Page 1 of 14

NICE Framework Competencies:

Moving from Concept to Implementation

Workshop Report

Karen A. Wetzel

National Initiative for Cybersecurity Education

National Institute of Standards and Technology

May 5, 2021

nist.gov/NICE
i

Table of Contents 

OVERVIEW..............................................................................................................................................................I

DAY 1: UNDERSTANDING NICE FRAMEWORK COMPETENCIES...............................................................................2

DAY 2: PUTTING COMPETENCIES INTO PRACTICE ..................................................................................................7

NEXT STEPS.......................................................................................................................................................... 12

Cover page photo credit: depositphotos/VitLes, https://depositphotos.com/346967482/stock-illustrationabstract-hexagon-background-technology-polygonal.html
NICE Framework Competencies

Workshop Report

Page 1 of 14

Overview

The National Initiative for Cybersecurity Education (NICE) published its first revision of the NIST Special 

Publication (SP) 800-181, the Workforce Framework for Cybersecurity (NICE Framework), in November 

2020. The NICE Framework is a fundamental reference for describing and sharing information about 

cybersecurity work. In this revision, Competencies were introduced to put into use the Framework’s 

core building blocks: Task, Knowledge, and Skill (TKS) statements.

Adding Competencies to the NICE Framework is a response to a growing need for skilled workers in this 

field and is reflective of what is happening in the cybersecurity profession at large—a shift towards a 

skills- and competency-based approach in recruitment and hiring practices and workforce development. 

Competencies offer a high-level perspective on cybersecurity work and, importantly, are defined via an 

employer-driven approach, are learner-focused, and are observable and measurable. Competencies 

provide a means of assessing a learner’s capabilities in a defined space while increasing alignment and 

coordination between employers, learners, and education and training providers.

NICE partnered with the CAE in Cybersecurity Community to develop a virtual workshop, entitled “NICE 

Framework Competencies: Moving from Concept to Implementation,” in order to better learn from the 

NICE community about their goals in using the Competencies, as well as to identify more details on what 

might still be needed in order to effectively implement their use. This workshop engaged learners in 

active, participatory sessions as a way to gain insights on how stakeholders expect to utilize the NICE 

Framework Competencies, including determining the greatest challenges and benefits to

implementation. As a result, the community provided perspectives and insights that will inform next 

steps in the development and support of the NICE Framework Competencies.

Prior to the workshop, the NICE Program Office published the draft NIST Interagency or Internal Report 

(NISTIR) 8355, NICE Framework Competencies: Assessing Learners for Cybersecurity Work, which

provides more detail on what NICE Framework Competencies are, including their evolution and 

development and example uses from various perspectives. Released in conjunction with NISTIR 8355 is a 

draft NICE Framework List of Competencies that provides a proposed list of 54 Competencies for the 

cybersecurity workforce.

The workshop was held over two days:

Day 1: Understanding NICE Framework Competencies

On the first day of this workshop, participants began by taking a closer look at what 

competencies are generally, how that translates to the NICE Framework Competencies model, 

and what gaps competencies can fill when it comes to cybersecurity workforce development.

Small group breakout sessions focused on use case development from a variety of stakeholder 

perspectives, and interactive sessions worked to build consensus around key issues.

Day 2: Putting Competencies into Practice

Building from the outcomes of day one, the second day took a closer look at use cases as a way 

of shifting from concept to application, focusing on questions around assessment and 

proficiency levels, to ultimately end with greater clarity around what is needed to put NICE 

Framework Competencies into practice.
Page 2 of 14

The workshop aimed at attracting broad representation from industry, government, and learning 

providers. Employers (both industry and government) will be central to helping identify and implement 

Competencies needed by today’s cybersecurity workforce, while higher education, training, and 

certification providers may create content or assessments for learners in alignment with the NICE 

Framework Competencies. Sixty-one (61) registrants represented industry (23%), academia (34%), and 

government (43%). 

Day 1: Understanding NICE Framework Competencies

The first day began with a presentation by Karen A. Wetzel, Manager of the NICE Framework, on “Why 

Competencies?” This presentation shared information about what Competencies have to offer, as well 

as the reasoning behind the incorporation of Competencies into the NICE Framework. It then provided 

more details on how NICE Framework defines Competencies and how they might be used in this 

context. This presentation provided a lead-in to an active discussion session with participants about how 

they perceived competencies coming into the workshop, what seems promising about competencies, 

and to raise any major questions they might have about them before moving forward. This discussion 

addressed topics such as:

• Competencies and their uses are still fairly undefined; there is need for a common language to 

help with understanding. 

• There is currently a divide between academia and employers around the definition and 

assessment of competencies; integrating them into the NICE Framework may help bridge that 

divide. 

• There are a number of potential applications of competencies—for instance, in apprenticeships, 

competitions, and academic programs—and the NICE Framework Competencies will need to 

work across these, as well as across industries.

• It would be helpful to further clarify how NICE Framework Competencies differ from Work 

Roles, both in definition and use.

• It would be useful to have the NICE Framework Competencies’ associated TKS statements 

aligned to them (as is intended following the NISTIR public comment period). 

• A future goal should be to package NICE Framework Competencies into the ecosystem, for 

instance in learning and employment records (LERs). 

Day 1 Breakout Sessions: Identifying Stakeholder Use Cases

Breakout sessions led participants through the consideration of top Competencies use cases for each of 

three primary stakeholder groups: employers, learners, and education and training providers. Each 

breakout group was assigned a single stakeholder perspective and conversations were led by workshop 

facilitators with support from NICE staff. Each group was asked to identify several top use cases and

then select one in order to walk through it in more detail in order to understand how NICE Framework 

Competencies will likely be used, what benefits implementation might provide, and what work is still 

needed to reach success. 

Employers

Top scenarios identified by this group included use of the NICE Framework Competencies for the 

following:

• Drafting job descriptions that will attract qualified candidates, as well as evaluating new hires

• Establishing a system to identify workforce capabilities in order to determine where training 

opportunities are needed for upskilling
Page 3 of 14

• Specifying team requirements via staff skills evaluated by human resources and management 

• In strategic planning to diversify ways of thinking and increase innovation

• In the evaluation of vendors in order to outsource cybersecurity work

Ultimately, this group determined to focus on the scenario around specifying team requirements. When 

asked to describe what victory might look like in this scenario, the group described it as: “Streamlined 

team and agility and distributed leadership.” Additionally, the group indicated that success would 

increase productivity, improve morale, and decrease turnover. These would be enabled in part by the 

more successful onboarding and retention efforts that a competencies-based hiring and workforce 

management process might enable. 

The group also identified many challenges that would need to be addressed to reach this success stage. 

When looking at the list of challenges that this breakout group provided, they could be sorted into the 

following broad categories:

• Additional Effort Required

o Too complex

o Too time consuming

o Lack of comprehension

o Difficulty compiling globalized dictionary

• Established Processes Needed

o Lack of standardized assessments 

o Inability to measure results

o Inability to measure ROI

• Existing Problems

o New technology needs

o Employee turnover 

o Lack of executive buy-in

o Cost of hiring permanent employee vs contractor

o Experience requirement new graduates face

Ironically, the list of existing problems here are identified as challenges but could possibly also be 

considered through a different lens: many of these might actually be addressed, if not resolved, by a 

coordinated and systematic implementation of Competencies. For instance, employee turnover might 

be lessened if Competencies are used to align applicant capabilities (either through Competenciesaligned coursework or via other assessment) with position requirements, ensure more rewarding and 

successful performance while in a position because of better career fit, as well as establishing career 

growth paths in the organization (including offering training) in areas identified by Competencies.

Regardless, the list that this group identified does indicate that a shift in this direction will need 

support—both internal (e.g., with executive buy-in) and external (via resources to help encourage buyin, including recommended processes). The breakout group was directly tasked to identify what 

supports might be needed to deal with the identified challenges. This group indicated that the following 

would be required before reaching success; they have been sorted here into broad categories.

• Tools

o Standardized assessments (including self-assessments)

o Standardized job description template

o Development of micro-credentials and learning and employment records (LER)
Page 4 of 14

• Workforce Management Adjustments

o Provision of training opportunities (and time to take advantage of these) for staff

o Organized career pathways

• Promotion 

o Conferences

o Visibility and marketing for cybersecurity

o Addressing lack of knowledge about job roles in cybersecurity

And, overall, the group agreed that the path toward success would need to be flexible while also

establishing an up-to-date process for stakeholders who want to engage.

Education and Training Providers

Top scenarios included the use of NICE Framework Competencies for the following:

• Use of Competencies in courses for students to learn from

• Learning assessments tied to NICE Framework Competencies

• Competencies to provide guidance to both educators and industry to bridge the gap between 

the two when matching for apprenticeships

Ultimately, this group determined to focus on the scenario that focused on how NICE Framework 

Competencies could be used with cybersecurity apprenticeships. When asked to describe what victory 

might look like in this scenario, the groups shared that a successful integration of NICE Framework 

Competencies with apprenticeship programs would bring industry and training providers to a consensus

on what demonstrable skills are needed, would establish commonly agreed-upon language that could be 

used for job descriptions, and would integrate both soft and essential skills. In addition to these top 

indicators of success, other factors included a better understanding of cybersecurity workforce needs in 

various industries and stronger correlations between knowledge units (KU’s) for the Centers of 

Academic Excellence (CAE) in Cybersecurity and NICE Framework Competencies.

As with the employer-focused breakout group, numerous hurdles must be addressed prior to achieving 

success. The list of challenges they provided could be sorted into the following broad categories:

• Employer Buy-in

o To get employers to buy into apprenticeship

o Only a few employers have signed up for this model

o Need employers to adopt common taxonomy (Work Roles or Competencies) when 

describing a position’s requirements

• Establish Processes Needed

o Prescription to use Competencies, get them adopted

o Need to map CAE curricula to not just KU’s but concrete elements of NICE Framework

o Need to develop learning assessments for CAE students that validate a learner’s ability 

in Competency areas and that, most importantly, employers will trust

o Facilitated coordination between key players

In addition to the above, the group also noted the impact of the pandemic on apprenticeships, as workfrom-home situations have eliminated, or at least suspended, many internships. It is generally expected 

that many organizations will likely be more flexible with work-from-home or hybrid work models in the 

future and may have a continuing impact on the availability or structure of apprenticeships and 
Page 5 of 14

internships. Finally, one item that the group listed as a challenge is in fact more of a success outcome: 

“Adopting these [Competencies] helps assessing outcomes, qualifying for a job.” 

This group identified three items needed to move toward success:

• Clear ways to assess Competencies

• Strategies to deepen and enhance ties between education, training providers, and industry

• An ability to use the NICE Framework as a tool for training

Learners

The NICE Framework defines learners broadly, as all those performing cybersecurity work—including 

students, job seekers, and employees. The breakout group that was tasked to consider NICE Framework 

Competencies from this perspective identified the following top scenarios: 

• Employee-based self-assessment against established role expectations

• To help in candidate expectations

• Establishing organization role and proficiencies

• Skills maturity assessment

• To identify relevant training 

Ultimately, this group determined to focus on self-assessment. When asked to describe what victory 

might look like in this scenario, they described the following: 

• Human resources looks beyond traditional, degree-based measures to open up opportunities 

and broaden applicant pools

• Business units, managers, and employers can better fit learners to career paths

• Learners better understand what employers want

• Learners have the opportunity to self-assess and accurately measure against Competencies

In order to reach this stage, however, the group identified the following challenges that will need to be 

addressed: a clear understanding of Competencies that can be used across internal business units (e.g., 

for human resources and for managers) and that trust needs to be built so employers know students are 

developing Competencies that truly meet today’s cybersecurity workforce needs. The breakout group 

identified the following solutions: 
Page 6 of 14

• Increase use of the NICE Framework 

• Provide more support to how the NICE Framework can be used by both small and large 

businesses

• Define a process for organizations to define expected Competencies that can then be 

incorporated into curricula

Sharing Out

Following the breakout sessions, the groups came together to share what they discussed and reflect on 

common themes. One significant area of agreement was the need for common language in order to 

unite academia, industry, and government—the goal of the NICE Framework. Overall, themes that came 

to the top for benefits, challenges, and solutions were shared out and are summarized in Table 1: Day 1 

Breakout Summary.

Table 1: Day 1 Breakout Summary

Benefits Challenges Solutions

• Enhanced connection 

between stakeholders

• Modularity: ability to scale 

across organization sizes and 

types 

• Greater understanding of 

position needs

• Improved assessment and 

efficiency

• Increased employability and

better hires, improved teams

• Improved capabilities—

including soft skills and 

strategic thinking (not just 

technicians)

• Processes:

o How to align assessment 

with varying industry 

demands

o Need to develop 

established metrics, 

proficiency levels, and 

ongoing and dynamic 

assessments

o Need to maintain

Competencies for 

currency and relevance

• Acceptance and Buy-In

o NICE Framework 

Competencies are not 

yet fully understood

o Need for improved trust 

and enhanced 

relationships between 

stakeholders

o Slow adoption or refusal 

to adopt Competency 

approach by employers

• Competencies should be 

prioritized for educational 

requirements

• Use Competencies to:

o Connect challenges to 

course outcomes 

o Help define exit exams

o Align with CAE KUs and 

certifications

o Use as part of the job 

interview process
Page 7 of 14

Day 2: Putting Competencies into Practice

The second day of the workshop looked more closely at proficiencies and assessment in the context of 

the NICE Framework Competencies. In order to focus the conversation, breakout groups were asked to 

consider these topics from the perspective of a specific use case, pulling from day one. 

The day was kicked off by a session on “Understanding Proficiencies and Assessment” with guest 

speakers Lisa Dorr (Senior Talent Management Strategist, Cybersecurity and Intelligence Talent 

Experience (CITE) Division, Office of the Chief Human Capital Officer, Department of Homeland Security) 

and Max Shuftan (Director, CyberTalent Programs, SANS Institute). Ms. Dorr provided context as to how 

proficiencies can be used in setting targets and measuring capabilities for Competencies. Mr. Shuftan 

then shared with attendees promising practices in cybersecurity talent assessments for recruiting, 

upskilling, and retraining. 

Day 2 Breakout Sessions: Proficiencies and Assessment

Following this introduction to how proficiencies and assessment might be used to forward the 

applicability and outcomes enabled by Competencies, the attendees were again split into three 

breakout groups. For this day, each group was assigned a specific use case that they were asked to use 

as the foundation for their conversations, one for each of the three stakeholder perspectives introduced 

on the first day; these were then fleshed out by each group. They included:

• Employer Perspective: Tracking Workforce Capabilities. This use case includes NICE Framework 

Competencies integrated into performance plans, talent acquisition forms, interviews, continual 

learning programs (and non-standard learning), employee assessment, and capability gap 

analysis.

• Education and Training Provider Perspective: Tying curriculum to NICE Framework 

Competencies. This use case is about using the NICE Framework Competencies as a curriculum 

framework from which programs of study and courses can be developed. By tying courses to 

one or more Competencies, students can be sure to develop necessary knowledge and skills and

demonstrate their ability to perform tasks.

• Learner Perspective: Self-Assessment. The breakout group for this perspective narrowed down 

this topic to focus on adult reskilling, where NICE Framework Competencies are used in applying 

aptitude for entry-level skills.

Each group was asked to consider how proficiencies and assessment would play a role in their use case. 

For proficiencies, the groups brought forward the following concepts summarized in Table 2: 

Proficiencies Breakout Groups Summary, below.
Page 8 of 14

Table 2: Proficiencies Breakout Groups Summary

Proficiencies 

Questions Employers Education and Training Providers Learners

How can they benefit 

the use case?

• Establishing 

expectations 

• Determining priority 

of work and micro vs 

macro baselines

They can be used to assess 

proficiency in performing a 

singular task or for a 

specific knowledge or skill 

in a particular Competency

They can help learners 

develop strong problemsolving skills, encourage 

interest in learning new 

things, help develop 

specialized study, provide 

an inventory of areas 

someone is interested in, 

and help determine 

programs for a student to 

go into

What scale (or levels) 

would be needed and 

why?

5-tier scale:

• Interested

• Foundational

• Intermediate

• Advanced

• Expert

3-tier scale: 

• Basic (foundational)

• Intermediate

• Advanced

A scale that 

accommodates both 

technical and managerial 

skills and that works with 

a 

matrix of capabilities into 

careers for applicants

Would proficiencies 

apply to the NICE 

Competency overall, at 

a component (e.g., 

statement) level, or 

both, and why?

There are benefits to a 

macro and micro 

approach: 

• Macro allows more 

flexibility, avoids 

assessment 

exhaustion

• Micro can provide 

more averaged 

assessment but may 

create assessment 

exhaustion

Evaluations should prove 

competency overall, while 

also drill down to align to 

TKS. 

Component level is a 

more easily understood 

concept and provides 

granularity needed to talk 

across the field. 

What kind of 

proficiencies scale 

would be useful? 

• A standard scale 

• A suggested, 

adaptable model 

• No model; created 

case-by-case

A model that allows for 

flexibility and adaptability

is needed, as users will 

vary; for instance, 

government has more “red 

tape” than private 

industry, and some 

organizations may be more 

mission driven while 

others are more process 

driven 

A license model would be 

most useful

A standard scale that will 

be adopted in the same 

way across the board 

would be most useful in 

this use case
Page 9 of 14

As can be seen by the above table, although there are some similarities in answers, there is not 

complete agreement. However, looking at proficiencies through the lens of a specific stakeholder use 

case provided some clarity that will be used as next steps are taken and additional resources in support 

of the NICE Framework Competencies are developed. 

A similar approach was used to consider the all-important topic of assessment. Results can be seen in 

the Table 3: Assessment Breakout Groups Summary, below. 
Page 10 of 14

Table 3: Assessment Breakout Groups Summary

Assessment Questions Employers Education and Training Providers Learners

How can they benefit the use case? Assessments provide a multitude of 

benefits. They: 

• Provide a baseline

• Categorize where they are in the 

NICE Framework

• Help project future needs 

• Increase employee retention 

through growth and direction

• Improve employee reallocations

• Establish current gap analysis

• Identify in-demand

Competencies and top hiring 

needs

Assessment can be formative or 

summative (of the learning program, 

course, or student), as well as selfassessment

It offers assurance of consistency of 

ways assessment is done

Provides a student perspective and

can show an organization what the 

person has achieved so far

Revisiting assessments and regular 

testing can provide additional 

information over time

How would you determine what 

type of assessment to use in this use 

case?

This would need to be done at the 

employer level, depending on the 

motivation of the assessment, and 

may be factor based and 

circumstantial; assessments may be 

separated by phase (e.g., during 

recruitment phase, promotion)

However, a rubric is needed as 

guidance to help organize subjective 

and objective assessments. Guidance 

could be provided to employers on 

how to use assessments and validate 

which assessments have merit and 

value

Assessments will vary depending on 

what is being assessed; for instance, 

knowledge-based vs. performancebased assessment; skills maturity 

assessments; or multiple 

assessments used to diversify the 

portfolio of information on a 

candidate

Assessments may vary depending on 

what is being assessed, for instance, 

aptitude vs. knowledge vs. 

achievements

Useful tools for assessment might 

include:

• Recurring assessment tool to be 

used over time (e.g., annually)

• Desirability test

• Automated set of tests that are 

updated regularly
Page 11 of 14

Table 4: Assessment Breakout Groups Summary, Continued

Assessment Questions Employers Education and Training Providers Learners

What is needed to ensure effective, 

credible assessment?

• Defined criteria for common 

circumstances (e.g., internal vs 

external assessment, 

recruitment vs development 

phase, etc.)

• More information about which 

assessments create trust

internally vs externally

• Increased validity brought by 

technical expertise needed to 

develop the assessments

• A balance of subjective and 

objective assessments is needed

Access to tools and assessment 

approaches that are: 

• Reliable

• Validated 

• Standardized

• Scalable 

Assessment tied to accreditation

Access to:

• Best practices unique to 

academia, industry, government

• Timely, triangulated research

• Qualitative tool (critically 

reflective)

• Community of interest 

How would assessment results be 

used by the organization?

In this use case, assessment 

outcomes would be used to: provide 

training, fill gaps, identify trends, 

promote staff, etc.

In this use case, outcomes could 

influence student decisions on which 

programs to attend, provide 

documentation students can present 

to employers for proof of ability (via 

a portfolio or LER), and identify 

individual or curricular areas for 

improvement

In this use case, outcomes can help 

learners decide a program of study, 

for personal or professional growth, 

and in tracking development and 

gaps
Page 12 of 14

Some additional common threads were identified when the groups came together to share their 

conversations with other participants, such as if there could be a recommended approach to proficiency

or an adaptable assessment model that could be revisited, evolve, and be tailored for local 

circumstances. At the same time, assessment-related recommendations include: assessments should be 

repeatable in order to gauge change over time; a variety of assessment types and their strengths and 

weaknesses should be outlined; and assessment results should be used to increase their value, 

potentially through story-telling. 

Next Steps

The information shared in this workshop, from presenters and participants alike, will inform future steps 

that the NICE community can take to further refine and advance understanding of the NICE Framework

Competencies and how they can be used. Along with comments received on the draft NISTIR 8355, NICE 

Framework Competencies: Assessing Learners for Cybersecurity Work and the draft NICE Framework List 

of Competencies, these community insights will help ensure that the Competencies are developed with 

the guidance and support needed to ensure that they are useful and effective implementations of the 

NICE Workforce Framework for Cybersecurity.