nist.gov/nice

updated May 2023

Workforce Framework

for Cybersecurity

(NICE Framework)

WHAT?

The NICE Workforce Framework for Cybersecurity (NICE Framework) (NIST SP 800-181r1) establishes a common language that 

defines and categorizes cybersecurity Competency Areas and 

Work Roles, including the Knowledge and Skills needed to 

complete Tasks in those roles. It is a fundamental resource in 

the development and support of a prepared and eective 

cybersecurity workforce that enables consistent organizational 

and sector communication for cybersecurity education, 

training, and workforce development.

The NICE Framework grew from the need to better define, 

develop, and assess the cybersecurity workforce in both the 

public and private sectors. More than 20 governmental 

departments and agencies, along with representatives from 

the private sector and academia, came together to address this 

challenge resulting in the creation of two early versions of the 

NICE Framework, followed by its release as NIST Special 

Publication 800-181 in 2017 and the first revision in 2020. The 

NICE Framework now provides an evolving resource that is 

agile, flexible, interoperable, and modular and continues to 

draw from engagement between the government, private 

sector, and academia.

Task, Knowledge, and Skill (TKS) statements serve as the 

foundational building blocks of the NICE Framework. The 

NICE Framework organizes these statements into Work Roles 

and Competency Areas that can be used to improve practices 

around identifying, recruiting, developing, and retaining 

cybersecurity talent.

The NICE Framework considers the cybersecurity workforce as 

those whose primary focus is on cybersecurity as well as those 

in the workforce who need specific cybersecurity-related 

knowledge and skills in order to perform their work in a way 

that enables organizations to properly manage the cybersecurity-related risks to the enterprise. It is used by:

Employers: Employers use the NICE Framework to support 

cybersecurity workforce assessment, planning, recruitment, 

and development. It is a key tool that helps employers identify 

critical gaps in cybersecurity staing and capabilities; determine and communicate position responsibilities and job 

descriptions; and provide sta training and career pathways.

Learners: Students, job-seekers, and 

employees can use the NICE Framework to explore the wide variety of 

cybersecurity-related Work Roles 

available and learn about top Competency Areas valued by employers for 

in-demand cybersecurity jobs. Staing 

specialists and guidance counselors 

can also use the NICE Framework as a 

resource to support learners. 

Education, Training, and Credential 

Providers: These providers can use the 

NICE Framework to create learning 

content and curriculum. By aligning 

with the NICE Framework, providers can leverage the common 

language to communicate with and support employer needs 

and describe learner capabilities.

Task, Knowledge, and Skill (TKS) Statements: The core 

building blocks of the NICE Framework. 

Task: An activity directed toward the 

achievement of organizational objectives. Task statements define the work 

to be done, and include associated 

Knowledge and Skill statements that 

represent learners’ potential to perform 

those Tasks. 

Knowledge: A retrievable set of 

concepts within memory. Knowledge 

statements define what a learner knows.

Skill: The capacity to perform an 

observable action. Skill statements 

define what a learner is able to do.

Competency Area: A cluster of related Knowledge and Skill 

statements that correlates with one’s capability to perform 

Tasks in a particular domain. Competency Areas can help 

learners discover areas of interest, inform career planning and 

development, identify gaps for knowledge and skills development, and provide a means of assessing or demonstrating a 

learner’s capabilities in the domain.

Work Role: A grouping of work for which an individual or team 

is responsible or accountable. They comprise a group of Tasks 

that define the work to be done.

The NICE Framework, tools, guidance, and other resources 

can be found in the NICE Framework Resource Center at: 

nist.gov/nice/framework

WHY?

LEARN MORE

HOW?

GLOSSARY

WHO?

Task

Skill Knowledge

Skill

Skill

Knowledge

Knowledge

Describes the work

Describes the learner