NIST Special Publication 800-181
Revision 1

Workforce Framework
for Cybersecurity(NICE Framework)
Rodney Petersen
Danielle Santos
Matthew C. Smith
Karen A. Wetzel
Greg Witte

This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-181r1

NIST Special Publication 800-181
Revision 1

Workforce Framework
for Cybersecurity(NICE Framework)
Rodney Petersen (Director)
Danielle Santos (Manager of Communications and Operations)
Karen A. Wetzel (Manager of the NICE Framework)
National Initiative for Cybersecurity Education (NICE)
Applied Cybersecurity Division
Information Technology Laboratory
Matthew C. Smith
Greg Witte
Huntington Ingalls Industries
Annapolis Junction, MD
This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-181r1
November 2020

U.S. Department of Commerce

Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology
Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

Authority
This publication has been developed by NIST in accordance with its statutory responsibilities under theFederal Information Security Modernization Act (FISMA) of 2014, 44 U.S.C. § 3551 et seq., Public Law(P.L.) 113-283. NIST is responsible for developing information security standards and guidelines, including
minimum requirements for federal information systems, but such standards and guidelines shall not apply
to national security systems without the express approval of appropriate federal officials exercising policy
authority over such systems. This guideline is consistent with the requirements of the Office of Management
and Budget (OMB) Circular A-130.
Nothing in this publication should be taken to contradict the standards and guidelines made mandatory andbinding on federal agencies by the Secretary of Commerce under statutory authority. Nor should theseguidelines be interpreted as altering or superseding the existing authorities of the Secretary of Commerce,
Director of the OMB, or any other federal official. This publication may be used by nongovernmentalorganizations on a voluntary basis and is not subject to copyright in the United States. Attribution would,
however, be appreciated by NIST.
National Institute of Standards and Technology Special Publication 800-181
Natl. Inst. Stand. Technol. Spec. Publ. 800-181 Rev. 1, 27 pages (November 2020)
CODEN: NSPUE2This publication is available free of charge from:https://doi.org/10.6028/NIST.SP.800-181r1
Certain commercial entities, equipment, or materials may be identified in this document in order to describe an
experimental procedure or concept adequately. Such identification is not intended to imply recommendation or
endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best
available for the purpose.
There may be references in this publication to other publications currently under development by NIST in accordancewith its assigned statutory responsibilities. The information in this publication, including concepts and methodologies,
may be used by federal agencies even before the completion of such companion publications. Thus, until eachpublication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For
planning and transition purposes, federal agencies may wish to closely follow the development of these new
publications by NIST.
Organizations are encouraged to review all draft publications during public comment periods and provide feedback to
NIST. Many NIST cybersecurity publications, other than the ones noted above, are available athttps://csrc.nist.gov/publications.

Comments on this publication may be submitted to:
National Institute of Standards and Technology
Attn: Applied Cybersecurity Division, Information Technology Laboratory
100 Bureau Drive (Mail Stop 2000) Gaithersburg, MD 20899-2000
Email: NICEFramework@nist.gov

All comments are subject to release under the Freedom of Information Act (FOIA).

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Reports on Computer Systems Technology

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

The Information Technology Laboratory (ITL) at the National Institute of Standards andTechnology (NIST) promotes the U.S. economy and public welfare by providing technicalleadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test
methods, reference data, proof of concept implementations, and technical analyses to advance thedevelopment and productive use of information technology. ITL’s responsibilities include thedevelopment of management, administrative, technical, and physical standards and guidelines forthe cost-effective security and privacy of other than national security-related information in federal
information systems. The Special Publication 800-series reports on ITL’s research, guidelines, andoutreach efforts in information system security, and its collaborative activities with industry,
government, and academic organizations.
Abstract
This publication from the National Initiative for Cybersecurity Education (NICE) describes theWorkforce Framework for Cybersecurity (NICE Framework), a fundamental reference fordescribing and sharing information about cybersecurity work. It expresses that work as Task
statements and describes Knowledge and Skill statements that provide a foundation for learners
including students, job seekers, and employees. The use of these statements helps students todevelop skills, job seekers to demonstrate competencies, and employees to accomplish tasks. As
a common, consistent lexicon that categorizes and describes cybersecurity work, the NICE
Framework improves communication about how to identify, recruit, develop, and retain
cybersecurity talent. The NICE Framework is a reference source from which organizations or
sectors can develop additional publications or tools that meet their needs to define or provide
guidance on different aspects of cybersecurity education, training, and workforce development.
Keywords
Competency; cybersecurity; cyberspace; education; knowledge; role; security; skill; task; team;training; workforce; work role.

ii

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)Patent Disclosure Notice
NOTICE: The Information Technology Laboratory (ITL) has requested that holders of patent claims
whose use may be required for compliance with the guidance or requirements of this publication
disclose such patent claims to ITL. However, holders of patents are not obligated to respond to ITL
calls for patents and ITL has not undertaken a patent search in order to identify which, if any,
patents may apply to this publication.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

As of the date of publication and following call(s) for the identification of patent claims whose use
may be required for compliance with the guidance or requirements of this publication, no suchpatent claims have been identified to ITL.
No representation is made or implied by ITL that licenses are not required to avoid patent
infringement in the use of this publication.

Document Conventions
The terms “shall” and “shall not” indicate requirements to be followed strictly in order toconform to the publication and from which no deviation is permitted. The terms “should” and“should not” indicate that among several possibilities one is recommended as particularly
suitable, without mentioning or excluding others, or that a certain course of action is preferred
but not necessarily required, or that (in the negative form) a certain possibility or course of action
is discouraged but not prohibited. The terms “may” and “need not” indicate a course of action
permissible within the limits of the publication. The terms “can” and “cannot” indicate apossibility and capability, whether material, physical or causal.
Throughout the NICE Framework, those performing cybersecurity work—including students,
job seekers, and employees—are referenced as Learners. This moniker highlights that eachmember of the workforce is also a lifelong learner.

iii

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Acknowledgments
The NICE Framework was developed by a Core Authoring Team that includes representatives
from numerous departments and agencies in the United States federal government. The National
Institute of Standards and Technology wishes to acknowledge and thank these team members
whose dedicated efforts contributed significantly to the publication:

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

William Newhouse, National Institute of Standards and Technology
Pam Frugoli, Department of Labor
Lisa Dorr, Department of Homeland Security
Kenneth Vrooman, Cybersecurity and Infrastructure Security Agency
Bobbie Sanders, Department of Defense
Patrick Johnson, Department of Defense
Matt Isnor, Department of Defense
Stephanie Shively, Department of Defense
Ryan Farr, Department of Defense
The authors and the Core Authoring Team gratefully acknowledge and appreciate the significant
contributions from individuals and organizations in the public and private sectors whosethoughtful and constructive comments improved the overall quality, thoroughness, andusefulness of this publication. The authors particularly appreciate the many helpful responses to
the NICE Framework Request for Comments and to the public comment draft of this publication.
Additionally, the team appreciates and acknowledges the contributions of those who establishedprevious editions of national cybersecurity workforce frameworks as described at the History
page of the NICE Framework Resource Center. [1]iv

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Note to Readers
Welcome to the National Initiative for Cybersecurity Education (NICE) Workforce Framework
for Cybersecurity (NICE Framework), Revision 1. The NICE Program Office staff have received
significant feedback from the community, including many responses to a recent request for
general comments regarding the NICE Framework and also responses to the public draft of thispublication. In light of that feedback and the fast-paced and connected ecosystem ofcybersecurity, the authoring team decided to adopt and promote attributes of agility, flexibility,interoperability, and modularity. These attributes led to a refactoring of the NICE Framework toprovide a streamlined approach for developing a workforce to manage cybersecurity risk. Below
is a summary of changes:
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1● Organizing constructs in Revision 1 have been simplified by deprecating Categories (e.g.,securely provision, oversee and govern, protect and defend, analyze, etc.) and Specialty
Areas (e.g., incident response, threat analysis, cybersecurity management, etc.). In order
to simplify an approach that offers agility, flexibility, interoperability, and modularity fororganizations, Revision 1 presents a streamlined set of “building blocks” comprised ofTasks, Knowledge, and Skills. Organizations that find value in the former Categories andSpecialty Areas can continue to use them or create teams around those concepts and alignthem with this version of the NICE Framework (see Section 3.4).
● Revision 1 describes several uses of Tasks, Knowledge, and Skills, including methods ofapplying those in the creation of Work Roles. Users of the Work Roles described in theoriginal NIST SP 800-181 may continue to use those; updates to those may be publishedby NICE in the future. [2]The relationships among Tasks, Knowledge, Skills, and Abilities have changed. Skill and Ability
statements from the previous version have been refactored for simplicity into Skill statements,
which focus on the action of the learner. This revision describes methods for associating
Knowledge and Skill statements with Task statements for various outcomes. The lists of Tasks,
Knowledge, Skills, and Work Roles that were previously available in Appendices A and B of the2017 Framework have been removed from this version in order to simplify the maintenance of
the NICE Framework and to ease updates to those lists. The Task, Knowledge, and Skills (TKS)
statements and corresponding Competencies and Work Roles will be maintained as separate
artifacts and will be subject to ongoing review and updates with a defined change process andindication of version control to manage and communicate changes. Until those updates occur, theearlier versions of these lists will remain available to users in the NICE Framework Resource
Center. In support of interoperability and modularity, future updates will ensure that thestatements match the final definitions of TKS statements noted here.
● For readers interested in mapping standards, references, or resources to the NICE
Framework, NICE is working with the Online Informative Reference (OLIR) Program todevelop templates for these mappings. The OLIR Program, managed by NIST, provides aprocess for aligning references to NIST documents. Additionally, the program provides acatalog of those references. [3]v

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Executive Summary

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Each of us—individually and organizationally—performs important work that provides acontribution to society. However, as information and technology, including many evolving typesof operational technology, grow increasingly complex and interconnected it can be difficult toclearly describe the work that is being performed or that we desire to accomplish, in these areasin particular. The National Initiative for Cybersecurity Education (NICE) recognizes that those
performing cybersecurity work—including students, job seekers, and employees— are lifelong
learners throughout their efforts to emphasize and address cybersecurity implications across
many domains. This segment of people is referenced in this document both as “Learners” and attimes as the “cybersecurity workforce”, though the latter is not meant to imply that the work
roles and content included in the NICE Framework apply only to those fully embedded in the
cybersecurity domain. The tasks that these learners perform are further referenced here as“cybersecurity work”, and the Framework provides a means to describing that work with
precision to support learner education or training and in the recruitment, hiring, development,
and retention of employees. The NICE Framework has been developed to help provide areference taxonomy—that is, a common language—of the cybersecurity work and of theindividuals who carry out that work. The NICE Framework supports the NICE mission toenergize, promote, and coordinate a robust community working together to advance an integrated
ecosystem of cybersecurity education, training, and workforce development. The NICE
Framework provides a set of building blocks for describing the tasks, knowledge, and skills thatare needed to perform cybersecurity work performed by individuals and teams. Through thesebuilding blocks, the NICE Framework enables organizations to develop their workforces toperform cybersecurity work, and it helps learners to explore cybersecurity work and to engage inappropriate learning activities to develop their knowledge and skills. This development, in turn,benefits employers and employees through the identification of career pathways that document
how to prepare for cybersecurity work using the data of Task, Knowledge, and Skill (TKS)
statements bundled into Work Roles and Competencies.
The use of common terms and language helps to organize and communicate the work to be done
and the attributes of those that are qualified to perform that work. In this way, the NICE
Framework helps to simplify communications and provide focus on the tasks at hand. Finally,use of the NICE Framework improves clarity and consistency at all organizational levels—from
an individual to a technology system to a program, organization, sector, state, or nation.

vi

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Table of Contents
Executive Summary ..................................................................................................... vi
1

Background ............................................................................................................ 1
1.1 Attributes of the NICE Framework .................................................................. 2
1.2 Purpose and Applicability................................................................................ 3
1.3 Audience ......................................................................................................... 3
1.4 Organization of this Publication ...................................................................... 3

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

2

NICE Framework Building Blocks ........................................................................ 4
2.1 Task Statements ............................................................................................. 4
2.2 Knowledge Statements ................................................................................... 5
2.3 Skill Statements .............................................................................................. 5

3

Using the NICE Framework .................................................................................. 6
3.1 Using Existing Task, Knowledge, and Skill (TKS) Statements ........................ 6
3.2 Creating New TKS Statements ....................................................................... 6
3.3 Competencies ................................................................................................. 7
3.3.1 Using Existing Competencies ............................................................... 8
3.3.2 Creating New Competencies ................................................................ 9
3.4 Work Roles ................................................................................................... 11
3.4.1 Using Existing Work Roles ................................................................. 12
3.4.2 Creating a New Work Role ................................................................. 12
3.5 Teams ........................................................................................................... 12
3.5.1 Building Teams with Work Roles ........................................................ 12
3.5.2 Building Teams with Competencies.................................................... 13

4

Conclusion ........................................................................................................... 15

References ................................................................................................................... 16
Acronyms ............................................................................................ 17
Glossary .............................................................................................. 18

vii

NIST SP 800-181 REV. 1

1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Background

Technology continues to evolve at an ever-increasing pace. Specifically, the technology whichfacilitates the ability to access and process information quickly and efficiently is dramaticallychanging. The work required to design, build, secure, and implement these data, networks, andsystems increases in complexity. Furthermore, describing this work and those who can performthe work remains a challenge. Compounding this problem, organizations use varying and selfcreated methods to attempt to solve the challenge.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

This publication from the National Initiative for Cybersecurity Education (NICE) describes theWorkforce Framework for Cybersecurity (NICE Framework). The NICE Framework helps
organizations overcome the barrier of describing their workforce to multiple stakeholders by
presenting a building block approach. Through the use of conceptual building blocks, the NICE
Framework presents a common language for organizations to use internally and with others. Thisapproach allows organizations to tailor and implement the NICE Framework to their uniqueoperating context. Furthermore, by creating a common language, the NICE Framework lowers
the barrier to entry for organizations seeking to enter and interoperate with other organizations.
Figure 1, below, depicts a high-level view of the NICE Framework. The main building blocks of
the NICE Framework are Tasks, Knowledge, and Skills (TKS) statements (explained in Section2) that are shown alongside the concepts they describe. Figure 1 shows that there are two maintypes of concepts being described: “the work” and “the learner.” Notably, those who are (or willbe) performing work (e.g., students, current employees, or job seekers) are continually learningand achieving objectives and can be found in any part of the learning lifecycle. The NICE
Framework attempts to describe both “the work” and “the learner” in generic terms that can beapplied to all organizations.

Figure 1 - NICE Framework Building Blocks Approach

The “work” is what an organization needs to achieve cybersecurity risk management objectives.
Every organization executes common tasks as well as some context-unique tasks. For example,
every organization has some form of management tasks, whereas only some organizations have
1

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

tasks to “deploy bulk energy systems securely.” The NICE Framework provides organizations a
way to describe their work through Task statements that group supporting Knowledge and Skill
statements.
The “learner” is the person who has knowledge and skills. The term learner applies to all people
within the scope of this document. A learner can be a student, job seeker, employee, or otherpeople within the workforce. In an organizational context, learners execute tasks. In an
educational context, learners acquire new knowledge and skills. All individuals are consideredlearners due to education or training they received prior to entering the workforce, ongoingtraining, self-learning, or a career progression plan.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

The NICE Framework provides organizations with a way to describe learners by associating
Knowledge and Skill statements to an individual or group. By using their Knowledge and Skills,
learners can complete Tasks to achieve organizational objectives. While not all organizations
will use every concept pertaining to learners, the NICE Framework provides organizations with aflexible set of building blocks to use as needed by their unique context. The recognition of therole the learner plays in developing capabilities to perform cybersecurity work also reinforces theapplicability of the NICE Framework to education and training providers.
By describing both the work and the learner, the NICE Framework provides organizations acommon language to describe their cybersecurity work and workforce. Parts of the NICE
Framework describe an organizational work context (Tasks), other parts describe a learnercontext (Knowledge and Skill), and finally, the building block approach of the NICE Framework
allows organizations to link the two contexts together.
Furthermore, the NICE Framework provides a mechanism to communicate across organizations
at a peer level, sector level, state level, national level, or international level using the samebuilding blocks. This communication can drive innovative solutions to common challenges,
lower barriers to entry for new organizations and individuals, and facilitate workforce mobility.
1.1

Attributes of the NICE Framework

The NICE Framework is a reference resource for those seeking to describe the cybersecurity
work their organization does, the people who will carry out the work, and the ongoing learningthat will be needed to do that work effectively. The nature of the work, and consequently, theworkforce, can be described using the TKS building blocks presented in the following sections.
These building blocks incorporate the following attributes:● Agility—People, processes, and technology mature and must adapt to change. Therefore,
the NICE Framework enables organizations to keep pace with a constantly evolving
ecosystem.
● Flexibility—While every organization faces similar challenges, there is no one-size-fitsall solution to those common challenges. Therefore, the NICE Framework enables
organizations to account for the organization’s unique operating context.

2

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)● Interoperability—While every solution to common challenges is unique, those solutions
must agree upon consistent use of terms. Therefore, the NICE Framework enables
organizations to exchange workforce information using a common language.
● Modularity—While cybersecurity risk remains the basis of this document, there areother risks that organizations must manage within the enterprise. Therefore, the NICE
Framework enables organizations to communicate about other types of workforces within
an enterprise and across organizations or sectors (e.g., privacy, risk management,
software engineering/development).
1.2

Purpose and Applicability

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Organizations manage many different business functions (such as operations, finance, legal, andhuman resources) as part of their overall enterprise. Each of these business functions has
associated risks. As technology has become an enabling factor in managing an enterprise, therisks associated with cybersecurity have also become more prominent. The NICE Frameworkassists organizations with managing cybersecurity risks by providing a way to discuss the workand learners associated with cybersecurity. These cybersecurity risks are an important input into
enterprise risk decisions as described in NIST Interagency Report 8286, Integrating
Cybersecurity and Enterprise Risk Management (ERM). [4]This document serves as a potential guide for other business functions that are considering thecreation of workforce frameworks. Organizations can increase efficiency by using the samebuilding blocks across various business functions. Therefore, any organization can leverage thisdocument.
1.3

Audience

The topic of managing a workforce for cybersecurity involves many different types of positions,as well as many different types of organizations. The audience of this document includes public
sector agencies, private and not-for-profit organizations, education and training providers,curriculum developers, credential providers, human resource professionals, hiring managers, line
managers, workforce planners, recruiters, and all learners.
1.4

Organization of this Publication

The remainder of this Special Publication is organized as follows:•

Section 2, NICE Framework Building Blocks: Defines the TKS building block
components of the NICE Framework•

Section 3, Using the NICE Framework: Describes common approaches to using the
NICE Framework•

Section 4, Conclusion•

References: A list of related publications referenced in this paper•

Appendix A, Acronyms: A list of acronyms and abbreviations used in this publication
3

NIST SP 800-181 REV. 1

2

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)NICE Framework Building Blocks

The Workforce Framework for Cybersecurity (NICE Framework) is built upon a set of discretebuilding blocks that describe the work to be done (in the form of Tasks) and what is required toperform that work (through Knowledge and Skills). These building blocks are organizing
constructs that support the usability and implementation of the NICE Framework. They provide amechanism by which both organizations and individuals can understand the scope and content of
the NICE Framework. These building blocks are meant to be guidelines that can be used toenhance comprehension rather than rigid structures.
2.1

Task Statements

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

As depicted in Figure 1, Task statements describe the work, while Knowledge and Skill (K&S)
statements describe the learner. Task statements should focus on
Task
the organizational language and communication patterns that
An activity that is directed
toward the achievement ofprovide value to the organization. These statements are designed
organizational objectives.
to describe work to be done and should be aligned with thecontext of the organization.
Tasks describe work to be completed. A task can be defined as
an activity that is directed toward the achievement oforganizational objectives, including business objectives,technology objectives, or mission objectives. Task statements
should be straightforward. While the work encompassed within a
Task statement may have many steps, as with the example
below, the statement itself is easy to read and understand.

Task Statements• Easy to read and understand• Begin with the activity
being executed• Do not contain the task
objective

A Task statement begins with the activity being executed.
Example: Troubleshoot system hardware and software.
A Task statement does not contain the objective within the statement, as objective may vary
based on mission drivers and organizational needs.
Example: Conduct interactive training exercises.
In the above example, the purpose of these exercises may be to create an effective learning
environment, but that goal is not included in the Task statement itself.
As Figure 1 shows, Tasks are related to K&S statements. A learner will demonstrate that they
possess the knowledge and skills to complete a Task (or will be challenged to gain theknowledge and learn the skill to prepare to complete the task.) The complexity within a Task is
explained by the associated K&S statements. In the troubleshooting example above, in order toeffectively troubleshoot any piece of software or hardware, the learner should be familiar withand understand the related Knowledge statements. The same can be said for Skill statements.

4

NIST SP 800-181 REV. 1

2.2

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Knowledge Statements

Knowledge statements relate to Task statements in that only withthe understanding described by the Knowledge statement will
the learner be able to complete the Task. Knowledge is defined
as a retrievable set of concepts within memory. Knowledge
statements may describe either foundational or specific concepts.
Multiple Knowledge statements may be needed to complete agiven Task. Likewise, one Knowledge statement may be used tocomplete many different Tasks.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Knowledge statements can be foundational.
Example: Knowledge of cyberspace threats andvulnerabilities.

Knowledge
A retrievable set of concepts
within memory.
Knowledge Statements• Describe foundational or
specific Knowledge• Multiple statements may beneeded to complete a Task
• A single statement may be
used to complete manydifferent Tasks

Knowledge statements can be specific.
Example: Knowledge of vulnerability information dissemination sources (e.g., vendor
alerts, government advisories, product literature errata, and sector bulletins).
Organizations developing Knowledge statements should consider the learners’ different levels ofknowledge and expertise. An example of these various levels is described in Bloom’s Taxonomy(Revised) which uses language that facilitates observability and assessment of the learner. [5]2.3

Skill Statements

Skill statements relate to Task statements in that a learner isdemonstrating skills in performing tasks. A learner who is notable to demonstrate the described skill would not be able tocomplete the Task that relies on that skill. A Skill is defined as
the capacity to perform an observable action. Skill statements
may describe straightforward or complex skills. Multiple Skill
statements may be needed to complete a given Task. Likewise,
exercising a Skill may be used to complete more than one Task.
Skill statements can be simple.
Example: Skill in recognizing the alerts of an Intrusion
Detection System

Skill
The capacity to perform anobservable action.
Skill Statements• Describe straightforward orcomplex skills• Multiple Skill statements
may be needed to completea Task• A single Skill statement
may be used to complete
more than one Task

Skill statements can be complex.
Example: Skill in generating a hypothesis as to how a threat actor circumvented theIntrusion Detection System.
As depicted in Figure 1, Skill statements describe what the learner can do, and Task statements
describe the work to be done. Therefore, it is important to separate the language used between
Skill statements and Task statements and to use terms that facilitate observability and assessmentof the learner.
5

NIST SP 800-181 REV. 1

3

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Using the NICE Framework

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Notably, while the Workforce Framework for Cybersecurity (NICE Framework) is intended toprovide a common set of building blocks from which many can draw, some organizations willfind the need to tailor the model to align more closely with their unique context. For example, amanufacturer may have sector- or organization-specific Tasks that are not described in the NICE
Framework. Others may find that the Tasks are applicable but need to adjust or develop specific
K&S statements in order to increase the likelihood that the Tasks can be completed as defined bytheir unique context. As such, these building blocks are not intended to be rigid; instead, they aremeant to provide a common language for organizations or sectors to use in ways that are
beneficial to a given context.
Finally, example uses of the NICE Framework building blocks provided below are notional orconceptual in nature; an organization may use the building blocks in any number of ways to best
meet local needs. These examples here are meant to illustrate potential practical approaches to
the NICE Framework that have been shown to help achieve common organizational objectives.
They provide guidance to organizations or sectors seeking a place to start rather than a singular
way to use the NICE Framework.
3.1

Using Existing Task, Knowledge, and Skill (TKS) Statements

Users of the NICE Framework reference one or more Task, Knowledge, and Skill statements(TKS statements), as described in Section 2, to describe both work and learners. Task statements
are used to describe the work. Task statements have associated K&S statements. Although a
Task statement may have a recommended set of associated K&S statements, users may include
other existing K&S statements to tailor Tasks for their unique context. K&S statements are used
to describe learners. K&S statements can be used in many ways to manage the cybersecurity
workforce. They can be used in part, all together, or not at all, depending on the implementing
organization’s unique context. The notional examples of use below demonstrate areas where
TKS statements might be implemented:•••

Employee Skill tracking program to determine promotion qualifications
Required Knowledge for completion of a course
Weekly Task list for completion at an organization

TKS statements and examples can be found in the NICE Framework Resource Center and will
be updated, as needed, to keep pace with changes resulting from evolving business missions,risks, or emerging technologies. [1]3.2

Creating New TKS Statements

Users are cautioned against modifying the text in existing NICE Framework TKS statements.
The statements are intended to support interoperability so changing their content may result in
subsequent misalignment when using outside sources. If different wording is needed in a TKS
statement to support a user’s unique context a new statement can be created.

6

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Users may also create entirely new Task, Knowledge, or Skill statements to help tailor the use of
the NICE Framework for local use within their unique context. Such additional statements will
help support clear and consistent internal discussions regarding learners and their work activities.
3.3

Competencies

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Competencies provide a mechanism for organizations to assesslearners. Competencies are defined via an employer-driven
approach that provides insight to an organization’s uniquecontext. Furthermore, Competencies allow education andtraining providers to be responsive to employer or sector needs
by developing learning experiences that help learners develop
and demonstrate the Competencies. Competencies consist of aname, description of the Competency, assessment method, as
well as a group of associated TKS statements.

Competency
A mechanism fororganizations to assesslearners.
Competencies are• Defined via an employerdriven approach• Learner-focused• Observable andmeasurable

Competencies offer flexibility by allowing organizations togroup together various TKS statements into an overarchingcategory that defines a broad need. While an individual Task and its associated Knowledge andSkill statements may not change, the more broadly defined Competency may introduce new
Tasks or even individual Knowledge and Skills — or remove existing ones — in response toshifting needs in a changing cybersecurity ecosystem.
There are various ways that Competencies could be used. For example, as depicted in Figure 2,
an organization could use Competencies as part of the hiring process aimed at fulfilling specificorganizational goals. In this case, the Competencies could be defined as a group of related Tasks
statements. The organization could then use these Competencies to assess whether a candidate
can perform those Tasks. This assessment could take the form of an interview, pre-employment
test, or work-based learning observation.

Figure 2. Using Competencies to Assess Learners through a Position Description

7

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Other organizations could use Competencies to determine whether a learner has achieved adefined set of Skills and Knowledge. These organizations could, as depicted in Figure 3, choose
to use Competencies as groups of K&S statements. These organizations could then assess thelearners for these K&S statements. Assessments could take the form of tests, lab-based
demonstration, or oral evaluations.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Figure 3. Using Competencies to Assess Learners through a Credential

The above examples are meant to be notional. They can be used in part, all together, or not at all,depending on the implementing organization’s unique context.
3.3.1

Using Existing Competencies

The NICE Framework Competencies are a way for organizations to align with the NICE
Framework at a high level without delving into the details of TKS statements. Competencies area way to describe the assessment of a learner. By enabling organization-defined groups of TKS
statements, Competencies enable organizations to succinctly communicate and effectively
organize their cybersecurity work in order to provide a streamlined view of the workforce. Other
potential uses of Competencies include to:••••

Describe types of Tasks within a given position
Track workforce capabilities
Describe team requirements
Demonstrate learner capabilities

8

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Although a Competency has a recommended set of associated TKS statements, users could add
or remove existing statements to tailor Competencies for their unique context. However, users
are cautioned against modifying the title or description of an existing NICE Framework
Competency. Competencies are intended to support interoperability so changing their content
may result in subsequent misalignment when using outside sources. If different wording isneeded in a Competency to support a user’s unique context a new Competency can be created as
described below (see Section 3.3.2).
3.3.2

Creating New Competencies

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Some organizations may need to describe a Competency for the specific context of theircybersecurity work. The NICE Framework, developed with the principle of agility, allows
organizations to describe a Competency to meet a changing cybersecurity ecosystem. This could
be done by altering an existing Competency to meet local needs or creating an entirely newcompetency.
Two notional examples are provided below to explain potential processes for using
Competencies. The two examples focus on Data Analysis to show that the same Competency canbe utilized through different approaches. Additionally, these examples elaborate on Figure 2 andFigure 3 to ground the reader in a potential implementation. These examples use a table structure
to communicate the Competency. This tabular approach is one of many that could be used by anorganization seeking to implement Competencies.
Data Analysis Example 1
Table 1, below, is informative and provides a starting point for building a Competency. The Data
Analysis Example 1 Competency has a name and a description that quickly allows theorganization to identify a Competency as one that has value to their organizational structure andcontext. Using the assessment method of “lab-based demonstration” the organization is assessing
a learner by providing a simulated work environment to complete the Tasks which meet theirbusiness objectives. (Note that Table 1 uses Tasks from the 2017 version of the NICE
Framework. [2])Table 1 – Example of Creating A New Data Analysis Competency with Existing NICE Framework 2017 Tasks

Competency Name: Data Analysis Example 1
Competency Description: The collecting, synthesizing, or analyzing qualitative and quantitative dataand information from a variety of sources to reach a decision, make a recommendation, and/or compile
reports, briefings, executive summaries, and other correspondence.
Assessment Method: Lab-based demonstration
Task Statements
T0007 | Analyze and define data requirements and specifications.

9

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

T0405 | Utilize open source language such as R and apply quantitative techniques (e.g., descriptive andinferential statistics, sampling, experimental design, parametric and non-parametric tests of difference,ordinary least squares regression, general line).

In the example described in Table 1, an organization may give a learner a computer loaded witha particular data set and connected to the lab network. The learner is then given time todemonstrate their ability to use open source languages to apply quantitative techniques to thedata. A key portion of this assessment may be to analyze the data set to ensure the data meets a
specific data specification before completing the analysis. Through this assessment the learnerdemonstrates the Competency of "Data Analysis Example 1” as defined by the employer.
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

A fully detailed Competency of Data Analysis could be much larger. By enumerating the Task
statements within the Competency the organization can specify the desired scope of theCompetency. For ease of use, Tasks are referenced with their NICE Framework 2017 Task IDs.
Data Analysis Example 2
Table 2, below, demonstrates another starting point for creating a Competency. The example isinformative; the description is the same as Table 1, however, this example uses Knowledge andSkill statements to build the Competency.
Table 2 - Example of Creating A New Data Analysis Competency With Additional Tasks

Competency Name: Data Analysis Example 2
Competency Description: The collecting, synthesizing, or analyzing of qualitative and quantitative
data and information from a variety of sources to reach a decision, make a recommendation, and/or
compile reports, briefings, executive summaries, and other correspondence.
Assessment Method: Test
K&S Statements
S0013 |Skill in conducting queries and developing algorithms to analyze data structures.
S0021 | Skill in designing a data analysis structure (i.e., the types of data a test must generate and how
to analyze that data).
S0091 | Skill in analyzing volatile data.
K0020 | Knowledge of data administration and data standardization policies.
K0338 | Knowledge of data mining techniques.

In this example, Table 2 represents a Data Analysis Competency. This Competency could becreated by a certification body that provides a test to assess learners. The test could be
administered in paper form or computer-based format. By passing the test, the learner

10

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

demonstrates the Competency of “Data Analysis Example 2” as defined by the certification
body.
(Note that Table 2 uses K&S statements from the 2017 version of the NICE Framework. [2])3.4Work RolesWork Roles are a common use case of the NICE Framework. Work Roles are a way ofdescribing a grouping of work for which someone is responsible or accountable.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

While previous workforce frameworks also associated Work Roles with Knowledge, Skill, andAbility specifications, the NICE Framework encourages a more agile approach through Tasks.
Work Roles are composed of Tasks that constitute work to be done; Tasks include associatedKnowledge and Skill statements that represent learners’ potential to perform those Tasks. Thistransitive approach, illustrated in Figure 3, supports flexibility and simplifies communication.

Figure 4 - Work Roles' Relationship to Building Blocks

Work Role names are not synonymous with job titles. Some Work Roles may coincide with a job
title depending on an organization’s use of job titles. Additionally, Work Roles are notsynonymous with occupations.
A single Work Role (e.g., Software Developer) may apply to those with many varying job titles(e.g., software engineer, coder, application developer). Conversely, multiple roles could be
combined to create a particular job. This additive approach supports improved modularity andillustrates the fact that all learners in the workforce perform numerous tasks in various roles,
11

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

regardless of their job titles. Similarly, the NICE Framework does not define proficiency levels(e.g., Basic, Intermediate, Advanced). Such attributes, and those regarding the proficiency withwhich a learner performs Tasks, are left to other models or resources.
3.4.1

Using Existing Work Roles

Each Work Role is intended to support the achievement of objectives through Tasks. Although aWork Role may have a predetermined set of associated Tasks, users may include other existing
Tasks to tailor Work Roles for their unique context. Similarly, a user may wish to draw from thelisted Work Roles or add additional ones to support additional objectives. The current set of
NICE Framework components is available from the NICE Framework Resource Center. [1]This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Users are cautioned against internally modifying the name and description of an existing Work
Role. The Work Roles are intended to support interoperability so changing their content may
result in subsequent misalignment. If different wording is needed, a new Work Role can becreated as described below.
3.4.2

Creating a New Work Role

Users may also create new Work Roles to help tailor the use of the NICE Framework for theirunique context. Such additional Work Roles will help support clear and consistent internal
discussions regarding the cybersecurity work.
3.5

Teams

Many organizations use teams to collectively tackle complex challenges by bringing together
individuals with complementary skills and experience. By utilizing different resources andperspectives, teams allow organizations to manage risks holistically. Teams take advantage ofeach member’s specialization of knowledge and processes to effectively distribute work. Teamscan be defined using Work Roles or Competencies.
3.5.1

Building Teams with Work RolesA Work Role-centered approach to building teams allows organizations to define what types ofWork Roles are needed to achieve defined objectives. Since Work Roles are themselves made up
of Competencies, this approach to building teams starts with the work to be completed. Thisapproach may be considered “top down.”
Table 3 - Example of a Secure Software Development Team Using the NICE Framework 2017 Work Roles

Lifecycle Phase
DesignBuild
DeployOperateMaintain
Decommission

Work Role
SP-ARC-002 | Security Architect
SP-DEV-001 | Software Developer
OM-NET-001 | Network Operations Specialist
OM-STS-001 | Technical Support Specialist
OM-DTA-001 | Database Administrator
OV-LGA-001 | Cyber Legal Advisor

12

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Table 3, above, demonstrates a way of creating a secure software development Team. The Work
Roles are referenced using the 2017 version of the NICE Framework Work Role IDs. Teams
built this way begin with the identification of the work that needs to be accomplished. In thisexample, the secure software development team is organized by lifecycle phase. The first row
illustrates that the team would consider objectives of the Design phase including planning, andthus would need a Security Architect. Table 3 is an informative example and does not cover all
the Work Roles that may be present or needed for a given Team. For more information, see
NIST’s Secure Software Development Framework. [6]Table 4 - Example Creating A Cybersecurity Team Using NICE Framework 2017 Work Roles and
New Work Roles
This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Cybersecurity Framework Function
Identify
Protect
DetectRespond
RecoverWork Role
NewWorkRole1 | Risk Manager
SP-RSK-002 | Security Control Assessor
PR-CDA-001 | Cyber Defense Analyst
PR-CIR-001|Cyber Defense Incident Responder
NewWorkRole2 | Communications Specialist

Table 4 describes an example cybersecurity Team. Similar to the secure software development
team, the example team is built with a work-centered approach. By using the Core of the
Framework for Improving Critical Infrastructure Cybersecurity (Cybersecurity Framework),
cybersecurity objectives are selected, Tasks are identified to achieve those objectives, and Work
Roles are selected to define the roles necessary to support those objectives. [7] Table 4 is an
informative example and does not cover all Work Roles which may be present or required for agiven Team. Two new Work Roles are added to show a mixed approach of using existing Work
Roles (Section 3.4.1) and creating new Work Roles (Section 3.4.2). By creating new Work Roles
the example demonstrates a flexible and agile approach to the tailoring of the NICE Framework.
3.5.2

Building Teams with Competencies

Teams can also be built using Competencies. This approach to building teams recognizes that
individual Tasks may be unknown, but the types of Competencies needed to solve the challenge
are known. This approach may be considered “bottom up.” Therefore, teams built this way canhelp identify learners who may participate in the Team’s work in the future. These learners may
or may not be associated with a Work Role and simply possess the Competencies needed to help
meet organizational objectives.
For example, a defensive cybersecurity team that uses its skills to imitate adversaries’ attack
techniques (i.e., a “Red Team”) may be composed of the following notional Competencies:•

Engagement Planning•

Rules of Engagement•

Pen Testing•

Data Collection•

Vulnerability Exploitation
13

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)By creating teams or other TKS groupings, each organization can tailor the NICE Framework inways that best help to apply and communicate about the learners (and the work that thoselearners will perform) to enable achievement of mission objectives.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

14

NIST SP 800-181 REV. 1

4

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Conclusion

Through the application of the building block approach described by the NICE Framework, users
can benefit from a consistent method for organizing and communicating the work to be done via
Task statements and the Knowledge and Skills of individual learners who support that work. The
NICE Framework helps guide the efforts of employers to describe cybersecurity work, educationand training providers to prepare cybersecurity workers, and learners to demonstrate theircapabilities to perform cybersecurity work.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

The ability to describe Tasks, Knowledge, and Skills is important to ensure a comprehensive
understanding of the work and the workforce. The NICE Framework provides an extensiblereference resource that can be applied and used by various organizations or sectors to describe
the work to be performed in many areas. The benefits to these organizations support the NICE
mission of energizing, promoting, and coordinating a robust community working together toadvance an integrated ecosystem of cybersecurity education, training, and workforce
development.

15

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

References

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1[1]

National Initiative for Cybersecurity Education (2020) NICE Framework Resource
Center. Available at https://www.nist.gov/nice/framework[2]

Newhouse WD, Witte GA, Scribner B, Keith S (2017) National Initiative for
Cybersecurity Education (NICE) Cybersecurity Workforce Framework. (National
Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication(SP) 800-181. https://doi.org/10.6028/NIST.SP.800-181[3]National Institute of Standards and Technology (2020) National Online Informative
References Program. Available at https://csrc.nist.gov/projects/olir[4]

Stine K, Quinn S, Witte G, Gardner RK (2020) Integrating Cybersecurity and Enterprise
Risk Management (ERM). (National Institute of Standards and Technology,
Gaithersburg, MD), NIST Interagency or Internal Report (IR) 8286.
https://doi.org/10.6028/NIST.IR.8286[5]

Krathwohl, D. R. (2002). A revision of Bloom's taxonomy: An overview. Theory Into
Practice, 41(4), 212-218. Available athttps://www.depauw.edu/files/resources/krathwohl.pdf[6]Dodson DF, Souppaya MP, Scarfone KA (2020) Mitigating the Risk of Software
Vulnerabilities by Adopting a Secure Software Development Framework (SSDF).
(National Institute of Standards and Technology, Gaithersburg, MD), NIST
Cybersecurity White Paper. https://doi.org/10.6028/NIST.CSWP.04232020[7]

National Institute of Standards and Technology (2018) Framework for Improving
Critical Infrastructure Cybersecurity, Version 1.1. (National Institute of Standards andTechnology, Gaithersburg, MD). https://doi.org/10.6028/NIST.CSWP.04162018

16

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)

Acronyms
Selected acronyms and abbreviations used in this paper are defined below.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

ERM

Enterprise Risk Management

FISMA

Federal Information Security Modernization Act

FOIA

Freedom of Information Act

ITLNIST Information Technology Laboratory

K&S

Knowledge and Skill statement(s)NICE

National Initiative for Cybersecurity Education

NIST

National Institute of Standards and Technology

OLIR

Online Informative Reference

OMB

Office of Management and Budget

SSDF

Secure Software Development Framework

TKS

Task, Knowledge, and Skill statements

17

NIST SP 800-181 REV. 1

WORKFORCE FRAMEWORK FOR CYBERSECURITY(NICE FRAMEWORK)Glossary
For a complete glossary, please visit https://csrc.nist.gov/glossary.

This publication is available free of charge from: https://doi.org/10.6028/NIST.SP.800-181r1

Competency

A mechanism for organizations to assess learners.

Knowledge

A retrievable set of concepts within memory.

Skill

The capacity to perform an observable action.

Task

An activity that is directed toward the achievement of organizational
objectives.

18