1

NICE Community Coordinating Council

Meeting Agenda

February 22, 2023 | 3:15-5:00 p.m. ET

I. Introduction and Ground Rules – NICE Program Manager Susana Barraza

• The NICE Community Coordinating Council was established to provide a mechanism in 

which public and private sector participants can develop concepts, design strategies, 

and pursue actions that advance cybersecurity education, training, and workforce 

development. 

• Members are encouraged to participate in the meeting via the platform chat space and 

the Q&A space.

• Reminder: The meeting it is not intended for marketing or other commercial purposes.

II. Opening Remarks

a. Interim Academic Co-Chair – Paul Bingham, Vice President and Dean, College of 

Information Technology, Governors University

• Continuing with the integration between academia and industry with respect to 

learning opportunities, students are looking to highlight their skills when applying 

for jobs as well as standardize nomenclature and credentials, and how they are 

shared and verified within the industry. 

• The number of digital credentials increased by 73% over the past few years, which 

was about 75 million digital credentials provided in one year. Being able to earn 

badges and credentials may prove to be a motivator for students continuing on to 

earn their degrees.

• A recent working paper from Columbia University Teachers College looked at dual 

enrollment programs, where high school students take college courses for credit.

Community Colleges may benefit from this, as students are more likely to enroll in 

the colleges where they are earning their dual enrollment credit.

b. Government Co-Chair – Rodney Petersen, Director of NICE

• There is a new Executive Order (EO) on Further Advancing Racial Equity and Support 

for Underserved Communities through the Federal Government. It is the second in a 

series of Executive Orders that shows the Federal Government’s commitment to 

diversity and equity inclusion. The EO:

• Embeds equity into federal policies, programs and activities as well as, 

collaborates with underserved communities and helps to build equity within 

those communities. 

• Advances equitable procurement and civil rights through diversity.
2

III. Standing Items

a. Report Roundup – Learning from Good Ideas 

Global Cybersecurity Outlook 2023 report 

Presented by Gretchen Bueermann and Natasa Perucica, World Economic Forum

URL:https://www3.weforum.org/docs/WEF_Global_Security_Outlook_Report_2023.pdf

• The speakers reported on the Global Cybersecurity Outlook 2023 Report and 

shared information on the cybersecurity labor gap.

• A quantitative survey as well as an in-depth qualitative survey were completed, 

interviewing over 300 cybersecurity and business leaders. 

• Interested in the gap between business leaders (board members/CEOs) and 

cybersecurity leaders (ISO/CSO) and how they align on certain issues. 

• In 2022, ten percent of cybersecurity leaders stated that people were missing 

critical people skills, but business leaders stated zero percent. 

• Ten percent of business leaders state that they are not ready to deal with 

cybersecurity issues. The hope is that changes by next year’s survey.

• More than half of IT and technology organizations reported they feel they have 

the skills they need today. Critical infrastructure industries state that they are

missing the skills needed to perform their job duties. 

• With 3.4 million open job roles (globally), concrete action is necessary to fill the 

gap. The top 3 “issues” with filling the gap are:

▪ Leaders need to actively support diversity, equity, and inclusion and hire 

from a diverse candidate pool.

▪ Making cybersecurity available through the expansion of the talent 

search. Move beyond traditional parameter searches and more 

accessible job postings creating an environment that enables inclusivity.

▪ Prioritize aptitude over technical skills.

• An initiative to bridge the cybersecurity skills gap will take place in the coming 

months. It will look at:

▪ Building a strategic framework to explore the different components of 

the cybersecurity career cycle. Examine the attractiveness of a 

cybersecurity profession, as there are unknowns that need to be 

clarified. 

▪ Reviewing the cybersecurity education and training programs, as some 

do not correspond to the landscape of the workforce. 

▪ Hiring cybersecurity professionals and prioritizing the skill set and not 

formal education. 

▪ Retaining employees and help them build skills for cybersecurity 

careers.
3

b. Strategy Stories – New Developments that align to NICE Strategic Plan

Cybersecurity Across Disciplines (CyAD)

Presented by Corrinne Sande, Whatcom Community College

URL: https://ncyte.net

• Corrinne Sande is the Executive Director for the National Cybersecurity Training 

and Education Center (NCyTE). The National Science Foundation (NSF) Advanced 

Technological Education (ATE) funds NCyTE. 

• Over August 1 - 2, 2023, the Cybersecurity Across Disciplines (CyAD) conference 

will be held in collaboration with Dr. John Sands of Moraine Valley Community 

College.

• The goal of the conference is expanding cybersecurity awareness and 

knowledge across other STEM disciplines at community/technical colleges.

Additionally, to help cyber faculty understand discipline-specific cybersecurity 

needs. CyAd topics will include: 

▪ A basic introduction to cybersecurity training for ATE Center community 

college faculty in other disciplines.

▪ Breakout workshops will also review critical aspects of cybersecurity 

applied to: 

o Manufacturing/Automation

o Critical Infrastructure

o Business

o Healthcare and Life Sciences

o Automotive/Autonomous Systems.

▪ Schedule topics that come in through a call for proposals.

▪ Create customized training, case studies or scenarios around each 

discipline.

▪ Bring in demonstrations of resources and tools.

• Advanced workshops have been done on manufacturing and automation with 

Florida Advanced Technological Center (FLATE). Additional CyAD workshops will 

take place in March and May. Information can be found through the following 

link: https://ncyte.net. 

• Q&A: 

Q: For those who are interested in joining the upcoming conference, how would 

they go about getting information?

A: It will be in the newsletter. Currently in the process of putting it on the 

website along with a registration form. Travel stipends will be provided to 60 

faculty.
4

c. Framework Feature – Applications and Uses of Workforce Framework for Cybersecurity

Using the NICE Framework in Montana, Andy Hanks, State CISO, State of Montana

• Montana had been using the NICE framework for four years primarily to grow 

the workforce program at the time Andy became the CISO for the state. They

wanted to prioritize gaps and needed a definitive description of cybersecurity

nomenclature. 

• The framework is primarily used for employee self-assessments, workforce 

development, program management, and program development, with respect 

to the Information Security and Data Privacy program.

• Starting with the NICE Framework spreadsheet table of contents page, columns 

for proficiency were added for when employees complete their self-assessment. 

The links on the table of contents page allow the employees to find more details 

about the work role descriptions.

• In another column, with respect to the work role, employees are to indicate 

their responsibility: whether primary, secondary, or no responsibility.

• An additional column is added to see if the employee is interested in the work 

role. They are seeing more interest in offensive security so that they can be 

ethical hackers. It allows them to understand an employee’s interest for future 

training and education paths.

• The assessments are reviewed by management with the employee. Proficiency 

targets are established so they know what development needs to take place and 

how to fill the gaps in their cybersecurity education. If an employee is listed as a 

primary or secondary for a work role, the expectation is their proficiency to be 

at a level two or three. 

• Formalized training opportunities are made available via formal external 

training and cross training within the organization. The later reinforces

Knowledge, Skills, Task (KST) with the employee in training.

• The program manager reviews the data to assess the threats and then uses it to 

prioritize the function work role gaps based on the risks identified. They look at 

what needs to be done to fill the gap by examining employees closest to filling 

the roles and upskilling them. They also consider employees interested in filling 

those roles and upskill them as well. If necessary, they will use the KSTs from 

the framework and hire new employees to fill the gap using the NICE 

framework.

• Program development is used by upskilling and maintaining the skills of the 

current staff, keeping and retaining employees and allowing their employees to 

grow their careers. If particular employee retention is not possible, then a risk 

ranking of work roles is conducted so they maintain proper staff. 

• Allowing employees to upskill and learn different skills retains employees. Once 

certain aspects of cybersecurity are covered they can go from being reactive to 

a more proactive approach and search for threats prior to them reaching the 

environment. 

• Cultivating apprenticeships and internships with colleges and universities is key 

in getting new talent within an organization.
5

d. Research Review- Driving Research on Effective Practices

Comparison of Public and Private Sector Cybersecurity and IT Workforces

Presented by Sasha Romanosky and Ryan Johnson, RAND Corporation 

URL: https://www.rand.org/pubs/research_reports/RRA660-

7.html?utm_source=AdaptiveMailer&utm_medium=email&utm_campaign=7014N0000

02G9qlQAC&utm_term=00v4N00000kS1L7QAK&org=1674&lvl=100&ite=272356&lea=1

775294&ctr=0&par=1&trk=a0w4N000009enRUQAY

• The National Defense Authorization Act (NDAA) requested a zero-based review 

of the Department of Defense (DOD) cybersecurity and IT workforces. The 

initial request was for an inventory of people in different roles, the gaps in those 

roles and a way to modernize the workforce. 

• It called for an analysis and comparison between DOD and the private industry 

workforce and how the DOD compares to the work being done in the private 

industry. 

• Created a universal taxonomy of workforce roles between DOD and the private 

sector. It is not precise, but with proper documentation and assumptions noted, 

provides the idea of what comparisons were made based on allocation and 

salaries in the defined work roles.

• Key Findings:

o The public sector emphasizes computer and information technology (IT)

support and administrative roles. The private sector emphasizes the 

allocation of software development and testing roles. 

o The public sector tends to hire more IT support workers and pays 

people in those categories more. The public sector is more customer 

facing and appeasing than the private sector.

o The frameworks being used are not the same. They were unable to 

match some job roles one-to-one, making comparisons difficult. No 

analysis will ever be perfect.

o The private sector positions tend to have ambiguity in work performed. 

The DOD primarily relies on work roles while the private industry

primarily relies on work title. They measure different things so the data 

can be skewed.

• Q&A:

Q: Would you consider lining this to CIP codes to see the number of students 

aligning to these work roles?

A: No, we didn’t do that, but it’s a great idea. Being able to account for an 

emerging work force and align them somehow. 

Q: Did your analysis of salary by role account for different levels of expertise in 

the subject area?

A: No, they did not. We were limited by the data available from DLS, which was 

comprehensive, but not exhaustive.

Q: In the balance between public and private, where would the jobs for 

government contractors be?

A: I do not think they would be accounted for in the public sector, because it is 

generally not accounted for, so probably in the private sector.
6

IV. Working Group Updates

a. Promote Career Discovery

Co-chair: Keith Davis, Koinonia Family Life, Inc

• Making progress discussing and planning around the ambassador program. Excited 

about rolling this out in the near future. 

• If members are interested in programs of ambassadorship please reach out to the 

co-chairs.

• Site: Promote Career Discovery Working Group | NIST

• Next meeting: March 15, 2023 at 3:30 p.m. ET

b. Transform Learning Process

 Co-chair: Dr. Donna Schaeffer, Marymount University

• There are currently two active projects:

o The first project is focused on diversity and inclusion resources, which will 

culminate in a spreadsheet of resources such as training, apprenticeship 

programs, scholarship opportunities, etc. Additionally, a two-pager will be 

created on: 1.) guidance on how to apply for internships and scholarships 

and 2.) pathways focusing on adjunct professors. 

o The second project is looking to gain more information for CAE schools on 

how they use performance-based assessments within their academic 

programs.

• Suggested starting another Community of Interest (COI) on ‘Diversity and Inclusion’

by working in a joint meeting with the K12 community. 

• Site: Transform Learning Process Working Group | NIST

• Next meeting: March 14, 2023 at 2:00 p.m. ET.

b. Modernize Talent Management

Co-chair: Lynsey Caldwell, Leidos

• Brainstormed ideas and topics for guest speakers and future topics of interest. 

• A “World of Haiku” presentation and demonstration was provided by Eric Basu, 

Founder and CEO. ‘The World of Haiku’ introduces learners to careers in 

cybersecurity using an augmented reality (AR) role-playing game environment. 

Users gain skills with scenario-based learning. https://www.worldofhaiku.com/

• Work continues on the ‘Writing Effective Job Descriptions for Employers’ in order to 

provide good guidance and tools to recruit successfully. An initial draft has been 

created. The project team is now refining the document.

• The next working group meeting will feature a guest speaker on Artificial 

Intelligence and Machine Learning (AIML) and how it’s used to match talent to jobs.

• Site: Modernize Talent Management Working Group | NIST

• Next meeting: March 16, 2023 at 1:00 p.m. ET
7

V. Community of Interest Updates

a. Apprenticeships in Cybersecurity

Co-chairs: Tony Bryan, CyberUp; Debbie McLeod, McLeod Information Systems

• A Department of Labor (DOL) update was given regarding and in support of Black 

history month. Site: https://www.apprenticeship.gov/employers/diversity-equityinclusion-accessibility

• The group was provided a presentation on the Navy MAP Apprenticeship Program.

The program serves all four branches of the military and is currently the largest 

apprenticeship program in the United States. They are aligned with the NICE 

Framework and registered with the DOL as a registered apprenticeship program.

• Site: Apprenticeships in Cybersecurity Community of Interest | NIST

• Next meeting: March 10, 2023 at 11:00 a.m. ET

b. Cybersecurity Skills Competitions

Co-chairs: Amelia Phillips, University of Cumberlands; David Zeichick, California State 

University, Chico

• A speaker from CAL-Poly Pomona presented on a Red vs Blue (RVB) game challenge: 

https://www.calpolyswift.org/cyber-challenge/ It is a self-sufficient environment 

allowing students to test their blue team skills. Scripts run in the background in 

attempts to leverage vulnerabilities as students try to patch them.

• Work continues on creating a site of all known cybersecurity competitions making it 

easily searchable and filtered. A demo will be provided during the next meeting.

• Site: Cybersecurity Skills Competitions Community of Interest | NIST

• Next meeting: March 16, 2023 at 3:30 p.m. ET

c. K12 Cybersecurity Education

Co-chair: Thomas Trevethan, Palo Alto Networks

• The group celebrated Black history month and learned of 10 black computer science 

engineers about whom people should know.

(https://elective.collegeboard.org/black-computer-science-pioneers-everyoneneeds-know) 

• Gearing up for the Cybersecurity Career Awareness Week in October.

• Extending the Cybersecurity Career Awareness Week (CCAW) throughout the year 

with a professional development series.

• Working on the ambassador’s program in coordination with the Promote Career 

Discovery working group.

• Site: K12 Cybersecurity Education Community of Interest | NIST

• Next meeting: March 8, 2023 at 3:30 p.m. ET

d. NICE Framework Users

Karen Wetzel, Manager of the NICE Framework

• The cybersecurity skills journals (CSJ) has put out information about the NICE 

Framework that will be out later this year. Information about the CSJ can be found 

here.
8

VI. Project Progress Reports

a. NICE Conference and Expo (Seattle, Washington) – June 5-7, 2023

Presented by Susi Barraza, NICE Program Manager

URL: https://niceconference.org/

• The NICE conference is June 5 – June 7, 2023 at Westin Seattle in Seattle, 

Washington.

• The proposal deadline was last week. Those who submitted will be notified in early 

March. 

• Early Bird Registration: February 27, 2023 – March 19, 2023; Regular Registration: 

March 20 – May 14, 2023; Pre-conference event in Seattle, WA: April 2023 (est.); 

Late Registration (if applicable): May 15 – May 28, 2023

• The Westin Seattle room block is open: https://niceconference.org/hotel-travel/

• There is a government rate for the hotel. Register soon as it is limited. 

• A local stakeholder pre-conference event will take place on April 3, 2023 in Seattle, 

Washington. More information will be forth coming.

• Connect with us:

o Website: www.niceconference.org 

o Email: info@niceconference.org

o Twitter: @nicecybercon

o NICE Conference LinkedIn Group: 

https://www.linkedin.com/groups/12696840/

b. NICE K12 Cybersecurity Education Conference (Phoenix, Arizona) – December 4-5, 2023

Presented by Felicia Rafeliff, iKeepSafe

URL: https://www.k12cybersecurityconference.org/

• The NICE K12 Conference will take place December 4 – December 5, 2023, Preconference workshops will be on Saturday, December 2, 2023. 

• Actively recruiting the 2023 planning committee. If interested please email Felicia: 

felicia@ikeepsafe.org. The meetings are the 4th Thursday of each month at 3:30 p.m. 

eastern, with the first meeting taking place March 23, 2023. 

• The conference will be at the Hilton Phoenix Resort at the Peak. 

• The 2023 pre-conference workshops will be held at Grand Canyon University. A tour 

will be provided as well as hands-on activities.

• Key Dates:

• March 7, 2023: Save the date and venue announcement

• March 23, 2023: 1

st planning committee meeting

• Early April: Call for proposals launch

• Late July: Agenda and speakers’ announcement

• Late August/Early September: Registration launch
9

c. US Cyber Games

Presented by Jessica Gulick, Director of Cyber Sports, Katzcy

URL: https://www.uscybergames.com/

• Jessica Gulick recently returned from the first February In-person Camp in Chicago, 

IL (February 17-19, 2023). The team consists of 30 members. The camp enabled the 

players to build team comradery. Training took place on Saturday, February 18, 

2023 and an in-team scrimmage was held on Sunday, February 19, 2023. 

• The Season 2 Pipeline Program provides information, training, and assistance to 

season 2 athletes that did not make the team but keeps them engaged in and 

informed about the US Cyber Games.

• The Virtual kick off for Season 3 is on June 1, 2023. There will be several guest 

speakers and fun announcements about the season. 

• The beginners game room will open on June 2, 2023. The Competitive CTF will open

on June 5, 2023. Both will be open until June 12, 2023. Participation is free.

Registration is open and can be found on the Cyber Game website.

• The US Cyber team will have a presence at RSA at two separate events; 1) the 

College Day Sandbox and 2) a fundraiser breakfast with Quantum labs.

• The US Cyber Game program has secured athlete intern positions for Black Hat. 

• The International Cyber Games will be hosted in San Diego, CA from July 31 – August 

4, 2023. The event venue is the Hilton La Jolla Torrey Pines.

• OPM has created a new website for internships (https://intern.usajobs.gov/) 

VII. Closing Remarks and Next Meeting Reminder

• The next NICE Council Meeting will be March 22, 2023 at 3:30 p.m. ET.