IT Security Essential Body 

Knowledge (EBK): A Competency and Functional FramSecurity Workforce Development 

Information Security and Privacy Advisory BDecember 7, 2007 
Training & Education:

Program Goals and Objectives 

National Strategy to 

Secure Cyberspace 

Priority III: 

National Cyberspace 

Security Awareness and 

Training Program 

NCSD Ed

Trainin

Prog

Foster adeq

education 

support the 

secu

 Improve cyber security education for IT pr Increase efficiency of existing cyber secur

programs

 Promote widely-recognized, vendor-neutra

certifications
Training & Education:

Key Programs 

 National Centers of Academic

Excellence in Information AssuranceEducation - CAEIAE Program

 Federal Cyber Service: Scholarship for

Service 

- SFS Program

 IT Security EBK: A Competency and F

Framework for IT Security Workforce D
Origin: IT Security 

Workforce Development Init

 President’s Critical Infrastructure Protection Board 

IT Security Certification Working Group Recommenda

 National Infrastructure Advisory

Council (NIAC)

 National Strategy to Secure Cyberspace,

Priority III

Nationa

F
IT Security EBK: Objectives 

 Ensure that we have the most qualifie

appropriately trained IT security workpossible

 Establish a national baseline represe

essential knowledge and skills that IT practitioners should possess to perfor

 Advance the IT security landscape by 

uniform competency guidelines
IT Security EBK: Framework Mod
IT Security EBK: Contributing Re

 DoD’s Workforce Improvement Program 

 National Instit

(WIP) – Directive 8570.1 IA Training Technology Sand Certification Framework 

 FIPS Publicat

 Committee on National Security Security Requ

Systems (CNSS) Training Standards Information an

 DoD Physical and Personnel Security 

 ISO/IEC Stan

program policy 

 Models (COB

 Federal Acquisition Regulation 

 Microsoft Ope

 Various Federal agency program plans  Position Descriptions 
IT Security EBK: Methodology 

Develop notional competencies using DoD IA SkIdentify functions from resources and critical worand map to competencies Identify key terms and concepts for each competIdentify notional IT security roles Categorize functions as Manage, Design, ImplemMap roles to competencies to functional perspec
IT Security EBK: Functional Per

ManageDesignImplementEvaluate

Work functions that co

overseeing a program or technsecurity program at a high levecurrency with changing risk and scoping a program or developiand processes that guide work putting programs, processes, oaction within an organization assessing the effectiveness of or process in achieving its obje
IT Security EBK: The Framewo

14 Competency Areas 

 Definitions to specify parameters and avoid overla Work functions categorized by functional perspect

Key Terms and Concepts 10 Function-Based IT Security Roles 

 Clusters of organizational positions/jobs Example job titles provided for clarification Role charts illustrate the 3-dimensional model in a 
IT Security EBK:

Framework Components 

 14 Competency Areas  Key Terms and Concepts 10 Function-Based IT Security 

Competency, Role and Function 
IT Security EBK: 14 Compete

 Data Security Digital Forensics Enterprise Continuity Incident Management IT Security Training and

Awareness

 IT Systems Operations and

Maintenance

 Network Security and

Telecommunications

 Personnel Securi Physical and Env Procurement Regulatory and S Risk Managemen Strategic Manage System and Appl
• Policy

• Privacy Principles/F

Practices

• Procedure• Regulations• Security Program• Standards• Validation• Verification

IT Security EBK:Regulatory and Standards Compliance 

Refers to the application of the principles, policies, and procedures tha

to meet applicable information security laws, regulations, standards, astatutory requirements, perform industry-wide best practices, and achi

• Manage: Establish and administer a risk-based enterprise informa

addresses applicable standards, procedures, directives, policies, r

• Design: Specify enterprise information security compliance progra• Implement: Monitor and assess the information security complian

personnel in accordance with enterprise policies and procedures

• Evaluate: Assess the effectiveness of enterprise compliance prog

applicable laws, regulations, standards, policies, and procedures

security program goals. 

Key Terms and Concepts: 

• Assessment• Auditing• Certification• Compliance• Ethics• Evaluation• Governance• Laws

Functions: 
IT Security EBK: 10 Roles 

 Chief Information Officer Digital Forensics Professional Information Security

Officer/Chief Security Officer

 IT Security Compliance

Professional

 IT Security Engineer

 IT Systems O

Maintenance 

 IT Security Pr Physical Secu Privacy Profe Procurement 
IT Security EBK: Role Chart 

Role: IT Security Compliance Professional Role Description:The IT Security Compliance Professional is responsible for overseeing, ev

compliance issues pertinent to the organization. Individuals in this role perencompassing compliance from an internal and external perspective. Such conducting internal investigations, assisting employees comply with interna

serving as a resource to external compliance officers during independent a

Compliance Professional provides guidance and autonomous evaluation o

management. 

Competencies/Functional Perspectives: 

 Data Security: Evaluate  Personnel Security

 Digital Forensics: Evaluate  Physical and Envir

 Enterprise Continuity: Evaluate  Procurement: Eva

 Incident Management: Evaluate  Regulatory & Stan

 IT Security Training and Awareness: Evaluate Implement, Evalua

 IT Systems Operations & Maintenance: Evaluate  Risk Management Network Security & Telecommunications: Evaluate  Strategic Managem

 System and Applic

Job Titles:  Auditor  Inspector / Investigator  Compliance Officer  Regulatory Affairs Analyst  Inspector General 

IT Security EBK:

Strengthening the IT Security 

Professional 

Development 

IT Security EBK 

Training 

Education 
IT Security EBK Testimoni

Federal Register Notice Fee

“I found this to be an excellent framework with which as we continually deal with security issues. Job well d

- Maryland Judiciary, Admini

“The document is well thought out and simple to read. done” - CISSP, Hickm

“It is a very well researched and formatted document 

common framework that is greatly needed. I applaud tinto this and hope that it will get traction out there in tcommunity” 
IT Security EBK Testimoni

Federal Register Notice Fee

“I commend you all for taking on such a challenge...with (and now privacy) certifications in the country, it is a reaable to craft a document as you all have managed to do -- 

- CEO, SECNAP Network Security (and IB

“This is straight forward, logical, and just downright mak

to see this permeate throughout the government.” - SAIC Integrated S

“A good document that is needed in the information securdeveloper of Information Security/IA curriculum and as asimple standardization would definitely be a step in the ri

- Information Assurance Traini
Contact Information: 

Brenda Oldfield Program DirectorTraining and EducationCS&T-National Cyber Security Division (703) 235-5184brenda.oldfield@dhs.gov