1 Draft Process for Review and Updates to NICE Framework Data

2

3 Changes to the NICE Framework have historically been derived from stakeholder feedback 

4 received via public comment periods, subject matter expert consultations and events, and 

5 community feedback. The new draft NICE Framework Data Update Process continues to engage 

6 stakeholders throughout and is consultative with subject matter experts, extending that in a 

7 way that is more structured, transparent, agile, and responsive. Further, NICE will continue to 

8 request public comments, hold events, and consult with experts to ensure that the NICE 

9 Framework is meeting stakeholder needs in an effort to expand its usefulness, applicability, and 

10 adoption nationwide.

11

12 Updates to NICE Framework data (Competencies, Work Roles, and Task, Knowledge, and Skill 

13 statements) will seek to support the NICE Framework attributes of agility, flexibility, 

14 interoperability, and modularity while also offering users a process that will minimize disruption 

15 in extant applications of the NICE Framework. The draft NICE Framework Data Update Process 

16 is in alignment with NIST’s approach to publication updates, founded on an open public 

17 comment model in order to garner feedback from the broad stakeholders that use NIST 

18 products – in the case of the NICE Framework, this includes federal, state, and local 

19 governments and tribal territories; private industry; academia; learners (students, job seekers, 

20 and employees); and international communities.

21

22 Below is an outline of the draft process presented in a question-and-answer format.

23

24 What is the proposed process?

25 To ensure that the NICE Framework is agile, flexible, modular, and interoperable, it is important

26 that regular reviews and updates can be made to the NICE Framework data to respond to and

27 anticipate changes in cybersecurity so that a capable and ready workforce is prepared to

28 mitigate and address ongoing risks.

29

30 As such, the NICE Framework will follow the model of the NIST SP 800-53, Security and Privacy

31 Controls for Federal Information Systems and Organizations, which launched a public comment

32 site in 2021. It is further informed by the Department of Defense “DOD Cyber Workforce 

33 Framework Revision Process Guide” and was shared with key interagency stakeholders for their 

34 input and feedback prior to this public announcement. Finally, the development of this process 

35 is in alignment with the NICE Strategic Plan, Goal 4, Objective 3: “Establish processes for 

36 regularly reviewing, improving, and updating the NICE Framework.”

37

38 Community members will be able to use the public comment site to submit proposed changes 

39 to NICE Framework data for consideration. The draft process described here is a preview of 

40 what will be in effect once a new system is available for public use (anticipated summer 2022).

41

42 Why is NICE proposing that the NICE Framework adopt a public comment process for

43 reviewing and updating data?
44 NIST believes that robust, widely understood, and participatory development processes

45 produce the strongest, most effective, most trusted, and broadly accepted standards and

46 guidelines. The following principles guide NIST's standards and guidelines development:

47 • Transparency: All interested and affected parties have access to essential information

48 regarding standards and guidelines-related activities throughout the development

49 process.

50 • Openness: Participation is open to all interested parties. All stakeholders – including

51 security practitioners, researchers, standards developing organizations, and users –

52 have an opportunity to be meaningfully involved in the standards and guidelines

53 development process.

54 • Balance: NIST solicits input from a wide range of stakeholders representing government,

55 industry, and academia to ensure that its standards are strong, practical, and meet the

56 needs of the Federal Government as well as the broader user community.

57 • Integrity: NIST serves as an impartial technical authority when it is developing standards

58 and guidelines.

59 • Technical Merit: NIST’s decisions during the development of standards and guidelines

60 are based on the technical merit of a proposal while being mindful of security, privacy,

61 policy, and business considerations.

62 • Global Acceptability: While the statutory basis for NIST’s work in risk management is the

63 need for protection of non-national security federal information systems, NIST

64 standards are the foundation of many information technology products and services

65 that are developed and sold globally.

66 • Usability: NIST aims to develop risk management guidelines that help implementers

67 create secure and useable systems that support business needs and better manage risk

68 for systems and organizations. 

69 • Continuous Improvement: NIST strives for ongoing engagement with the cybersecurity

70 and privacy community to continuously improve our standards and guidelines.

71 • Innovation: As a scientific bureau within the U.S. Department of Commerce, NIST's

72 mission is to promote U.S. innovation and industrial competitiveness by advancing

73 measurement science, standards, and technology in ways that enhance economic

74 security and improve our quality of life.

75

76 Who can submit updates for consideration?

77 Updates may be identified internally by NICE Program Office staff or may be proposed by 

78 private and public stakeholders, including government, industry, academia, learners, and 

79 others. The NICE Program Office will work to achieve consensus on the public and private 

80 sector input, balancing the need for both periodic updates based upon emerging needs and the 

81 desirability for a stable framework.

82

83 When will I be able to submit updates for consideration?

84 Once the NICE Framework Data Update site is launched, stakeholders will be able to provide 

85 input (a "proposal") to NIST at any time. Note that submission of a proposal does not guarantee 
86 that NIST will include the proposal in a future comment period (as a “candidate”) or release of 

87 the NICE Framework. 

88

89 Stakeholders will be able to view and provide comments on candidates (draft updates available 

90 for public comment) during defined comment periods. Comments on candidates are reviewed 

91 by NIST prior to posting.

92

93 What is the difference between a Proposal and a Candidate?

94 A "proposal" is a submission for an update – including new data or enhancement, revision, or 

95 withdrawal of existing data. 

96

97 A "candidate" is a proposal that is available for public comment. Stakeholders will have the 

98 ability to review and provide feedback on draft candidates during defined comment periods.

99

100 Note that submission of a proposal does not guarantee that NIST will include the proposal in a 

101 future comment period (as a “candidate”), and neither proposals nor candidates are 

102 guaranteed to be accepted as updated data for the NICE Framework.

103

104 What kinds of updates can I submit for consideration?

105 Changes can be proposed for the following NICE Framework data: Competencies, Work Roles,

106 and Task, Knowledge and Skill (TKS) statements. Proposed updates may take the form of:

107 • Administrative changes: These changes address minor administrative errors, including

108 typographical and grammatical errors.

109 • Additions: New statements, Work Roles, or Competencies.

110 • Adjustments: Proposals to change existing data elements (e.g., revisions or expansions).

111 • Withdrawals: Proposals to retire existing data elements.

112

113 What if I want to suggest an update on other NICE Framework material?

114 NICE will continue to accept suggestions for changes related to the NICE Workforce Framework 

115 for Cybersecurity (NIST Special Publication 800-181, Revision 1) and NICE Framework Categories 

116 as part of future Calls for Public Comments and informally via the niceframework@nist.gov

117 email address. 

118

119 How will decisions regarding my submission be made?

120 As a NIST publication, updates to the NICE Framework will be approved by the NICE program 

121 office after consultation with subject matter experts and stakeholders as needed. Because the 

122 NICE Framework is a national framework, these stakeholders may represent federal 

123 government as well as local and state government, private industry, academia, and learners 

124 (students, job seekers, and employees).

125

126 In addition to taking into consideration the NIST principles noted above, the following will also 

127 be taken into consideration when reviewing proposed updates: 

128 • Whether the update is essential and has wide-ranging impact, versus a change to 

129 address the unique requirements of an organization or specific sector.
130 • How the update relates to existing content, including the extent of impact an update 

131 might make.

132 • How updates align to the defined NICE Framework structure.

133 • If Task, Knowledge, and Skill (TKS) statement updates adhere to the Task, Knowledge, 

134 Skill (TKS) Statements Authoring Guide for Workforce Frameworks.

135

136 How will I know the status of my submission?

137 You will receive alerts throughout the process to let you know the status of your submission. 

138 This includes confirmation at the original time of submission, when a review of the submission

139 has begun, and when a determination has been made. In addition, you can contact the NICE 

140 program office at any time with specific questions. 

141

142 How will I find out about approved updates?

143 Updates that are accepted will include an implementation timeline. A change log will be 

144 maintained and all updates will be communicated via the NICE Framework Resource Center and 

145 via the NICE Framework Users Group. 

146

147 How often will updates occur?

148 Administrative updates (e.g., fixing spelling errors) may occur at any time. Minor updates (e.g., 

149 adjustments to individual statements that do not have significant or widespread impact, or new 

150 content that is additive in nature) will be timed to be released together and may happen up to 

151 twice annually. Major updates (e.g., changes to existing Work Roles and their statements; 

152 withdrawals that have significant impact on remaining content, etc.) may occur as needed but 

153 not more frequently than annually. 

154

155 Can I continue to use earlier versions of data? 

156 A detailed change log and unique identifiers will be used to maintain version control of the NICE 

157 Framework data as it evolves. As such, earlier versions of content, including withdrawn content, 

158 will still be available for use.