NICE Community Coordinating Council

Meeting Minutes

September 26, 2023 | 3:30-5:00 p.m. ET

I. Introduction and Ground Rules – NICE Program Manager Susana Barraza

• The NICE Community Coordinating Council was established to provide a mechanism in which 

public and private sector participants can develop concepts, design strategies, and pursue 

actions that advance cybersecurity education, training, and workforce development. 

• Members are encouraged to participate in the meeting via the platform chat space and the 

Q&A space.

• Reminder: The meeting is not intended for marketing or other commercial purposes.

II. Opening Remarks

a. Academic Co-Chair – Zarina Blankenbaker, Ph.D., President, Tarrant County College –

Northwest

• Zarina is honored to serve as Co-Chair and delighted to be affiliated with this 

esteemed group. The work of NICE is inspiring. Her goal is to always have a pulse on 

where her community is, aspires to be and how to get there. She is frequently at the 

table with industry and business partners.

• A hot topic is the indispensable significance of soft skills which is now being referred 

to as power skills. What business and industry partners are saying is that its not just 

technical skills anymore. They want more included in a technically skilled 

employees’ toolkit. Businesses now operate in a globalized technical world and 

employees need to navigate a complex web of relationships both internal to their 

organization and external which extends globally. They need to communicate 

effectively and adapt to changes that employers say are essential. 

• Zarina shared a few recurring themes that she hears are most important to 

employers across the board.

o Adaptability and resilience: seeing that change is the only constant in 

today’s business world. 

o Employers want employees who are capable of articulate communication 

through reports, presentations or just conveying ideas. Communicating 

across diverse terms. 

o Emotional intelligence emerged as a trait multiple times as an essential skill.

o Teamwork and collaboration are very important skills. No one works in 

isolation. Employers want team players who can collaborate seamlessly with 

colleagues from different backgrounds.
o Problem solving and critical thinking. No one wants employees who follow 

directions by the book. Employers are on the hunt for innovative 

employees. 

• Zarina’s industry partners are looking for employees who are equipped with power 

skills. We want to make sure that our colleges are soft skill incubators. They are 

looking for employees who understand the human dimension of their work.

b. Industry Co-Chair – Michael Alicea, Chief Human Resources Officer, Trellix 

• Michael agrees with Zarina from an industry perspective but not quite in the

obvious way. For Michael, the soft skills are those skills which allow someone to 

come to work in a company in areas that are related to cybersecurity, maybe not 

coding, but understanding the echo system of how a client uses a company’s

capabilities. How their ecosystem works. Someone who understands the client’s

needs even if they are not significantly technical. You can then bring them in and get 

them steeped in the culture of a company and bridge the gap. Move them up the 

technical skill chain. The skills that Michaels’ company looks for are an entry point

into their organization.

c. Government Co-Chair – Rodney Petersen, Director of NICE 

• Rodney moved directly to the Standing items.

III. Standing Items

a. Report Roundup – Learning from Good Ideas 

How AI-powered software development may affect labor markets

Presented by Peter Cihon, GitHub and Mert Demirer, Massachusetts Institute of 

Technology

URL: https://www.brookings.edu/articles/how-ai-powered-software-development-mayaffect-labor-markets/ 

• Some attendees may be familiar with generative AI and the way it is permeating

several digital applications. Git Hub has had a product on the market for some time 

as a coding assistant. 

• Git Hub conducted a study about how AI-powered software development affect 

labor markets. The GitHub Copilot productivity study recruited ninety-five 

developers and split them randomly into two groups. The groups were tasked with 

writing a web server in JavaScript. One group of forty-five developers used the 

GitHub Copilot and fifty did not. 

• Out of the first group of forty-five, seventy-eight percent finished in an average time 

of one hour and eleven minutes. Out of the second group of fifty, seventy percent 

finished, who did not use the Github Copilot, in an average time of two hours and 

forty-one minutes. 

• Early literature on Generative AI and developer productivity shows two common 

findings. First, there is a large effect on productivity. These tools increase 

productivity of software engineers. Also, the tools tend to help developers. 
• One important open question is replicating these studies in real-world environment. 

They are working with a few companies to study this and are monitoring their 

progress in real time. 

• Another question is whether these compliment software skills between AI and 

developers. They could substitute for some tasks and compliment other tasks. 

• There are clear questions for further research building off these experimental 

designs. The piece we offer to contextualize is the existing literature with some 

history from software development tools. When we think of the history of 

computing it is a history of subsequent waves of innovation in the ways in which 

software are built. With each innovation there is a higher level of automation.

• The trends from history show a story of lower costs over time. At the same time

there has been an increased demand for digital transformation and increased labor 

demand. During the transitions developers have benefited. 

• Using AI to build AI sets the stage for an exciting future.

b. Strategy Stories – New Developments that align to NICE Strategic Plan 

All Services Personnel and Institutional Readiness Engine (ASPIRE)’s NICE Fit

Presented by Anthony Boese, U.S. Department of Veterans Affairs

• ASPIRE stands for All-Services Personnel and Institutional Readiness Engine.

• The ASPIRE system is a cross-agency collaborative project which looks to assess, 

educate, and streamline the federal government workforce. This AI-powered 

system-of-systems uses computer adaptive assessments to determine individuals’ 

knowledge, skills, and abilities (KSAs). The system will analyze the individuals' KSAs 

against agency standards to identify gaps and finally, map personalized learning 

pathways to close those gaps and for further development. ASPIRE can assess and 

upskill in any area, with AI, data science, AI and data ethics, and cybersecurity 

currently under development.

• There is a lot that ASPIRE is doing that overlaps cleanly with what NICE is doing, 

want to push forward and execute. Broadly speaking these are the objectives of 

NICE that overlap with ASPIRE’s work:

o Goal #3: Modernize the Talent Management Process to Address 

Cybersecurity Skills Gaps

 3.2: Utilize new technologies such as machine learning and 

automated approaches to increase connections and fit between 

employers and job seekers. 

• APIRE is pushing the edge on the modernization of talent development. Through the 

All Services Personnel and Readiness Engine they: Assess, Find Gaps, Educate, 

Describe, and Make Ready. 

• ASPIRE provides a consistent language, consistent audit, consistent security, 

consistent validation, consistent education, and consistent predications.

• Anthony Boese Contact information: Anthony.boese@va.gov
c. Framework Feature – Applications and Uses of Workforce Framework for Cybersecurity 

Center for Certification & Competency-Based Education (C3Be)

Presented by Diane DeBacker and Julianna Marie Stockton, The University of Kansas

URL: https://c3be.ku.edu/ 

• Diane and Julianna will share about a project around the cybersecurity talent 

pipeline. The project being shared was worked on with a client that asked them to 

help with a talent pipeline for cybersecurity. They will talk about well suited talent 

within this industry.

• Working with their client and industry representatives they identified the top ten 

attributes that would make a candidate well suited to a future role in cybersecurity. 

They then analyzed the abilities section of the KSAs in the NICE Framework, all onehundred and seventy-eight of them, to identify which attribute was most relevant to 

the performance of that specific ability in a cybersecurity context. 

• After the map was complete, they added in all the nods and connections of each of 

the one-hundred and seventy-eight abilities and the rest of the framework: the 

work roles, specialty areas, job categories across the entire framework. 

• The map provided a graph that resulted in the ten well suited attributes that their 

client requested for consideration. The ten attributes are considered power skills. 

• Based upon focus groups they had with early career, mid-career, and C-Suite 

individuals within the cybersecurity field, they took that information and mapped it 

against what is required in the Knowledge and Skills and Abilities of the NICE 

Framework and the work roles. 

• The visual alone gives a clear indication about what is needed within each work role. 

It is very useful in developing a cybersecurity talent pipeline. 

• What do we do with the information? We could look at an individual work role and 

see what attributes are critical for success within a given role. It is particularly useful 

for their client with the talent pipeline development and aligning assessments. One 

could also examine a single attribute, like communication, to see how it varies 

across the work roles, the job categories, through out cybersecurity which may 

suggest some more nuanced indicators of how a skill or attribute, like 

communication, might progress development over the course of someone’s career 

across different roles. Or, it could be utilized like a mirror, reflecting information 

about the Framework itself. 

• They would love to hear about what members would be curious to explore further. 

• Question: How can integrity be brought into the discussion about power skills? 

o In their focus groups around the attributes, integrity came up around the 

discussion of protective instincts. It encompassed ethics. 

d. Research Review- Driving Research on Effective Practices

A Targeted Study on the Match between Cybersecurity Higher Education Offerings and 

Workforce Needs
Presented by Diane Murphy, Marymount University

URL: https://digitalcommons.odu.edu/cgi/viewcontent.cgi?article=1493&context=vjs 

• Diane talked about a study that was conducted in 2020/2021. The idea behind it 

was to see the gap between higher education and their view of cybersecurity and 

what the workforce needs. 

• The study was sponsored by the Commonwealth Cybersecurity Initiative and 

focused on Northern Virginia. They were looking at, as a group of seven universities, 

at how they are preparing their students and looking at what their local industry 

was asking for in their job descriptions and the hiring process.

• It is still very hard for a college graduate to get their first cybersecurity job. They 

examined what they were teaching and what they thought was a preparation for 

the workforce and what their industry partners were looking for.

• They developed the study, sent out surveys and received about one-hundred and 

twenty responses. About seventy-five percent of them were from industry, twenty 

percent from government and the remaining from academia. They then looked at 

the differences between the industry perception of what they were getting from 

graduates and the academic perception. 

• The employer’s perspectives were very interested in hiring experienced personnel

over recent graduates. Only about twenty percent of the postings being put out 

were from entry level people. They felt new graduates did not have the training to 

hit the ground running. They felt the salary expectations were too high particularly 

given the movement of personnel between companies. They also found that there 

were a lot of inconsistencies between job titles. The findings also reinforced the 

need for skills and work experience. 

• The seven schools also examined how they were meeting some of the needs. The 

findings included:

o The curriculum and programs broadly aligned with employer demands for 

foundational knowledge. 

o Soft skills like teamwork and communication are necessary and not always 

prioritized in programs. 

o Need for more recognition of the role of certifications in demonstrating 

skills. 

o Need to focus more on experiential learning and demonstrate on resumes, 

not just internships, but also projects and in-class activities, competitions, 

etc.

o The preference for specific tools and certifications. 

• As academics, they felt updating their curriculum is very important. Soft skills are 

very important. They need to promote a strong online presence as well as 

certifications and experiential learning. They also felt that students need to take 

advantage of outside-the-classroom learning to stay current as well as take 

advantage of projects and competitions to demonstrate skills on a resume. 

IV. Working Group Updates

a. Promote Career Discovery 

Co-chair: Karl Cureton, Council Exchange Board of Trade (CEBOT)
• Cybersecurity Career Ambassador Program Update:

o Conducted Five training session sessions so far for about 30 ambassadors. 

They are piloting the program to scale. Connie Bragg has been a key to the 

program’s success.

o Final product will be ready on October 11, 2023. 

o The Ambassador Program will hold a webinar on Wednesday during the 

Cybersecurity Career Awareness Week on Cultivating Cybersecurity Leaders: 

The New Cybersecurity Careers Ambassadors Program’.

• Having conversations about ideations on a new project charter that is looking at 

how to ensure outcomes as far as the Strategies of Goal 1. They are contemplating a 

plan that considers the NICE Community from a research and vision perspective and 

look at coordinating a solution that handles the workforce gap in cybersecurity by

focusing on the connection between employer and employee.

• They are coordinating an event on October 19th called ‘Cybersecurity Paths and 

Ladders’. The event will take place in lieu of their monthly meeting.

• Site: Promote Career Discovery Working Group | NIST

• Next Meeting: November 15, 2023, at 3:30 p.m. ET

b. Transform Learning Process 

Co-chair: Tara Wisniewski, ISC2

• The group have recently been discussing the need for more research around the 

shortage in cybersecurity workforce education. They are examining what the group 

can do more of in terms of the studies. 

• The group has located a new Co-Chair for their newest project charter to champion 

the development and recognition of teachers, faculty, and instructors as part of the 

in-demand workforce.

• The Working Group will take up the topic of Artificial Intelligence (AI) as a topic for 

teaching and other attributes from it.

• Site: Transform Learning Process Working Group | NIST

• Next Meeting: October 10, 2023, at 2:00 p.m. ET

c. Modernize Talent Management 

Co-chairs: Jo Justice, Leidos; Olesya Menon, Google

• The previous project on ‘Guidance to Writing Effective Job Descriptions’ was 

updated to reflect the loss of one of their project members and is now dedicated in 

memory of Elizabeth Fraumann.

• The group conducted a survey for future projects which led them to issues 

pertaining to talent retention, that aligns with their strategic goal. The new project 

is called ‘Issues Contributing to Talent Retention – Why People Leave and Why 

People Stay’.

• The meeting also had a lively discussion about reskilling and upskilling, diversity, 

mental health issues, and how all those things are related to the cybersecurity 

workforce. 

• They have also updated their environmental scan.

• Site: Modernize Talent Management Working Group | NIST
• Next Meeting: October 19, 2023, at 1:00 p.m. ET 

V. Community of Interest Updates 

a. Apprenticeships in Cybersecurity 

Staff: Marian Merritt, NICE

• The leaders have been very active and spoke at a recent Department of Labor and 

Department of Education event in Biloxi, Mississippi. They spoke about un-locking 

career pathways using cybersecurity. 

• They are also appearing at InfoSec World. They have a career booth where they are 

promoting apprenticeship. They are conducting a session on the benefits of 

Cybersecurity Apprenticeship Pathways.

• They also held a session meeting with members of the Business Round Table on 

ways to get member feedback on cybersecurity apprentice able occupation. 

• Within the COI, the have finalized their one-pager which is now back with the NICE 

Program Office for final editorial changes. 

Site: Apprenticeships in Cybersecurity Community of Interest | NIST

• Next meeting: October 13, 2023, at 11:00 a.m. ET

b. Cybersecurity Skills Competitions 

Co-chair: Jake Mihevc, Mohawk Valley Community College

• The group have moved three papers forward that have been in progress in their 

group for some years. They will be publishing; Building a Competition; A Guide to 

Cyber Ranges and a Guide for Competitors. Those will all be published in the next 

few weeks. 

• The group discussed how to map a competition landscape for students and faculty. 

A project is underway to build a competition list. They have received a ton of great 

feedback on different criteria, filters, and how to make that list most accessible to 

students and faculty.

Site: Cybersecurity Skills Competitions Community of Interest | NIST

• Next meeting: October 20, 2023, at 2:00 p.m.

c. K12 Cybersecurity Education 

Co-chair: Thomas Trevethan, Palo Alto Networks

• The group celebrated the Insider Threat Awareness Month. They shared a plethora 

of resources with the group from the Security Awareness Governance Site. 

• Amber and Lindsay from iKeepSafe.org provided a presentation.

• Davina updated the group on the progress being made for Cybersecurity Career 

Awareness Week, which starts on October 16th. 

• The K12 COI is planning to kick off its professional development monthly webinar 

series on the morning of October 16th. It will focus on teacher best practices for 

integrating cyber across all academic disciplines within the K12 space.

• Site: K12 Cybersecurity Education Community of Interest | NIST

• Next meeting: October 12 2023, at 3:30 p.m. ET

d. Diversity and Inclusion 

Staff: Susana Barraza, NICE
• The Diversity and Inclusion Community of Interest officially launched in August.

• They are currently working on drafting their charter based on discussions and 

expectations from members.

• Members are working on getting a short video out for Cybersecurity Career 

Awareness Week. 

• Site: Diversity and Inclusion Community of Interest | NIST

• Next meeting: October 20th at 11:00 a.m. ET 

e. NICE Framework Users 

Staff: Mike Prebil, NICE

• Earlier this month the group held an open call with other members of the NIST 

community. The objective for the open call was to discuss some of the conceptual 

connections between the NICE Framework and other NIST Frameworks as well as 

some of the ways they can formalize those connections. The connections between 

frameworks are extremely important.

• The next Framework Users Group will feature someone from the Ethically Hacking 

Space, a non-profit, focused on the cybersecurity skills needs of space-based 

commerce and defense. 

• In November they will have a cross-over feature with the Cybersecurity 

Competitions COI looking at the ways that different competitions are using the NICE 

Framework. 

• Framework Users Group: https://www.nist.gov/itl/appliedcybersecurity/nice/community/community-coordinating-council/nice-frameworkusers

VI. Project Progress Reports 

a. US Cyber Games 

Presented by Brad Wolfenden

URL: https://www.uscybergames.com/ 

• Their target demographic is fifteen to twenty-five years old.

• Season 3 Timeline is well under way. Successfully wrapped up the Combine on 

September 1, 2023. The Combine is an intensive period of assessment, training, and 

evaluation for the US Cyber Games program. They saw substantial growth in Season 

3 with just over one-hundred and twenty individuals joining the Combine. The 

coaching and mentor staff will meet to discuss the data collected throughout the 

combine over the coming weekend to make some selections for the Season 3 team 

and Season 3 Pipeline Program. Both will be announced on October 16, 2023, at the 

US Cyber Games Draft Day.

• The Season 3 US Cyber Combine was held from July 7th – September 1st, 2023. Each 

week of the Combine was broken into a core topic area.

• Contact: info@uscybergames.com

b. NICE K12 Cybersecurity Education Conference (Phoenix, Arizona) – December 4-5, 2023 

Presented by Felicia Rafeliff, iKeepSafe
• Early Bird registration is open. The fee is $295 until October 23, 2023. The full 

agenda and speaker line up is now live on the website.

• There are sixteen pre-conference workshops that are an additional $50 per ninetyminute session at Canyon University on Saturday and Sunday. They have a brandnew facility where all the workshops will be held. A free box lunch will be provided 

for the sessions as well.

• Their roster of students will be announced next week. Six high school students will 

be featured in the 2023 National Cyber Signing Day. 

• There are four keynote speakers. More information about them can be found on the 

Conference Website. 

• The next planning committee meeting will take place tomorrow, Thursday, July 27th

at 3:30p.m. ET.

• Actively looking for exhibitors and sponsors. There are still exhibitor spaces available

in addition to sponsorship opportunities.

• Next planning committee is on Thursday, September 28, 2023, at 3:30pm ET. 

• Connect on Twitter:

i. @ikeepsafe 

ii. NISTcyber

iii. #NICEK12

• Please contact Felicia Rateliff with questions: felicia@ikeepsafe.org

• URL: https://www.k12cybersecurityconference.org/

c. NICE Conference and Expo (Dallas, Texas) – June 3-5, 2024 

Presented by Cesar Cabot, Florida International University 

URL: https://niceconference.org/

• The conference will be held at the Sheraton, Dallas, Texas.

• The theme has been announced: Strengthening Ecosystems – Aligning Stakeholders 

to Bridge the Cybersecurity Workforce Gap. 

• Call for proposals will open in October.

• Regional Initiative for Cybersecurity Education and Training (RICET) will be held in 

October in the Bahamas. The in-person registration has closed but the virtual 

component is still available for registration. 

VII. Featured Topic 

Building a Cybersecurity and Privacy Learning Program: NIST Releases Draft SP 800-50 Rev. 1 

Presented by Marian Merritt, NICE Deputy Director

URL: https://www.nist.gov/news-events/news/2023/08/building-cybersecurity-and-privacylearning-program-nist-releases-draft-sp 

• Marian has been working on an update to NIST SP 800-50 which is a twenty-year-old 

document. The documents original title was ‘Building an Information Technology Security 

Awareness & Training Program (2003)’. 
• The document is meant for the Federal Cybersecurity Training audience. The document is 

targeted for people who are educating the cybersecurity federal workforce and over time 

this document has found a much broader audience.

• The new draft was made public on August 28, 2023. It was announced through Gov Delivery 

but was also provided to the various groups who have an interest in this topic.

• The co-authoring team included people from CISSA, the Department of Transportation, the 

IRS, NASA, MITRE, along with several additional stakeholders.

• The publication will go out for public comment which will be open until October 27, 2023. 

The comments will be adjudicated after which the final draft will be made public.

• Some of the goals include:

o Leveraging NIST guidance (such as the numerous Frameworks that have been created 

since the original document was published). 

o Develop consistent language.

o Reflect research from FISSEA community and incorporate the research as well.

o Address challenges such as measuring impact. 

• The updated title is: ‘Building a Cybersecurity and Privacy Learning Program’. They are 

highlighting the inclusion of ‘privacy’ as many people doing the training now need to cover 

the topic of privacy. Privacy is a huge issue. People doing the training usually have to 

coordinate with the privacy team. Additionally, the title now includes ‘learning program’ as 

it supports a culture of respect for employees. The hope is that the concept of learning as an 

umbrella will be accepted by the community and more broadly understood terminology of 

training.

• They are encouraging people to step back from the concept that employees are the weakest 

link. Rather, they want to encourage building a culture where employees are respected, 

supported, brought into the practice of risk reduction and management. Everyone plays a 

role in managing the organizations cybersecurity and privacy risk.

• They also view the learning program as not simply a single program done once a year that is 

someone else’s responsibility. The program needs to be nimble, adaptable, cyclical, and 

iterative. 

• The team also recognize that Federal agencies vary greatly in size. The guidance provided in 

the SP 800-50 reflect those different circumstances. It is intended to be collaborative, 

flexible, and scalable. 

VIII. Closing Remarks and Next Meeting Reminder

The next NICE Community Coordinating Council Meeting will be October 24, 2023, at 3:30 p.m. 

ET.