T0074, T0094, T0222, T0226, T0341, T0369, T0384, T0390, T0408, T0425,
T0429, T0441, T0445, T0472, T0505, T0506, T0529, T0533, T0537
K0001, K0002, K0003, K0004, K0005, K0006, K0070, K0127, K0146, K0168,
K0234, K0248, K0309, K0311, K0313, K0335, K0624
S0176, S0250
A0003, A0033, A0037

Executive Cyber Leadership
OV-EXL-001
Executive Cyber Leadership (EXL)
Oversee and Govern (OV)
Executes decision-making authorities and establishes vision and direction for an
organization's cyber and cyber-related resources and/or operations.
T0001, T0002, T0004, T0006, T0025, T0066, T0130, T0134, T0135, T0148,
T0151, T0227, T0229, T0229, T0248, T0254, T0263, T0264, T0282, T0337,
T0356, T0429, T0445, T0509, T0763, T0871, T0872, T0927, T0928
K0001, K0002, K0003, K0004, K0005, K0006, K0009, K0070, K0106, K0314,
K0296, K0147, K0624, K0628
S0018, S0356, S0357, S0358, S0359
A0033, A0070, A0085, A0094, A0105, A0106, A0116, A0117, A0118, A0119,
A0129, A0130, A0130

107

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORK

Program Manager
OV-PMA-001
Program/Project Management and Acquisition (PMA)
Oversee and Govern (OV)
Leads, coordinates, communicates, integrates, and is accountable for the overall
success of the program, ensuring alignment with agency or enterprise priorities.
T0066, T0072, T0174, T0199, T0220, T0223, T0256, T0273, T0277, T0302,
T0340, T0354, T0377, T0379, T0407, T0412, T0414, T0415, T0481, T0493,
T0551
K0001, K0002, K0003, K0004, K0005, K0006, K0047, K0048, K0072, K0090,
K0101, K0120, K0126, K0146, K0148, K0154, K0164, K0165, K0169, K0194,
K0196, K0198, K0200, K0235, K0257, K0270
S0038, S0372
A0009, A0039, A0045, A0056,

Information Technology (IT) Project Manager
OV-PMA-002
Program/Project Management and Acquisition (PMA)
Oversee and Govern (OV)
Directly manages information technology projects.
T0072, T0174, T0196, T0199, T0207, T0208, T0220, T0223, T0256, T0273,
T0277, T0340, T0354, T0370, T0377, T0379, T0389, T0394, T0407, T0412,
T0414, T0415, T0481, T0493, T0551
K0001, K0002, K0003, K0004, K0005, K0006, K0012, K0043, K0047, K0048,
K0059, K0072, K0090, K0101, K0120, K0126, K0146, K0148, K0154, K0164,
K0165, K0169, K0194, K0196, K0198, K0200, K0235, K0257, K0270
S0038, S0372
A0009, A0039, A0045, A0056

Product Support Manager
OV-PMA-003
Program/Project Management and Acquisition (PMA)
Oversee and Govern (OV)Manages the package of support functions required to field and maintain thereadiness and operational capability of systems and components.
T0072, T0174, T0196, T0204, T0207, T0208, T0220, T0223, T0256, T0273,
T0277, T0302, T0340, T0354, T0370, T0377, T0389, T0394, T0412, T0414,
T0493, T0525, T0551, T0553
K0001, K0002, K0003, K0004, K0005, K0006, K0043, K0048, K0059, K0072,
K0090, K0120, K0126, K0148, K0150, K0154, K0164, K0165, K0169, K0194,
K0196, K0198, K0200, K0235, K0249, K0257, K0270
S0038, S0372
A0009, A0031, A0039, A0045, A0056

108

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge
SkillsAbilities
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORKIT Investment/Portfolio Manager
OV-PMA-004
Program/Project Management and Acquisition (PMA)
Oversee and Govern (OV)Manages a portfolio of IT investments that align with the overall needs of mission
and enterprise priorities.
T0220, T0223, T0277, T0302, T0377, T0415, T0493, T0551
K0001, K0002, K0003, K0004, K0005, K0006, K0048, K0072, K0120, K0126,
K0146, K0154, K0165, K0169, K0235, K0257, K0270
S0372
A0039

IT Program Auditor
OV-PMA-005
Program/Project Management and Acquisition (PMA)
Oversee and Govern (OV)
Conducts evaluations of an IT program or its individual components, to determine
compliance with published standards.
T0072, T0207, T0208, T0223, T0256, T0389, T0412, T0415
K0001, K0002, K0003, K0004, K0005, K0006, K0043, K0047, K0048, K0072,
K0090, K0120, K0126, K0148, K0154, K0165, K0169, K0198, K0200, K0235,
K0257, K0270
S0038, S0085, S0372
A0056

109

NIST SP 800-181

B.4

Protect and Defend (PR)Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORKCyber Defense Analyst
PR-CDA-001
Cyber Defense Analysis (CDA)
Protect and Defend (PR)Uses data collected from a variety of cyber defense tools (e.g., IDS alerts,
firewalls, network traffic logs.) to analyze events that occur within theirenvironments for the purposes of mitigating threats.
T0020, T0023, T0043, T0088, T0155, T0164, T0166, T0178, T0187, T0198,
T0214, T0258, T0259, T0260, T0290, T0291, T0292, T0293, T0294, T0295,
T0296, T0297, T0298, T0299, T0310, T0332, T0469, T0470, T0475, T0503,
T0504, T0526, T0545, T0548
K0001, K0002, K0003, K0004, K0005, K0006, K0007, K0013, K0015, K0018,
K0019, K0024, K0033, K0040, K0042, K0044, K0046, K0049, K0056, K0058,
K0059, K0060, K0061, K0065, K0070, K0074, K0075, K0093, K0098, K0104,
K0106, K0107, K0110, K0111, K0112, K0113, K0116, K0139, K0142, K0143,
K0157, K0160, K0161, K0162, K0167, K0168, K0177, K0179, K0180, K0190,
K0191, K0192, K0203, K0221, K0222, K0260, K0261, K0262, K0290, K0297,
K0300, K0301, K0303, K0318, K0322, K0324, K0332, K0339, K0342, K0624
S0020, S0025, S0027, S0036, S0054, S0057, S0063, S0078, S0096, S0147, S0156,
S0167, S0169, S0367, S0370
A0010, A0015, A0066, A0123, A0128, A0159

Cyber Defense Infrastructure Support Specialist
PR-INF-001
Cyber Defense Infrastructure Support (INF)
Protect and Defend (PR)
Tests, implements, deploys, maintains, and administers the infrastructure hardware
and software.
T0042, T0180, T0261, T0335, T0348, T0420, T0438, T0483, T0486
K0001, K0002, K0003, K0004, K0005, K0006, K0021, K0033, K0042, K0044,
K0058. K0061, K0062, K0104, K0106, K0135, K0157, K0179, K0205, K0258,
K0274, K0324, K0332, K0334
S0007, S0053, S0054, S0059, S0077, S0079, S0121, S0124, S0367
A0123

110

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORKCyber Defense Incident Responder
PR-CIR-001
Incident Response (CIR)
Protect and Defend (PR)Investigates, analyzes, and responds to cyber incidents within the network
environment or enclave.
T0041, T0047, T0161, T0163, T0164, T0170, T0175, T0214, T0233, T0246,
T0262, T0278, T0279, T0312, T0395, T0503, T0510
K0001, K0002, K0003, K0004, K0005, K0006, K0021, K0026, K0033, K0034,
K0041, K0042, K0046, K0058, K0062, K0070, K0106, K0157, K0161, K0162,
K0167, K0177, K0179, K0221, K0230, K0259, K0287, K0332, K0565, K0624
S0003, S0047, S0077, S0078, S0079, S0080, S0173, S0365
A0121, A0128

Vulnerability Assessment Analyst
PR-VAM-001
Vulnerability Assessment and Management (VAM)
Protect and Defend (PR)
Performs assessments of systems and networks within the NE or enclave andidentifies where those systems/networks deviate from acceptable configurations,enclave policy, or local policy. Measures effectiveness of defense-in-deptharchitecture against known vulnerabilities.
T0010, T0028, T0138, T0142, T0188, T0252, T0549, T0550
K0001, K0002, K0003, K0004, K0005, K0006, K0009, K0019, K0021, K0033,
K0044, K0056, K0061, K0068, K0070, K0089, K0106, K0139, K0161, K0162,
K0167, K0177, K0179, K0203, K0206, K0210, K0224, K0265, K0287, K0301,
K0308, K0332, K0342, K0344, K0624
S0001, S0009, S0025, S0044, S0051, S0052, S0081, S0120, S0137, S0171, S0364,
S0367
A0001, A0044, A0120, A0123

111

NIST SP 800-181

B.5

Analyze (AN)Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORK

Threat/Warning Analyst
AN-TWA-001
Warning/Threat Analysis (TWA)
Analyze (AN)Develops cyber indicators to maintain awareness of the status of the highly
dynamic operating environment. Collects, processes, analyzes, and disseminates
cyber threat/warning assessments.
T0569, T0583, T0584, T0585, T0586, T0589, T0593, T0597, T0615, T0617,
T0660, T0685, T0687, T0707, T0708, T0718, T0748, T0749, T0751, T0752,
T0758, T0761, T0783, T0785, T0786, T0792, T0800, T0805, T0834
K0001, K0002, K0003, K0004, K0005, K0006, K0036, K0058, K0108, K0109,
K0177, K0349, K0362, K0377, K0392, K0395, K0405, K0409, K0415, K0417,
K0427, K0431, K0436, K0437, K0440, K0444, K0445, K0446, K0449, K0458,
K0460, K0464, K0469, K0471, K0480, K0499, K0511, K0516, K0556, K0560,
K0561, K0565, K0603, K0604, K0610, K0612, K0614
S0194, S0196, S0203, S0211, S0218, S0227, S0228, S0229, S0249, S0256, S0278,
S0285, S0288, S0289, S0296, S0297, S0303
A0013, A0066, A0072, A0080, A0082, A0083, A0084, A0087, A0088, A0089,
A0091, A0101, A0102, A0106, A0107, A0109

Exploitation Analyst
AN-EXP-001
Exploitation Analysis (EXP)
Analyze (AN)Collaborates to identify access and collection gaps that can be satisfied throughcyber collection and/or preparation activities. Leverages all authorized resources
and analytic techniques to penetrate targeted networks.
T0028, T0266, T0570, T0572, T0574, T0591, T0600, T0603, T0608, T0614,
T0641, T0695, T0701, T0720, T0727, T0736, T0738, T0754, T0775, T0777
K0001, K0002, K0003, K0004, K0005, K0006, K0108, K0109, K0131, K0142,
K0143, K0177, K0224, K0349, K0362, K0417, K0444, K0471, K0560, K0351,
K0354, K0368, K0371, K0376, K0379, K0388, K0393, K0394, K0397, K0418,
K0430, K0443, K0447, K0451, K0470, K0473, K0484, K0487, K0489, K0509,
K0510, K0523, K0529, K0535, K0544, K0557, K0559, K0608
S0066, S0184, S0199, S0200, S0201, S0204, S0207, S0214, S0223, S0236, S0237,
S0239, S0240, S0245, S0247, S0258, S0260, S0264, S0269, S0279, S0286, S0290,
S0294, S0300
A0013, A0066, A0080, A0084, A0074, A0086, A0092, A0093, A0104

112

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORK

All-Source Analyst
AN-ASA-001
All-Source Analysis (ASA)
Analyze (AN)
Analyzes data/information from one or multiple sources to conduct preparation of
the environment, respond to requests for information, and submit intelligencecollection and production requirements in support of planning and operations.
T0569, T0582, T0583, T0584, T0585, T0586, T0589, T0593, T0597, T0615,
T0617, T0642, T0660, T0678, T0685, T0686, T0687, T0707, T0708, T0710,
T0713, T0718, T0748, T0749, T0751, T0752, T0758, T0761, T0771, T0782,
T0783, T0785, T0786, T0788, T0789, T0792, T0797, T0800, T0805, T0834
K0001, K0002, K0003, K0004, K0005, K0006, K0036, K0058, K0108, K0109,
K0177, K0221, K0349, K0362, K0444, K0471, K0560, K0377, K0392, K0395,
K0405, K0409, K0427, K0431, K0436, K0437, K0440, K0445, K0446, K0449,
K0458, K0460, K0464, K0469, K0480, K0511, K0516, K0556, K0561, K0565,
K0603, K0604, K0610, K0612, K0614, K0357, K0410, K0457, K0465, K0507,
K0533, K0542, K0549, K0551, K0577, K0598
S0194, S0203, S0211, S0218, S0227, S0229, S0249, S0256, S0278, S0285, S0288,
S0289, S0296, S0297, S0303, S0189, S0254, S0360
A0013, A0066, A0080, A0084, A0072, A0082, A0083, A0085, A0087, A0088,
A0089, A0091, A0101, A0102, A0106, A0107, A0108, A0109

Mission Assessment Specialist
AN-ASA-002
All-Source Analysis (ASA)
Analyze (AN)Develops assessment plans and measures of performance/effectiveness. Conducts
strategic and operational effectiveness assessments as required for cyber events.
Determines whether systems performed as expected and provides input to thedetermination of operational effectiveness.
T0582, T0583, T0585, T0586, T0588, T0589, T0593, T0597, T0611, T0615,
T0617, T0624, T0660, T0661, T0663, T0678, T0684, T0685, T0686, T0707,
T0718, T0748, T0749, T0752, T0758, T0761, T0782, T0783, T0785, T0786,
T0788, T0789, T0793, T0797, T0834
K0001, K0002, K0003, K0004, K0005, K0006, K0036, K0058, K0108, K0109,
K0177, K0349, K0362, K0377, K0392, K0395, K0405, K0409, K0410, K0414,
K0417, K0427, K0431, K0436, K0437, K0440, K0444, K0445, K0446, K0449,
K0457, K0460, K0464, K0465, K0469, K0471, K0480, K0507, K0511, K0516,
K0549, K0551, K0556, K0560, K0561, K0565, K0598, K0603, K0604, K0610,
K0612, K0614
S0189, S0194, S0203, S0211, S0216, S0218, S0227, S0228, S0229, S0249, S0254,
S0256, S0271, S0278, S0285, S0288, S0289, S0292, S0296, S0297, S0303, S0360
A0013, A0066, A0080, A0084, A0072, A0082, A0083, A0087, A0088, A0089,
A0091, A0101, A0102, A0106, A0107, A0109, A0085, A0108

113

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORK

Target Developer
AN-TGT-001
Targets (TGT)
Analyze (AN)
Performs target system analysis, builds and/or maintains electronic target folders toinclude inputs from environment preparation, and/or internal or external
intelligence sources. Coordinates with partner target activities and intelligenceorganizations, and presents candidate targets for vetting and validation.
T0597, T0617, T0707, T0582, T0782, T0797, T0588, T0624, T0661, T0663,
T0684, T0642, T0710, T0561, T0594, T0599, T0633, T0650, T0652, T0688,
T0717, T0731, T0744, T0769, T0770, T0776, T0781, T0790, T0794, T0798,
T0799, T0802, T0815, T0824, T0835
K0001, K0002, K0003, K0004, K0005, K0006, K0036, K0058, K0108, K0109,
K0177, K0142, K0349, K0362, K0444, K0471, K0560, K0392, K0395, K0409,
K0427, K0431, K0436, K0437, K0440, K0445, K0446, K0449, K0460, K0464,
K0516, K0556, K0561, K0565, K0603, K0604, K0614, K0457, K0465, K0507,
K0549, K0551, K0598, K0417, K0458, K0357, K0533, K0542, K0351, K0379,
K0473, K0381, K0402, K0413, K0426, K0439, K0461, K0466, K0478, K0479,
K0497, K0499, K0543, K0546, K0547, K0555
S0194, S0203, S0218, S0227, S0229, S0249, S0256, S0278, S0285, S0288, S0289,
S0296, S0297, S0189, S0228, S0216, S0292, S0196, S0187, S0205, S0208, S0222,
S0248, S0274, S0287, S0302, S0360, S0361
A0013, A0066, A0080, A0084, A0087, A0088, A0089, A0091, A0101, A0102,
A0106, A0109, A0085, A0073

Target Network Analyst
AN-TGT-002
Targets (TGT)
Analyze (AN)
Conducts advanced analysis of collection and open-source data to ensure target
continuity; to profile targets and their activities; and develop techniques to gain
more target information. Determines how targets communicate, move, operate andlive based on knowledge of target technologies, digital networks and theapplications on them.
T0617, T0707, T0582, T0797, T0624, T0710, T0599, T0650, T0802, T0595,
T0606, T0607, T0621, T0653, T0692, T0706, T0715, T0722, T0745, T0765,
T0767, T0778, T0803, T0807
K0001, K0002, K0003, K0004, K0005, K0006, K0108, K0109, K0177, K0349,
K0362, K0444, K0471, K0392, K0395, K0431, K0436, K0440, K0445, K0449,
K0516, K0379, K0473, K0413, K0439, K0479, K0547, K0487, K0544, K0559,
K0389, K0403, K0424, K0442, K0462, K0472, K0483, K0499, K0500, K0520,
K0550, K0567, K0592, K0599, K0600
S0194, S0203, S0229, S0256, S0228, S0196, S0187, S0205, S0208, S0222, S0248,
S0274, S0287, S0177, S0178, S0181, S0183, S0191, S0197, S0217, S0219, S0220,
S0225, S0231, S0234, S0244, S0246, S0259, S0261, S0262, S0263, S0268, S0277,
S0280, S0291, S0301
A0013, A0066, A0080, A0084, A0087, A0088, A0089, A0091, A0101, A0102,
A0106, A0109, A0085, A0073

114

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORK

Multi-Disciplined Language Analyst
AN-LNG-001
Language Analysis (LNG)
Analyze (AN)Applies language and culture expertise with target/threat and technical knowledge
to process, analyze, and/or disseminate intelligence information derived fromlanguage, voice and/or graphic material. Creates, and maintains language specificdatabases and working aids to support cyber action execution and ensure criticalknowledge sharing. Provides subject matter expertise in foreign languageintensive or interdisciplinary projects.
T0650, T0606, T0715, T0745, T0761, T0837, T0838, T0839, T0840, T0841,
T0842, T0843, T0844, T0845, T0846, T0847, T0848, T0849, T0850, T0851,
T0852, T0853, T0854, T0855, T0856, T0857, T0858, T0859, TO860
K0001, K0002, K0003, K0004, K0005, K0006, K0108, K0143, K0177, K0431,
K0449, K0413, K0487, K0462, K0520, K0550, K0567, K0599, K0600, K0417,
K0377, K0356, K0359, K0391, K0396, K0398, K0407, K0416, K0476, K0488,
K0491, K0493, K0499, K0524, K0532, K0539, K0540, K0541, K0545, K0548,
K0564, K0571, K0574, K0579, K0596, K0606, K0607
S0187, S0217, S0244, S0259, S0262, S0277, S0218, S0184, S0290, S0179, S0188,
S0193, S0195, S0198, S0210, S0212, S0215, S0224, S0226, S0232, S0233, S0235,
S0241, S0251, S0253, S0265, S0283, S0284
A0013, A0089, A0071, A0103

115

NIST SP 800-181

B.6

Collect and Operate (CO)Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORKAll Source-Collection Manager
CO-CLO-001
Collection Operations (CLO)
Collect and Operate (CO)Identifies collection authorities and environment; incorporates priority information
requirements into collection management; develops concepts to meet leadership's
intent. Determines capabilities of available collection assets, identifies newcollection capabilities; and constructs and disseminates collection plans. Monitors
execution of tasked collection to ensure effective execution of the collection plan.
T0562, T0564, T0568, T0573, T0578, T0604, T0605, T0625, T0626, T0631,
T0632, T0634, T0645, T0646, T0647, T0649, T0651, T0657, T0662, T0674,
T0681, T0683, T0698, T0702, T0714, T0716, T0721, T0723, T0725, T0734,
T0737, T0750, T0753, T0755, T0757, T0773, T0779, T0806, T0809, T0810,
T0811, T0812, T0814, T0820, T0821, T0827
K0001, K0002, K0003, K0004, K0005, K0006, K0036, K0058, K0109, K0177,
K0431, K0449, K0417, K0579, K0596, K0444, K0471, K0392, K0395, K0440,
K0445, K0516, K0560, K0427, K0446, K0561, K0565, K0405, K0480, K0610,
K0612, K0353, K0361, K0364, K0380, K0382, K0383, K0386, K0387, K0390,
K0401, K0404, K0412, K0419, K0425, K0435, K0448, K0453, K0454, K0467,
K0474, K0475, K0477, K0482, K0492, K0495, K0496, K0498, K0503, K0505,
K0513, K0521, K0522, K0526, K0527, K0552, K0553, K0554, K0558, K0562,
K0563, K0569, K0570, K0580, K0581, K0583, K0584, K0587, K0588, K0601,
K0605, K0613
S0238, S0304, S0305, S0311, S0313, S0316, S0317, S0324, S0325, S0327, S0328,
S0330, S0332, S0334, S0335, S0336, S0339, S0342, S0344, S0347, S0351, S0352,
S0362
A0069, A0070, A0076, A0078, A0079

116

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

NICE FRAMEWORKAll Source-Collection Requirements Manager
CO-CLO-002
Collection Operations (CLO)
Collect and Operate (CO)Evaluates collection operations and develops effects-based collection requirements
strategies using available sources and methods to improve collection. Develops,
processes, validates, and coordinates submission of collection requirements.
Evaluates performance of collection assets and collection operations.
T0564, T0568, T0578, T0605, T0651, T0714, T0725, T0734, T0809, T0810,
T0811, T0565, T0577, T0580, T0596, T0602, T0613, T0668, T0673, T0675,
T0682, T0689, T0693, T0694, T0730, T0746, T0780, T0819, T0822, T0830,
T0831, T0832, T0833
K0001, K0002, K0003, K0004, K0005, K0006, K0036, K0058, K0109, K0177,
K0353, K0361, K0364, K0380, K0382, K0383, K0384, K0386, K0387, K0390,
K0395, K0401, K0404, K0412, K0417, K0419, K0421, K0425, K0427, K0431,
K0435, K0444, K0445, K0446, K0448, K0453, K0454, K0467, K0474, K0475,
K0477, K0480, K0482, K0492, K0495, K0496, K0498, K0505, K0513, K0516,
K0521, K0526, K0527, K0552, K0554, K0558, K0560, K0561, K0562, K0563,
K0565, K0568, K0569, K0570, K0579, K0580, K0581, K0584, K0587, K0588,
K0596, K0605, K0610, K0612
S0304, S0305, S0316, S0317, S0327, S0330, S0334, S0335, S0336, S0339, S0344,
S0347, S0352, S0329 S0337, S0346, S0348, S0353, S0362
A0069, A0070, A0078

117

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

NICE FRAMEWORKCyber Intel Planner
CO-OPL-001
Cyber Operational Planning (OPL)
Collect and Operate (CO)Develops detailed intelligence plans to satisfy cyber operations requirements.
Collaborates with cyber operations planners to identify, validate, and levy
requirements for collection and analysis. Participates in targeting selection,
validation, synchronization, and execution of cyber actions. Synchronizes
intelligence activities to support organization objectives in cyberspace.
T0734, T0563, T0575, T0576, T0579, T0581, T0587, T0590, T0592, T0601,
T0627, T0628, T0630, T0636, T0637, T0638, T0639, T0640, T0648, T0656,
T0659, T0667, T0670, T0676, T0680, T0690, T0691, T0705, T0709, T0711,
T0719, T0726, T0728, T0733, T0735, T0739, T0743, T0760, T0763, T0772,
T0784, T0801, T0808, T0816, T0836
K0001, K0002, K0003, K0004, K0005, K0006, K0036, K0108, K0109, K0120,
K0431, K0417, K0444, K0395, K0445, K0560, K0427, K0446, K0561, K0565,
K0480, K0610, K0612, K0435, K0471, K0392, K0440, K0405, K0377, K0349,
K0362, K0436, K0379, K0403, K0460, K0464, K0556, K0603, K0614, K0465,
K0507, K0598, K0511, K0414, K0577, K0347, K0350, K0352, K0355, K0358,
K0399, K0400, K0408, K0411, K0422, K0432, K0455, K0456, K0459, K0463,
K0494, K0499, K0501, K0502, K0504, K0506, K0508, K0512, K0514, K0517,
K0518, K0519, K0525, K0538, K0566, K0572, K0575, K0578, K0582, K0585,
K0586, K0589, K0590, K0591, K0593, K0594, K0595, K0599, K0602
S0218, S0203, S0249, S0278, S0296, S0297, S0176, S0185, S0186, S0213, S0250,
S0272, S0273, S0306, S0307, S0308, S0309, S0310, S0312, S0314, S0315, S0318,
S0319, S0320, S0321, S0322, S0323, S0331, S0333, S0338, S0340, S0341, S0343,
S0345, S0350, S0360
A0013, A0066, A0070, A0089, A0085, A0082, A0074, A0067, A0068, A0077,
A0081, A0090, A0094, A0096, A0098, A0105, A0160

118

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description

Tasks

Knowledge

SkillsAbilities

NICE FRAMEWORKCyber Ops Planner
CO-OPL-002
Cyber Operational Planning (OPL)
Collect and Operate (CO)Develops detailed plans for the conduct or support of the applicable range of cyber
operations through collaboration with other planners, operators and/or analysts.
Participates in targeting selection, validation, synchronization, and enables
integration during the execution of cyber actions.
T0734, T0563, T0579, T0581, T0592, T0627, T0628, T0640, T0648, T0667,
T0670, T0680, T0690, T0719, T0733, T0739, T0743, T0763, T0772, T0801,
T0836, T0571, T0622, T0635, T0654, T0655, T0658, T0665, T0672, T0679,
T0699, T0703, T0704, T0732, T0741, T0742, T0747, T0764, T0787, T0791,
T0795, T0813, T0823
K0001, K0002, K0003, K0004, K0005, K0006, K0036, K0108, K0109, K0347,
K0349, K0350, K0352, K0362, K0377, K0379, K0392, K0395, K0399, K0400,
K0403, K0408, K0411, K0414, K0417, K0422, K0431, K0432, K0435, K0436,
K0444, K0445, K0446, K0455, K0464, K0465, K0471, K0480, K0494, K0497,
K0499, K0501, K0502, K0504, K0506, K0507, K0508, K0511, K0512, K0514,
K0516, K0518, K0519, K0525, K0534, K0538, K0556, K0560, K0561, K0565
K0566, K0572, K0576, K0582, K0585, K0586, K0589, K0590, K0593, K0594,
K0597, K0598, K0599, K0603, K0610, K0612, K0614
S0218, S0249, S0296, S0297, S0176, S0185, S0186, S0213, S0250, S0273, S0309,
S0312, S0322, S0333, S0209, S0326, S0349, S0360
A0013, A0066, A0070, A0089, A0085, A0082, A0074, A0067, A0068, A0077,
A0081, A0090, A0094, A0096, A0098, A0105

Partner Integration Planner
CO-OPL-003
Cyber Operational Planning (OPL)
Collect and Operate (CO)Works to advance cooperation across organizational or national borders between
cyber operations partners. Aids the integration of partner cyber teams by providing
guidance, resources, and collaboration to develop best practices and facilitateorganizational support for achieving objectives in integrated cyber actions.
T0581, T0582, T0627, T0670, T0739, T0763, T0772, T0836, T0571, T0635,
T0665, T0699, T0732, T0747, T0764, T0787, T0795, T0823, T0601, T0760,
T0784, T0629, T0666, T0669, T0671, T0700, T0712, T0729, T0759, T0766,
T0817, T0818, T0825, T0826
K0001, K0002, K0003, K0004, K0005, K0006, K0108, K0109, K0431, K0417,
K0444, K0395, K0435, K0392, K0377, K0362, K0436, K0379, K0403, K0465,
K0507, K0598, K0511, K0414, K0350, K0400, K0408, K0411, K0422, K0432,
K0455, K0499, K0501, K0504, K0506, K0508, K0512, K0514, K0538, K0585,
K0599
S0218, S0249, S0296, S0297, S0185, S0186, S0213, S0250, S0326, S0360
A0013, A0066, A0070, A0089, A0085, A0082, A0074, A0067, A0068, A0077,
A0081, A0090, A0094, A0096, A0098, A0105

119

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

Knowledge
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

SkillsAbilities

NICE FRAMEWORKCyber Operator
CO-OPS-001
Cyber Operations (OPS)Collect and Operate (CO)Conducts collection, processing, and/or geolocation of systems to exploit, locate,and/or track targets of interest. Performs network navigation, tactical forensic
analysis, and, when directed, executing on-net operations.
T0566, T0567, T0598, T0609, T0610, T0612, T0616, T0618, T0619, T0620,
T0623, T0643, T0644, T0664, T0677, T0696, T0697, T0724, T0740, T0756,
T0768, T0774, T0796, T0804, T0828, T0829
K0001, K0002, K0003, K0004, K0005, K0006, K0009, K0021, K0051, K0109,
K0142, K0224, K0363, K0372, K0373, K0375, K0379, K0403, K0406, K0420,
K0423, K0428, K0427, K0429, K0430, K0433, K0438, K0440, K0452, K0468,
K0481, K0485, K0486, K0480, K0516, K0528, K0530, K0531, K0536, K0560,
K0565, K0573, K0608, K0609
S0062, S0183, S0236, S0182, S0190, S0192, S0202, S0206, S0221, S0242, S0243,
S0252, S0255, S0257, S0266, S0267, S0270, S0275, S0276, S0281, S0282, S0293,
S0295, S0298, S0299, S0363
A0095, A0097, A0099, A0100

120

NIST SP 800-181

B.7

Investigate (IN)Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks
Knowledge

SkillsAbilities

NICE FRAMEWORKCyber Crime Investigator
IN-INV-001
Cyber Investigation (INV)
Investigate (IN)Identifies, collects, examines, and preserves evidence using controlled anddocumented analytical and investigative techniques.
[Note: Several of these activities may only to be conducted by personnel with a
Law Enforcement or Counter Intelligence Authority.]
T0031, T0059, T0096, T0103, T0104, T0110, T0112, T0113, T0114, T0120,
T0193, T0225, T0241, T0343, T0346, T0360, T0386, T0423, T0430, T0433,
T0453, T0471, T0479, T0523
K0001, K0002, K0003, K0004, K0005, K0006, K0046, K0070, K0107, K0110,
K0114, K0118, K0123, K0125, K0128, K0144, K0155, K0156, K0168, K0209,
K0231, K0244, K0251, K0351, K0624
S0047, S0068, S0072, S0086
A0174, A0175

Law Enforcement/Counterintelligence Forensics Analyst
IN-FOR-001
Digital Forensics (FOR)
Investigate (IN)
Conducts deep-dive investigations on computer-based crimes establishingdocumentary or physical evidence, to include digital media and logs associatedwith cyber intrusion incidents.
T0059, T0096, T0220, T0308, T0398, T0419, T0401, T0403, T0411, T0425
K0001, K0002, K0003, K0004, K0005, K0006, K0017, K0021, K0042, K0060,
K0070, K0077, K0078, K0107, K0109, K0117, K0118, K0119, K0122, K0123,
K0125, K0128, K0131, K0132, K0133, K0134, K0145, K0155, K0156, K0167,
K0168, K0179, K0182, K0183, K0184, K0185, K0186, K0187, K0188, K0189,
K0305, K0624
S0032, S0046, S0047, S0062, S0065, S0067, S0068, S0069, S0071, S0073, S0074,
S0075, S0087, S0088, S0089, S0090, S0091, S0092, S0093
A0005, A0175

121

NIST SP 800-181

Work Role NameWork Role ID
Specialty Area
Category
Work Role
Description
Tasks

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Knowledge

SkillsAbilities

NICE FRAMEWORKCyber Defense Forensics Analyst
IN-FOR-002
Digital Forensics (FOR)
Investigate (IN)
Analyzes digital evidence and investigates computer security incidents to deriveuseful information in support of system/network vulnerability mitigation.
T0027, T0036, T0048, T0049, T0075, T0087, T0103, T0113, T0165, T0167,
T0168, T0172, T0173, T0175, T0179, T0182, T0190, T0212, T0216, T0238,
T0240, T0241, T0253, T0279, T0285, T0286, T0287, T0288, T0289, T0312,
T0396, T0397, T0398, T0399, T0400, T0401, T0432, T0532, T0546
K0001, K0002, K0003, K0004, K0005, K0006, K0018, K0021, K0042, K0060,
K0070, K0077, K0078, K0109, K0117, K0118, K0119, K0122, K0123, K0125,
K0128, K0131, K0132, K0133, K0134, K0145, K0155, K0156, K0167, K0168,
K0179, K0182, K0183, K0184, K0185, K0186, K0187, K0188, K0189, K0224,
K0254, K0255, K0301, K0304, K0347, K0624
S0032, S0047, S0062, S0065, S0067, S0068, S0069, S0071, S0073, S0074, S0075,
S0087, S0088, S0089, S0090, S0091, S0092, S0093, S0131, S0132, S0133, S0156
A0005, A0043

122

NIST SP 800-181

NICE FRAMEWORKAppendix C – Workforce Development Tools
C.1

DHS Cybersecurity Workforce Development Toolkit

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

The DHS Cybersecurity Workforce Development Toolkit (CWDT) [8] helps any organization
understand its cybersecurity workforce and staffing needs to protect its information, customers,
and networks. This toolkit includes cybersecurity career path templates and recruitment
resources to recruit and retain top cybersecurity talent. The CWDT provides tools to help
understand an organization’s cybersecurity workforce risks and take inventory of anorganization’s workforce. CWDT tools leverage the specialty areas and KSAs and Tasks in the
NICE Framework. CWDT notes that the first step in preparing to build a cybersecurity
workforce is a shared vision for organizing one’s cybersecurity workforce. Having a sharedvision supports leaders as they respond to changing environments and provides data to better
adjust resources, see patterns of work, and highlight areas of potential risk. This understanding is
especially important in the ever-changing environment of cybersecurity. The CWDT includes a
Cybersecurity Workforce Planning Capability Maturity Model (CMM), a self-assessment tool tohelp an organization to evaluate the maturity of its cybersecurity workforce planning capability.
The (CWDT) offers profiles as a guide to focus on retaining staff at every level whether entrylevel, mid-career, or seasoned cybersecurity professionals.
C.1.1

Proficiency Levels and Career Paths

Developing and sharing career paths with employees will help them identify their proficiency
levels and advance in cybersecurity career paths.
The CWDT includes a three-step process to develop cybersecurity career paths for one’sorganization.
•
•
•
C.2

Step 1 – Familiarize yourself with proficiency levels and review sample career paths.
Step 2 – Use a CWDT template to create custom cybersecurity-specific career paths foryour organization filling in “Suggested Experience & Credentials,” “Competencies andSample Skills / KSAs,” and “Suggested Training & Development Activities.”
Step 3 – Share career paths with cybersecurity managers and staff.
Baldrige Cybersecurity Excellence Builder Tool

Once an organization has determined its cybersecurity requirements (such as through acybersecurity audit or an internal self-assessment), it can reference the NICE Framework to
identify the work roles and tasks that will help fulfill those requirements. While general terms,
such as “cyber professionals,” have historically been used to measure needs, the specificity
provided by the NICE Framework provides a better approach to describe the dozens of discrete
job functions needed. By identifying the required and available competencies, and by identifying
gaps between required and available skills, the organization can identify critical needs. The
NICE Framework helps an organization to answer the following questions, drawn from theBaldrige Cybersecurity Excellence Builder Tool [9], regarding maintenance of an effective andsupportive workforce environment to achieve its cybersecurity goals:
123

NIST SP 800-181•••

NICE FRAMEWORKHow do you assess your workforce capability and capacity needs related tocybersecurity?
How do you organize and manage your cybersecurity workforce to establish roles andresponsibilities?
How do you prepare your workforce for changing cybersecurity capability and capacity
needs?

As more organizations assess their cybersecurity workforce, the common lexicon in the NICE
Framework enables capacity and capability assessment across multiple organizations, industry
sectors, and regions.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

C.3

Position Description Drafting Tool

The DHS Cyberskills Management Support Initiative PushbuttonPD Tool [10] allows managers,
supervisors, and HR specialists to rapidly draft a federal employee position description (PD)without the need for extensive training or prior knowledge of position classification. It is
designed to present language from multiple, mission-critical authoritative sources and standards
for duties, tasks, and KSAs, rapidly capture the hiring official’s requirements, and present themin a robust hiring package that can be easily integrated into existing agency HR processes. Anyorganization can experiment with the PushbuttonPD Tool to see how it pulls NICE Frameworkmaterial into a job description.

124

NIST SP 800-181

NICE FRAMEWORKAppendix D – Cross Reference to Guidance and Guideline Documents

NICE Strategic Goal #3 Guide Career Development and Workforce Planning aims to support
employers to address market demands and enhance recruitment, hiring, development, andretention of cybersecurity talent. One objective within this strategic goal is to publish and raiseawareness of the NICE Framework and encourage adoption. Adoption in this case means that the
NICE Framework is used as a reference resource for actions related to cybersecurity workforce,training, and education.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

One way to encourage adoption of the NICE Framework is to push authors of cybersecurity
guidance or guideline documents to cross reference some of the content of those documents tocomponents in the NICE Framework. Appendix D includes examples of publication crossreferencing that could encourage adoption of the NICE Framework.
D.1

Cybersecurity Framework

In 2014, NIST released the Framework for Improving Critical Infrastructure Cybersecurity [11],commonly referred to as the Cybersecurity Framework. Developed in response to Executive
Order (EO) 13636 [12], the Cybersecurity Framework provides a performance-based and costeffective approach to help organizations to identify, assess, and manage cybersecurity risk. It was
built through a series of public workshops that were convened by NIST to better understand whatstandards and methodologies are helpful for achieving effective risk management, and how
voluntary existing good practices might be implemented to improve cybersecurity.
A companion document to the Cybersecurity Framework, the NIST Roadmap for Improving
Critical Infrastructure Cybersecurity [13] points to the need for a skilled cybersecurity
workforce to meet the unique cybersecurity needs of critical infrastructure. It recognizes that, as
the cybersecurity threat and technology environments evolve, the workforce must continue toadapt to design, develop, implement, maintain, and continuously improve the necessary
cybersecurity practices.
The Cybersecurity Framework consists of three parts: Framework Core, Framework
Implementation Tiers, and Framework Profiles. Each Cybersecurity Framework component
reinforces the connection between business drivers and cybersecurity activities. The Framework
Core elements work together as follows:•

Functions organize basic cybersecurity activities at their highest level. These Functions Identify, Protect, Detect, Respond, and Recover - are described in detail below.

•

Categories are the subdivisions of a Function into groups of cybersecurity outcomesclosely tied to programmatic needs and activities.

•

Subcategories further divide a Category into specific outcomes of technical and/or
management activities. They provide a set of results that, while not exhaustive, helps to
support achievement of the outcomes in each Category.

•

Informative References are specific sections of standards, guidelines, and practices
common among critical infrastructure sectors that illustrate a method to achieve the125

NIST SP 800-181

NICE FRAMEWORK

outcomes associated with each Subcategory. The Informative References presented in the
Framework Core are illustrative and not exhaustive. They represent the cross-sector
guidance most frequently referenced during the Framework development process.
The Core Functions each contribute to a high-level understanding of the cybersecurity needs ofthe organization:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181•

Identify (ID) – Develop the organizational understanding to manage cybersecurity risk tosystems, assets, data, and capabilities.

•

Protect (PR) – Develop and implement the appropriate safeguards to ensure delivery ofcritical infrastructure services.

•

Detect (DE) – Develop and implement the appropriate activities to identify theoccurrence of a cybersecurity event.

•

Respond (RS) – Develop and implement the appropriate activities to take action
regarding a detected cybersecurity event.

•

Recover (RC) – Develop and implement the appropriate activities to maintain plans forresilience and to restore any capabilities or services that were impaired due to acybersecurity event.

In many ways, these Functions correlate to the NICE Framework Categories. Table 8 describes
the relationships among the Cybersecurity Framework Functions and NICE Framework
Categories.

126

NIST SP 800-181

NICE FRAMEWORKTable 8 - Crosswalk of NICE Framework Workforce Categories to Cybersecurity Framework
Functions
NICE Framework
Category

Category Description

Securely Provision(SP)

Conceptualizes, designs, and/or builds
secure information technology (IT) systems,with responsibility for aspects of system
and/or network development.
Provides the support, administration, andmaintenance necessary to ensure effective
and efficient information technology (IT)system performance and security.
Provides leadership, management, direction,
or development and advocacy so that theorganization may effectively conduct
cybersecurity work.
Identifies, analyzes, and mitigates threats tointernal information technology (IT) systems
and/or networks.
Performs highly-specialized review andevaluation of incoming cybersecurity
information to determine its usefulness forintelligence.
Provides specialized denial and deception
operations and collection of cybersecurity
information that may be used to develop
intelligence.
Investigates cybersecurity events or crimes
related to information technology (IT)systems, networks, and digital evidence.

Operate andMaintain (OM)
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Oversee and Govern(OV)

Protect and Defend(PR)
Analyze (AN)Collect and Operate(CO)

Investigate (IN)

D.1.2

Related Cybersecurity
Framework Function(s)Identify (ID), Protect (PR)Protect (PR), Detect (DE)Identify (ID), Protect (PR),
Detect (DE), Recover (RC)Protect (PR), Detect (DE),Respond (RS)
Identify (ID), Detect (DE),Respond (RS)

Detect (DE), Protect (PR),Respond (RS)

Detect (DE), Respond (RS),Recover (RC)

Example Integration of Cybersecurity Framework with NICE Framework

While the Cybersecurity Framework and the NICE Framework were developed separately, eachcomplements the other by describing a hierarchical approach to achieving cybersecurity goals.
Consider the following example:
Cybersecurity Framework’s Respond Function includes a Mitigation (RS.MI) Category. The
Category includes a Subcategory, RS.MI-2, pointing to an outcome of, “Incidents are
mitigated.” While Cybersecurity Framework describes this outcome, and provides several
informative references regarding the security controls to achieve it, Cybersecurity Framework
does not provide any informative guidance regarding who should be responsible for attaining theoutcome, or what KSAs would apply.

127

NIST SP 800-181

NICE FRAMEWORK

Reviewing the NICE Framework, we identify the Cybersecurity Defense Incident Responder(PR-IR-001) role in the Protect and Defend (PR) category, Incident Response (IR) specialty
area. We can review the description of this role to ensure that it aligns with the Cybersecurity
Framework RS.MI-2 outcome:Responds to disruptions within the pertinent domain to mitigate immediate andpotential threats. Uses mitigation, preparedness, and response and recovery approaches
to maximize survival of life, preservation of property, and information security.
Investigates and analyzes relevant response activities and evaluates the effectivenessof and improvements to existing practices.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Investigates, analyzes, and responds to cybersecurity incidents within the network
environment or enclave.
We learn from Appendix A of this document that the person whose position includes this workrole might be expected to perform many of the following Tasks, which align with the desired
Cybersecurity Framework outcome:•T0041 - Coordinate and provide expert technical support to enterprise-wide cybersecurity
defense technicians to resolve cybersecurity defense incidents.

•

T0047 - Correlate incident data to identify specific vulnerabilities and makerecommendations that enable expeditious remediation.

•

T0161 - Perform analysis of log files from a variety of sources (e.g., individual host logs,
network traffic logs, firewall logs, and intrusion detection system [IDS] logs) to identify
possible threats to network security.

•

T0163 - Perform cybersecurity defense incident triage, to include determining scope,urgency, and potential impact; identify the specific vulnerability; and makerecommendations that enable expeditious remediation.

•

T0170 - Perform initial, forensically sound collection of images and inspect to discern
possible mitigation/remediation on enterprise systems.

•

T0175 - Perform real-time cybersecurity defense incident handling (e.g., forensic
collections, intrusion correlation and tracking, threat analysis, and direct system
remediation) tasks to support deployable Incident Response Teams (IRTs).

•

T0214 - Receive and analyze network alerts from various sources within the enterpriseand determine possible causes of such alerts.

•

T0233 - Track and document cybersecurity defense incidents from initial detection
through final resolution.

•

T0246 - Write and publish cybersecurity defense techniques, guidance, and reports on
incident findings to appropriate constituencies.

•

T0262 - Employ approved defense-in-depth principles and practices (e.g., defense-inmultiple places, layered defenses, security robustness).

128

NIST SP 800-181

NICE FRAMEWORKThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181•

T0278 - Collect intrusion artifacts (e.g., source code, malware, Trojans) and use
discovered data to enable mitigation of potential cybersecurity defense incidents within
the enterprise.

•

T0279 - Serve as technical expert and liaison to law enforcement personnel and explain
incident details as required.

•

T0312 - Coordinate with intelligence analysts to correlate threat assessment data.

•

T0164 - Perform cybersecurity defense trend analysis and reporting.

•T0395 - Write and publish after-action reviews.

•

T0503 - Monitor external data sources (e.g., cybersecurity defense vendor sites,
Computer Emergency Response Teams, Security Focus) to maintain the currency of
cybersecurity defense threat condition and determine which security issues may have an
impact on the enterprise.

•

T0510 - Coordinate incident response functions.

Furthermore, from Appendix B, we can learn the broad range of KSAs that might be needed by aperson whose cybersecurity position includes this work role.
Armed with this information, an organization seeking to achieve the outcome described by
Cybersecurity Framework
RS.MI-2 may determine whether one or more existing staff have the necessary skills to complete
the tasks described. If one or more KSAs are lacking, the employee desiring to fill that work role
will know specifically what areas need improvement and can seek academic classes or industry
training to gain the necessary knowledge. If no such staff are found, the employer has specific
Task descriptions and KSA requirements that may be advertised in a job posting, or that may be
used for contractor staff to augment existing personnel.
D.2

Systems Security Engineering

NIST Special Publication (SP) 800-160, Systems Security Engineering - Considerations for a
Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems [14], addresses
the engineering-driven actions necessary to develop more defensible and survivable systems—
including the components that compose those systems and the services that depend on them. It
starts with and builds upon a set of well-established International Standards for systems andsoftware engineering, and infuses systems security engineering techniques, methods, andpractices into those systems and software engineering activities. The ultimate objective is toaddress security issues from a stakeholder requirements and protection needs perspective, and touse established engineering processes to ensure that such requirements and needs are addressedwith the appropriate fidelity and rigor across the entire life cycle of the system. Increasing thetrustworthiness of systems is a significant undertaking that requires a substantial investment in
the requirements, architecture, design, and development of systems, components, applications,and networks—and a fundamental cultural change to the current “business as usual” approach.
Introducing a disciplined, structured, and standards-based set of systems security engineering
activities and tasks provides an important starting point and forcing function to initiate needed
129

NIST SP 800-181

NICE FRAMEWORK

change. The ultimate objective is to obtain trustworthy secure systems that are fully capable ofsupporting critical missions and business operations while protecting stakeholder assets, and to
do so with a level of assurance that is consistent with the risk tolerance of those stakeholders.
Mapping components of the NICE Framework to the specialty discipline described in NIST SP
800-160 will validate those components. Practitioners of the system security engineering
specialty discipline will likely become subject matter experts who can justify additional KSAs
and tasks to be added to the NICE Framework.
D.3

U.S. Office of Personnel Management Federal Cybersecurity Codes

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

On January 4, 2017, the U.S. Office of Personnel Management (OPM) issued a memorandum[15] titled “Guidance for federal agencies assigning new cybersecurity codes to positions withinformation technology, cybersecurity, and cyber-related functions”. The memorandum notesthat the Federal Cybersecurity Workforce Assessment Act of 2015 [16] requires OPM toestablish procedures to implement the NICE coding structure and to identify all Federal civilian
positions that require the performance of information technology, cybersecurity, or other cyberrelated functions. Table 9 shows the mapping of NICE Framework Work Role IDs which
represent the interdisciplinary nature of cybersecurity work to OPM cybersecurity codes which
are compatible with the OPM Enterprise Human Resources Integration system.

130

NIST SP 800-181

NICE FRAMEWORKTable 9 – Crosswalk of Work Role IDs to OPM Cybersecurity Codes

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

Work Role ID

OPM
Code

Work Role ID

OPM
Code

Work Role ID

OPM
Code

SP-RSK-001

611

OV-LGA-001

731

AN-TWA-001

141

SP-RSK-002

612

OV-LGA-002

732

AN-EXP-001

121

SP-DEV-001

621

OV-TEA-001

711

AN-ASA-001

111

SP-DEV-002

622

OV-TEA-002

712

AN-ASA-002

112

SP-ARC-001

651

OV-MGT-001

722

AN-TGT-001

131

SP-ARC-002

652

OV-MGT-002

723

AN-TGT-002

132

SP-TRD-001

661

OV-SPP-001

751

AN-LNG-001

151

SP-SRP-001

641

OV-SPP-002

752

CO-CLO-001

311

SP-TST-001

671

OV-EXL-001

901

CO-CLO-002

312

SP-SYS-001

631

OV-PMA-001

801

CO-OPL-001

331

SP-SYS-002

632

OV-PMA-002

802

CO-OPL-002

332

OM-DTA-001

421

OV-PMA-003

803

CO-OPL-003

333

OM-DTA-002

422

OV-PMA-004

804

CO-OPS-001

321

OM-KMG-001

431

OV-PMA-005

805

IN-INV-001

221

OM-STS-001

411

PR-CDA-001

511

IN-FOR-001

211

OM-NET-001

441

PR-INF-001

521

IN-FOR-002

212

OM-ADM-001

451

PR-CIR-001

531

OM-ANA-001

461

PR-VAM-001

541

131

NIST SP 800-181

NICE FRAMEWORKAppendix E – Acronyms

Selected acronyms and abbreviations used in this paper are defined below:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

API
CDM
CDS
CIO
CKMS
CMMI
CMS
CNSSI
COMSEC
COTR
DNS
EISA
FISMA
FOIA
HR
IDS
IP
IPS
IR
IRT
ISD
ITL
KSA
LAN
NICE
OLA
OMB
OPM
OS
OSI
P.L.
PCI
PHI
PIA
PII
PKI
R&D
RFID
RMF
SA&A
SDLC
SLA
SOP

Application programming interface
Continuous Diagnostics and Mitigation
Cross-Domain Solutions
Chief Information Officer
Crypto Key Management System
Capability Maturity Model Integration
Content Management System
Committee on National Security Systems Instruction
Communications Security
Contracting Officer's Technical Representative
Domain Name System
Enterprise Information Security Architecture
Federal Information Security Modernization Act
Freedom of Information Act
Human Resource
Intrusion detection system
Internet Protocol
Intrusion Prevention System
Incident Response
Incident Response Teams
Instructional System Design
Information Technology Laboratory
Knowledge, Skills, and Abilities
Local area network
National Initiative for Cybersecurity Education
Operating-Level Agreement
Office of Management and Budget
Office of Personnel Management
Operating system
Open System Interconnection
Public Law
Payment Card Industry
Personal Health Information
Privacy Impact Assessments
Personally Identifiable Information
Public key infrastructure
Research and Design
Radio Frequency Identification
Risk Management Framework
Security Assessment and Authorization
System development life cycle
Service-Level Agreements
Standard operating procedures
132

NIST SP 800-181

SQL
TCP
TTP
URL
VPN
WAN

NICE FRAMEWORKStructured query language
Transmission Control Protocol
Tactics, techniques, and procedures
Uniform Resource Locator
Virtual Private Network
Wide Area Network

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181

133

NIST SP 800-181

NICE FRAMEWORKAppendix F– References

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181[1]

NICE Framework Revision webpage, National Institute of Standards and Technology[Website], https://www.nist.gov/itl/applied-cybersecurity/nice/nice-cybersecurityworkforce-framework-revisions[2]

National Initiative for Cybersecurity Education, National Cybersecurity Workforce
Framework, ver. 1.0, https://www.nist.gov/file/359276[3]

National Initiative for Cybersecurity Education, National Cybersecurity Workforce
Framework, ver. 2.0, https://www.nist.gov/file/359261[4]

Reference Spreadsheet for NIST Special Publication 800-181
https://www.nist.gov/file/372581[5]

NICE Framework, National Institute of Standards and Technology [Website], https://www.nist.gov/itl/applied-cybersecurity/nice/resources/nice-cybersecurity-workforceframework[6]

U.S. Department of Labor, Employment and Training Administration (ETA)[Website]. https://www.doleta.gov[7]Competency Model Clearinghouse, Cybersecurity Competency Model,
https://www.careeronestop.org/competencymodel/competencymodels/cybersecurity.aspx[8]

U.S. Department of Homeland Security, Cybersecurity Workforce Development
Toolkit (CWDT), https://niccs.us-cert.gov/workforce-development/cybersecurityworkforce-development-toolkit[9]Baldrige Cybersecurity Excellence Program, National Institute of Standards andTechnology [Website], https://www.nist.gov/baldrige/products-services/baldrigecybersecurity-initiative[10]

U.S. Department of Homeland Security, CMSI PushButtonPD™ Tool Website,
https://niccs.us-cert.gov/workforce-development/dhs-cmsi-pushbuttonpd-tool[11]

Framework for Improving Critical Infrastructure Cybersecurity Version 1.0, National
Institute of Standards and Technology February 12, 2014,
https://www.nist.gov/sites/default/files/documents/cyberframework/cybersecurityframework-021214.pdf[12]

Executive Order no. 13636, Improving Critical Infrastructure Cybersecurity,
DCPD-201300091, February 12, 2013. http://www.gpo.gov/fdsys/pkg/FR-2013-0219/pdf/2013-03915.pdf[13]

NIST Roadmap for Improving Critical Infrastructure Cybersecurity, National Instituteof Standards and Technology, February 12, 2014,
https://www.nist.gov/sites/default/files/documents/cyberframework/
roadmap-021214.pdf

134

NIST SP 800-181

NICE FRAMEWORKThis publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181[14]

NIST Special Publication (SP) 800-160, Systems Security Engineering Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy
Secure Systems, National Institute of Standards and Technology, November 2016,
https://doi.org/10.6028/NIST.SP.800-160[15]Memorandum on Guidance for Assigning New Cybersecurity Codes to Positions
with Information Technology, Cybersecurity, and Cyber-Related Functions, January
2017, https://www.chcoc.gov/content/guidance-assigning-new-cybersecurity-codespositions-information-technology-cybersecurity[16]

H.R.2029 - Consolidated Appropriations Act, 2016 which contains Division NCybersecurity Act of 2015, https://www.congress.gov/114/plaws/publ113/PLAW114publ113.pdf

135