July 30, 2017

Cybersecurity Workforce RFI:

The Professionalization of Cybersecurity

In response to the National Institute of Standards and Technology (NIST) request, we offer the following 

information on the scope and sufficiency of efforts to educate and train the Nation's cybersecurity 

workforce and recommendations for ways to support and improve that workforce in both the public and 

private sectors.

We are proponents of the professionalization of cybersecurity. This goal transforms all of our programs in 

cybersecurity at the University of Washington. Cybersecurity is now a discipline that permeates operations 

and management, a field in which policies, processes, and risk management are as important as technology. 

The nation has a wide and growing gap between the demand and supply of trained cybersecurity personnel. 

These vacancies are growing at all levels, from IT operations through management to executive leadership 

and communications. We should address this need systematically, by promoting the emerging national 

model, by developing scalable programs, and by ensuring the readiness of graduates.

Promoting the national model. As more schools establish cybersecurity programs, we need to make a 

concerted effort to share the research, frameworks, and standards that have been developed over decades. 

As newcomers enter this field, we need to make them familiar with the NIST job classifications and the 

knowledge units, to make sure that their programs produce graduates who have the knowledge, skills, and 

abilities (KSA’s) expected by employers.

Similarly we need to organize around the goal of protecting critical infrastructure and key resources. This 

framework should be embedded in workforce development programs for cybersecurity. The programs for 

managers and executives should address cross-institution and cross-sector responses, since our critical 

infrastructure is controlled by both public agencies and private companies.

Scalability. This need for workforce development in cybersecurity is so great that the national system of 

training programs should be set up with efficient scaling in mind. The centers of academic excellence 

provide a network through which core curriculum, course modules, and program models can be shared 

nationwide. This supports rapid coherent promulgation of training programs.

Two other aspects – the human aspects – of scalability have to be addressed. How do we develop quality 

educators for these programs, and how do we expand the pool of qualified candidate students? For quality 

students, we recommend expanding programs like Cyber P3i, to actively recruit veterans and reservists for 

this field. Expanding focused cybersecurity career guidance to recruit broadly to build talent pipelines to 

assist organizations looking for internal pathways for their staff to move into the cybersecurity team.

Increase readiness. Whether public and private, employers are looking for staff members who are “breach 

ready”, ready to contribute to the problem solving teamwork during an adverse event. This transition from 

UNIVERSITY OF WASHIN GTON 

CIAC

CENTER FOR INFO R MATION ASSURANCE AND

CYBERSECURITY

HUSKY HALL 10909 NE 185TH STREET • ROOM HH 1439 • BOX 358 523

BOTHELL/WA • 98 011 - 8246

PHONE: 206 - 2 4 0 - 0345 • FAX: 206 - 260 - 0115
 training program to workplace can be smoothed by including industry partners in the design and execution 

of the training models.

We believe that embracing a rules-and-tools approach to the professionalization of cybersecurity leads 

naturally to addressing all of these aspects.

Sincerely,

Barbara Endicott-Popovsky, Ph.D.

Executive Director, Center for Information Assurance and Cybersecurity 

Affiliate Professor University of Washington Bothell Computer Science and Systems 

Affiliate Professor, Master of Infrastructure Planning and Management

Editor, Journal of Digital Forensics, Security and Law www.jdfsl.org

Fellow, American Academy of Forensic Scientists 

Fellow, Aberystwyth University, Wales

Center for Information Assurance and Cybersecurity in Education

University of Washington Bothell

endicott@uw.edu

www.uwb.edu/ciac

Center for Information Assurance and Cybersecurity in Research

Applied Physics Lab

Benjamin Hall 616 NE North Lake Place, Room 525

Seattle, WA