NICE Working Group

Meeting Minutes

Date: April 27, 2016 Time: 3:30 PM	EST

SharePoint: https://nistgov.sharepoint.com/sites/NICEProgram/NICEWG

I. Roll Call and Ground Rules

•	 Danielle Santos, NICE Program Manager, welcomed members to the meeting and

mentioned that	the Adobe Connect	chat	box feature should be utilized to announce

attendance, provide feedback and ask questions.

•	 Danielle also noted that	participation in the NICE Working Group is not	intended for

advertising and promotional purposes and to keep this in mind when using the chat	feature.

•	 Danielle apologized to any members unable to join the Adobe Connect	due to the limited

capacity. The program office is working to alleviate this issue for future meetings.

II. NICE	Program Office Updates

•	 Rodney Petersen, NICE Program Director, talked about	an excerpt	from Presidents Obama’s	

previous State of the Union address on the subject	of reforming America’s training

programs. NICE works towards the same activities and themes stated in this speech.	To

better focus on required skills, on the under and unemployed, provide better career paths,

and investigate job driven and diversity in training. These themes align with the NICE

program.

•	 Federal initiatives include the Trade Adjustment	Assistance Community College and Career

Training (TAACCCT) program which provides grants to train individuals for higher paying

jobs, as well as, the Apprenticeship USA program which provides rapid technical training.

•	 The Obama	Administration created the Ready to Work job driven checklist	to encourage

employers to engage with employees to ‘earn and learn’, to make smart	choices and to

measure initiative outcomes.

•	 NIST is in the process of establishing Regional Alliances and Multi-stakeholder Partnerships

to Stimulate (RAMPS) Cybersecurity Education and Workforce Development.	The focus is on

local and regional economies. Be on the lookout	for an announcement	sometime next	week

followed by a webinar discussing grants and organizations that	may apply. Information will

be distributed to the NICEWG and will also be included	on the NIST/NICE website.

•	 For more information about	the aforementioned programs and other Federal initiatives,

please refer to the attached presentation and the website links below:

• Ready to Work https://www.whitehouse.gov/ready-to-work

• Ready to Work Fact	Sheet	https://www.whitehouse.gov/the-pressoffice/2014/07/22/fact-sheet-ready-work-glance-job-driven-training-and-americanopportunit

• Trade Adjustment	Assistance Community College and Career Training (TAACCCT) Grant	

Program https://doleta.gov/taaccct/

• Upskill Fact	Sheet	https://www.whitehouse.gov/the-press-office/2015/04/24/factsheet-administration-announces-new-commitments-support-president-ob

• Apprenticeship USA http://www.dol.gov/featured/apprenticeship

• TechHire Initiative https://www.whitehouse.gov/issues/technology/techhire
III. Opening Remarks

a.	 President	Kathi Hiyane-Brown, NICEWG Academic Co-Chair, welcomed members to the

meeting and mentioned her recent	attendance at the American Association of Community

Colleges	(AACC) Annual Convention in Chicago. Kathi emphasized that	although in our circle

we talk a lot	about	cybersecurity and training opportunities, etc., others not	linked to our

network are not	aware of available resources. There were many community college

presidents that	did not	know about	the NSF grant	Whatcom Community College was

awarded to enhance cybersecurity education nationwide.	The scope of our work is just	

beginning.	We need to continue to talk about	the urgent	need and ask for support.	

President	Kathi thanked everyone	for their efforts in promoting these critical issues.

b.	 Andre Thornton, NICEWG Industry Co-Chair, followed up commenting on the need to

prepare the future workforce. There are groups and organizations within companies that	

are focused	on finding the right	talent. There is also a lot	of effort	coming out	of the

government.

IV. Standing Items

a.	 Fun Facts – creating	a culture	of	evidence

•	 Rodney presented facts on minorities in cybersecurity. He conceded that	these facts

are not	fun or encouraging as the data	available is not	very current	or reliable. This

uncertainty in the data	aligns with NICE goals, specifically, to nurture a diverse

learning community.

•	 The preliminary data	is discouraging for minorities; however, it may be outdated.

One study indicates that	minorities make up just	29% of the science and engineering

focused	workforce.	 NICE will try to investigate more recent data	and work towards

having minorities better represented in cybersecurity as one of our initiatives. If you

know of any newer data	sources, please contact	us.

•	 Please refer to the attached presentation and the website links for the referenced

data:

•	 African Americans Underrepresented in the Cybersecurity Field (April 7, 2016)

http://www.forbes.com/sites/stevemorgan/2016/04/07/african-americansunderrepresented-in-the-cybersecurity-field/#141b4f1d323f

•	 You Think the Lack of Diversity in Tech is Bad; It’s Worse in Cybersecurity (March

23, 2016) http://dcinno.streetwise.co/2016/03/23/lack-of-diversity-minoritiesin-cybersecurity-industry-hiring/

•	 International Consortium of Minority Cybersecurity Professionals

https://icmcp.org/

•	 International Colloquium for Minorities in Cyber Security

http://icmics.com/default.asp

b.	 Report Roundup – learning from good	ideas

•	 Davina Pruitt-Mentle, NICE Academic Lead, presented on Barriers and Opportunities

for 2-Year and 4-Year STEM	Degrees: Systemic Change to Support	Students’ Diverse

Pathways.

•	 The report highlights some of what	this working group is engaged in. In

summary, the report	looks at the importance of STEM. The report	recognizes

degree holders equate to a higher salary, lower unemployment	and a lower

gender gap in the STEM	field.	
•	 The study finds that	most	degree holders do not	end up working in the STEM	

field. Many students lose interest	before degree completion and transition to

other studies. Patterns show an array of pathways (not	pipelines) and transfers

during the second year with some transferring more than once. There is also an

increase in the number of students enrolled in multiple institutions. Many do not	

finish in 4 years. There is an increase in the number of students that	have gap

years; taking time off. The report	also states that	minorities make up about	half

of those enrolled online in ‘for profit’ degree programs.

•	 The important	takeaways include gatekeeper classes and a rising cost	for STEM	

from institutions raising tuition for these types of programs. Recommendations

include adjusting the data	collection process	to better understand findings.	This

type of data	is difficult to collect. Also,	better career research looking at

enrollment	and analyzing patterns. The report	can be found by visiting:

http://www.nap.edu/catalog/21739/barriers-and-opportunities-for-2-year-and4-year-stem-degrees

c.	 Event	Engagement	– highlights	from recent	events	and upcoming events	

•	 Frank Cicio,	co-chair of the NICE Workforce Framework Project, presented on the

following events:

•	 Aspen Institute and Lumina Foundation (past event) – Frank traveled to

Washington DC last	week to attend an UpSkill America event where industry and

education came together to discuss programs and sustainability of the programs

that	help train the workforce.	The focus was on the employment	talent	business

case.

•	 Epic Challenge (upcoming	event) – The Epic Challenge will be	held on May 18th

and brings	students from all around the world to participate in a ‘viral

hackathon’. The Challenge is defined by DHS and DOD. There are about	125

teams that	will work on the final leg which is about	3 days. The Epic Challenge is

always looking for mentors in the industry. Learn more information at:	

https://youtu.be/29_DcoCWqZs

•	 Cybersecurity Awareness Week(CSAW) (upcoming event) – CSAW is a student	

run cybersecurity event sponsored	by NYU featuring competitions,	an industry

conference, workshops and a career fair. Find out	more at:

https://csaw.engineering.nyu.edu/

•	 Please refer to the attached presentation for additional information about	these

events.

d.	 Strategy	Stories	– new developments	that align	to NICE	Strategy

•	 Ambareen Siraj, founder and chair of Women in Cybersecurity (WiCyS) Initiative

presented information on the WiCyS	Conference.	The conference aligns with NICE

objective 2.4: Grow creative and effective efforts to increase the number of women,

minorities, veterans, persons with disabilities, and other underrepresented populations

in the cybersecurity workforce.

•	 WiCyS is unique because students make up almost	half of the attendance.	

Otherwise attendees are current	and prospective cybersecurity professionals.

Under	the National Science Foundation (NSF) and beginning in 2013,	recruitment

and retention has grown to 800 participants in 3 years. Students attend at

almost	no cost.
•	 Outside of the student	population, there is equal distribution amongst	educators

and industry. Participants include 57% students, 20% educators and 20%

professionals.

•	 The conference welcomes men who support	women in cybersecurity. 13% of

participants were men.	 Feedback from men is that	the conference is an eye	

opening experience	which changed their perspectives on how it	feels to be a

woman and minority in the industry.

•	 The conference hosts several workshops with 50 participating organizations.

Time will tell if the conference is effective. They are collecting and analyzing data	

and feedback to determine the impact, especially for young women.

•	 Participation can be in the form of attendance, conducting sessions, committee

participation, etc. Please refer to the attached presentation and the URL below

for additional information:	 https://www.csc.tntech.edu/wicys/

e.	 Metric Moment – what	gets measured gets done

•	 Casey O’Brien,	co-chair of the NICE Collegiate Subgroup, presented some results from

the cybersecurity in the top U.S. undergraduate Computer Science programs study.

•	 The study from Cloud	Passage evaluated top ranked technical universities (from	US

news and world report/business insiders top 50/2015 QS world rankings).

•	 The study researched what	the universities have to offer regarding cybersecurity

courses and the requirements to graduate. The results are dismal and not	surprising.

•	 Some of the metrics in the report	included only 3 out	of top 50 schools require a

cybersecurity course for graduation. The findings revealed that	out	of the top 10

schools, not	a single program requires a cybersecurity course to graduate. Grades

were assigned to each university and there are no A’s assigned, only 3 B’s and 8

earned F’s.	What stands out	is how much Information Security is embedded	in

programs as opposed to pure dedicated cyber courses. With cybersecurity programs

they see security the way ABET (accreditation board) defines it.

•	 We don’t	know if the lessons learned being integrated in the top schools.

•	 For more metrics and information visit:	

https://www.cloudpassage.com/company/press-releases/cloudpassage-study-findsu-s-universities-failing-cybersecurity-education/

V. Subgroup	Updates

a.	 K-12 – Virginia	Lehmkuhl-Dakhwe, co-chair, spoke about	the subgroup’s	Tiger Teams

including the national computer science initiative which is compiling	information on

computer science and how cybersecurity is represented in computer science education.	

Another Tiger Team is reviewing the Computer Science K-12 framework. The convening

group would like to catalog after school programs that	exist. The next	K-12	subgroup

meeting is May 11th and will feature updates and goal identification from the Tiger Teams.

b.	 Collegiate – Casey O’Brien, co-chair, shared with members that	the Collegiate subgroup has

been	meeting since June 2015. They have completed working through the NICE Strategic

Plan and have identified 3 priority goals. Moving forward, the group will divide into 3

groups,	Group 1 will focus on Goal 1.1,	stimulate the development	of approaches and

techniques that	can more rapidly increase the supply of qualified cybersecurity workers.	

The team lead is Dr. Heather Monthie, Grand Canyon University. Groups will define	

objectives and deliverables in time for the NICE conference. Group 2 will focus	on goal 3:

3.4,	promote tools that	assist	human resource professionals and hiring managers with
recruitment, hiring, development, and retention of cybersecurity professionals.	Dr.	Barbara	

Endicott-Popovsky	(co-chair) will lead for now. Finally, group 3 will have some cross

pollination with FCC reliability and interoperability group defining value propositions for the

NICE framework. In working to bring industry into this fold, there is a need to do a better

job of making the business case and develop	value propositions as it	specifically relates to

the framework. Mark Petersen will spearhead this effort.

c.	 Competitions - Dan Manson, co-chair, mentioned the CyberPatriot final winners and the

competition becoming a national sport. The cyber	defense competition had a member from

the University of Central Florida	on all 3 teams. Dan also mentioned that	the National Cyber

League will be held May 2 – June	30. Dan and Jessica	Gulick, the subgroup-co-chair, will	

participate on a panel at CISSE on June	15th to discuss how competitions are being

embedded in schools. Dan also stated that	the subgroup is	in the process of developing a

white paper on standardizing competitions.	

d.	 Career Development and Workforce Planning – Leo Van Duyn,	co-chair, spoke about	the

team’s focus on 12 job role profiles. The goal is for the subgroup	members to review and

provide feedback on the 12 job roles by next	month. All will benefit	by having a baseline to

develop	internal programs.	Additionally,	the subgroup plans to review a diagnostic tool with

Montana Williams (Training and Certifications subgroup co-chair) and examine the Heat	

Map project	which provides existing role profiles and KSAs that	the private industry needs.

Frank,	co-chair, spoke about	sustainability and tangible vs. intangible assets and posed the

question ‘Are resources a risk or an asset’?	The NICE initiative is trying to standardize a

framework.	There is always the question of funding.	The goal is for companies to justify the

ROI	on investing in coursework. If companies invest dollars and retain employees over time,

employees have longevity. Frank also spoke about	project	based learning which can

accelerate the workforce, particularly for high school and higher education and scale college

workforce.

VI. Project Progress Reports

a.	 NICE Annual Conference – Danielle Santos, NICE Program Manager, revealed the call for

proposals are open through May 31st. The NICE Conference and Expo is being held in Kansas

City, MO from	November 1-2, 2016. They are	looking for proposals that	align to the theme

(“Innovations to Shape the Future Cybersecurity Workforce”).	The conference will	showcase

prospective collaboration and innovative methods that	align with NICE’s goals. The selected

presentations will be a part	of track sessions. Proposals will be reviewed by the program

committee in June. Selections will be made in early July and then announced along with key

note speakers. For more information and other key dates click the following link:

www.fbcinc.com/nice

VII. New	Business

Diana	Burley spoke about	the ACM-IEEE Joint	Task Force on Cybersecurity Education

a.	 Diana, co-chair of the Task Force,	stated that the ACM-IEEE Task force began in September

2015 developing curriculum for cybersecurity education. The intent	is to provide curriculum	

guidance for ALL institutions with a focus	on cybersecurity being a computer based

discipline.	Cybersecurity involves people and other technologies such as law, policy, and

human factors. ACM	is a computing based society. They are actively engaged in talks on the

definition.	Please reach out	if you want	the group to consider recommendations.
b.	 Growing to over 100,000	members since 1968,	ACM publishes computer curricular

standards. This effort	launched in September and in the fall, developed the parameters. We

first	reviewed previous work and then started activity engaging with large and small groups.

c.	 If you would like the full	briefing, reach out	to Diana. Leading to June, ACM	will hold an

International Security Workshop along with the CISSE colloquium in Philadelphia.	If you’d

like to participate contact Diana. ACM will develop a draft	to present	to ACM	education

council. Documents will be posted on the website. http://www.csec2017.org/

d.	 Rodney asked Diana	if the standards for computer science are a precursor for curriculum.

Need a baseline in part	because the field is so diverse. Diana	answered by saying that	

considering engineering schools, business schools, etc., developing guidelines that	allow

flexibility is key. This is a foundation for that	effort.

e.	 Please refer to the attached presentation for additional information.

VIII. Summary of Action Items

•	 Danielle Santos reminded the members to lookout	for the RAMP federal funding and where to

apply.

•	 The slide presentation and meeting minutes, including links,	will be sent	to members the week

2nd of May .

IX. Next Meeting Reminder - May 25, 2016 at 3:30PM	Eastern Time