NICE Working Group
 

Meeting Minutes
 

Date: November 30, 2016 Time: 3:15 PM	EST
 

SharePoint	Page:	https://nistgov.sharepoint.com/sites/NICEProgram/NICEWG
 

Strategic	Plan	for	NICE: http://csrc.nist.gov/nice/about/strategicplan.html
 

I. Roll Call and Ground Rules

•	 Danielle Santos, NICE Program Manager, welcomed members to the

meeting. As a	reminder, this will be the last	meeting for 2016.

•	 During this meeting the Adobe Connect	chat	box feature should be

utilized to provide feedback and ask questions.

•	 Danielle noted that	participation in the NICE Working Group (NICEWG) is

not	intended for advertising and promotional purposes and to keep this

in mind when participating and using the chat	feature.

II. NICE	Program	Office	Updates	

•	 Rodney Petersen, Director of NICE, provided a	recap on the highlights

executed during this past	year.

•	 The NICE Program Office	is	fully staffed. As a	reminder, the following

members are working hard serving the community in	their various	roles:

o	 Bill Newhouse, Deputy Director

o	 Danielle Santos, Program Manager

o	 Davina	Pruitt-Mentle, Academia	Lead

o	 Clarence Williams, Government	Lead

o	 Marian Merritt, Industry Lead

•	 The Program Office is pleased about	the developed processes	for

enhanced communications such as monthly webinars,	quarterly

eNewsletter and email communication.	

•	 Growth in the K-12	area	continues including the 2nd annual conference

with an increase in	technical programs of study. GenCyber camps benefit	

students and train middle school teachers.

•	 The Regional Alliances and Multistakeholder Partnerships to Stimulate

(RAMPS)	Cybersecurity Education and Workforce Development awardees

are provided funding opportunities to build multistakeholder workforce

partnerships of employers, schools and institutions of higher education,

and other community organizations.
	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 		

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 		

•	 The NICE Cybersecurity Workforce Framework has been updated along

with aligning the knowledge units. The jobs Heat	Map, CyberSeek, has

been launched.

•	 Looking ahead NICE will also focus on a renewed emphasis on skills.

Many employees convey	this is needed and can be achieved through

training and certifications.	There	will	also	be a	renewed focus	on	the

acknowledgement	and importance of ongoing training. We are

collectively working to unite on this challenge with other agencies. The

NICEWG and subgroups assist	in this challenge by bringing academia,	

industry and government	together building a	strong foundation.

III. Opening Remarks

a.	 Industry Co-Chair Andre Thornton shared thoughts on the new

administration.	Regarding education,	there will be an increased

opportunity for public and private partnership.	This work	is important	

and will receive	more	synergy. Gear up!

IV. Standing	Items

a.	 Fun Facts –Annemarie B. Reed, Accenture Corporate Marketing,	spoke	

about	“Cracking the Gender Code”.

•	 Accenture is	a leading global professional services consulting, digital,

technology, and operations company. Annemarie works on	corporate

citizenship, human resources,	and talent among other things. Training

for junior and high school girls through summer immersion programs

as well as providing funding and research to help expand the program

across the nation are supported.

•	 Girls	Who	Code is a	U.S. non-profit organization working to close the

gender gap in technology. There is a	shortage of women in the

computer science pipeline.	

•	 Based on research, Accenture was unsatisfied with the availability in

the workforce and why interest	for	women	is decreasing. In college

there are more men graduating in computer science since the 1980’s.	

Women’s share of the workforce has declined 24%.

•	 Computer skills are one of the most	sought	after and the rate of job

creation is 3 times the U.S. national average. Below is what	was

found:

o	 By implementing a	strategy focus based on three stages we

could more than triple the number of	women	to increase the

female share of the workforce from 24	– 39%.

o	 These strategies could boost	cumulative earnings.
	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	

		

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 		

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 		

	 	 	 	 	 	 	

	 	 	 	 	 	 		

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

•	 The	sooner actions are taken the sooner we can see some uplift. One

primary way is with junior high	school,	high	school and then college

girls.	

o	 Showing that	computing can be cool, fun, and not	just	for boys

in	junior	high. Change	perceptions that	it’s geeky and for boys	

only. Support	parents and teachers to understand the role of

computing.

o	 During high school provide the needed resources and classes.

o	 Inspire teachers and provide positive role models in college.

•	 The information provided is a	quick overview on our research and

findings.	We’re always looking to collaborate on solutions to increase

the women in the pipeline.

•	 Find out	more here: https://www.accenture.com/us-en/cracking-thegender-code

b.	 Report Roundup –Yejin	Cooke	from NASCIO presented on the topic of	

the “State CIO Top Ten Priorities for 2017” and what	this means.

•	 Beginning	in 2006, NASCIO began surveying state CIO members to

garner their focus,	direction settings, and what	they will be working

on.	Also solicited were the top 10 technologies, apps and tools which

assist CIO’s.

•	 Security is the #1 priority for the 5th consecutive year. Cybersecurity is	

a	huge issue for states,	and local and federal government.	It	should be

noted there is a	big gap between the #1 and #2	priorities and all

others fall in line after that.

•	 Because resources are constrained,	budget	and cost	control are listed

and have appeared since 2009. Legacy modernization tries to balance

cost	savings.

•	 The	bottom half of the top ten list	become more important	as we

retire older technology. Data	management	and analytics, enterprise

vision and roadmap for IT, and agile and incremental software

delivery,	relate to the balance between legacy and modernization.

•	 Agile appeared a	year ago yet hasn’t	increased in importance.	Finally,

broadband reflects continued interest	in closing digital divide.

•	 Issues that	do not	appear in the top ten are several items that	tie for

#11 such as HR, the talent	crisis, procurement, innovation, and

business	process	improvement.	

•	 See attached presentation and find out	more here:

http://www.nascio.org/Portals/0/Publications/Documents/2017/NAS

CIO-TopTen-2017.pdf
	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 		

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 		

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	

	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	

		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 		

	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 		

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	 	

		

	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 		

	 	 	 	 	 	 	 	 	

	 	 	 		

	 	 	 	 	 	 	 	 	

	 	

c. Event	Engagement – Members of the NICE Program Committee provided

a	recap of the 2016	NICE Conference and Expo.

•	 The NICE conference was both well attended and a	success. For the

first	time ever	there were pre-conference seminars on the topics of	

the NICE framework and building a	cyber-ready workforce.

•	 There were approximately 500 persons registered for the conference.

A	survey sent	to attendees garnered 114	responses.	Below are some

of the results:

o	 There was a	satisfaction rate of 98%.

o	 99%	felt	there was good program content.

o	 99% felt	the conference was better than those held before.

o	 A highlight	was Byron Auguste, a	keynote speaker,	who spoke	

on rewiring the labor market	to drive innovation in

cybersecurity.

o	 There was high praise for the new version of the NICE

framework and the quality of speakers.

o	 The conference was well constructed and provided good

networking capabilities.

• Most	presentations can be found on the conference website here:

https://www.fbcinc.com/e/nice/ncec/presentations.aspx

•	 The next	NICE conference is	scheduled	for	November	7-8,	2017	in

Dayton Ohio. During spring,	2017,	a call for proposals and

presentations will be issued. The program committee will be working

on a	theme.

•	 Simone Petrella, Program Committee Industry Co-Chair, seeks to

increase industry participation and solve the workforce and training

gaps. This year there was a	lot	of representation from training

providers and academia	but	more participation from	employers is	

needed. If you are interested in getting involved or plan to attend let	

us	know!

d.	 Strategy	Stories – Bill Newhouse spoke on the draft	NIST Special

Publication 800-181, NICE Cybersecurity Workforce Framework.	This	

body of work relates directly to the NICE Strategic Plan, Objective 3.2:

“Publish and raise awareness of the National Cybersecurity Workforce

Framework and encourage adoption”.

•	 The benefit	of the NICE Cybersecurity Workforce Framework is having

a	common lexicon.	
	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 		

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

		

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 		

	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

•	 The document	contains seven (7) high level work categories

developed from years of study and analysis within the career field.

Within each work category are specialty areas, of which there are 34.		

Drilling further down are defined	work roles and detailed descriptions

of activities performed in cybersecurity. Most	people carry out

several work	roles	for which there are many tasks.

•	 The	audience	for the document are employers that	can utilize the

material to create training plans and to see other work roles to work

towards. Certification providers have been mapping categories and

we	hope they continue to do so. Education providers who apply the

framework can say this is what	we teach towards and cite the

outcome of these skills and abilities.	

•	 NICEWG members can assist	by sending	the link for comments out	to

other folks and ask for feedback and updates. Look at	the tasks and

see if there are covered in a	way that	makes sense.

•	 See attached presentation and find out	more here:

http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-181

e.	 Metric moment – Kevin Nolton from the Cyber Innovation Center spoke

about	“NICREC Measures for Success and Progress”.

•	 Through a	DHS grant,	NICERC has been tasked to solve K-12	

cybersecurity issues. The goal is to have a	trained workforce	that	

includes having both soft	and hard skills.

•	 The	developed	course work	provides resources to educators at	no

cost. Through training and teacher access, we can grow the amount	

of students impacted. Last	year the impact	reached over 375,000

students across the country by	simply introducing them to cyber

concepts.

•	 The	curriculum reaches across the fifty states plus two territories. We	

continue to seek partners to reach out and find ways to work with

your state and district to implement	cyber and STEM. Working with

11 state departments and working state wide with curriculum.	It	is

projected that	the curriculum will be approved to half the states in

the country.

•	 To	assist	in the transformation of education into the 21st century

environment contact	Kevin Nolten:

Kevin.Nolten@cyberinnovationcenter.org.

•	 Educators are provided access to the Canvas Learning Management	

System which allows the team the constant	interaction and traffic of

downloads, inquiries and sharing feedback from the classrooms.

These are the main way’s we are garnering impact. The curriculum	is	
	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 		 	 	 	 	

		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 			

	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 		

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	

designed to be modular. Various projects and lessons can be

implemented.	

•	 See presentation attached and find out	more here: http://nicerc.org/

V. Subgroup	Updates

a.	 K-12 - Carlos Garcia, co-chair, reported that	the K-12	co-chairs are

splitting work in leading the monthly meetings. The project	teams under

the subgroup could not	meet	the November deadline and have pushed

the deadline back. The K-12 subgroup is growing. With new	members	

come new ideas to focus on in the future.

•	 There is a	Cybersecurity for Computer Science Webinar next	

Wednesday, December 7th at	2:00pm. Register through the following

link: http://csrc.nist.gov/nice/webinars/index.html

b.	 Collegiate – Heather Monthie, Collegiate co-chair, is the subgroups new

co-chair replacing Barbara	Endicott-Poposky as Barbara	has fulfilled her

term.

•	 The Collegiate subgroup did not	meet	their	imposed deadline for

deliverables. In April and May 2016, the focus was narrowed but	

because so many people were unavailable during the summer the

summer meetings were canceled.

•	 When the subgroup reconvened in the fall,	the	group	began

discussing its mission and what	to accomplish moving forward. About	

fifteen ideas were	recorded which have been solidified down to ten.	

The group was surveyed on those ten topics and which ones were of

most	interest. Some of the ideas include: job fairs, student	

associations, how to get	more women and veterans involved	in	

cybersecurity, cybersecurity teachers, pathways, and a	

program/training repository. Heather has been collecting the

responses and the group will discuss how to move forward on some

of the ideas during the next	meeting.	

c.	 Competitions – Dan Manson, co-chair, reported that	the competitions

white paper was released during the NICE Conference last	month. The

white paper is available for download from this site:

http://lp.katzcy.com/cybersecuritygames.

•	 There	were over twenty-five persons interviewed for contribution to

the white paper. This paper discusses the benefits of competitions.

•	 Since completion, subgroup members have been discussing how to

elevate the competitions white paper. The white paper will be

presented during a	NICE Webinar on January 18th,	2017. The hope is	
	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 		

	 	 	 	 	 	 	

	 	

	 	

	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 		

	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	

that	the paper gets wide distribution and the subgroup is looking

forward to the feedback.

•	 The timing of the white paper is particularly interesting due to the

increased growth in cyber competitions. This year, CSAW is

partnering with NYU Abu Dhabi and Indian Institute of Technology

Kanpur to expand its reach as an international competition with

worldwide impact.

d.	 Training	and	Certifications – Linda	Montgomery, co-chair, discussed	a	

matrix that	was developed by the training and performance based

certifications project	team.	

•	 The group took the framework prior to the 800-181 Special

Publication and mapped vendor credentials based on the Army, the

Navy and the National Guard and overlaid information from the C3

group. The updated framework will increase and expand the KSA’s.

Training gaps will be a	byproduct	of output	of the matrix were

building.	The draft	of the credential matrix is located on the Training

and Certifications SharePoint	site here: Copy of NICE Working Group	

Presentation 11 1 2016 W C3 Comparison 2

•	 The	cyber range one pager is	complete. Cyber range programs will be

evaluated by entities such as Ixia	and the MI	range.

•	 The next	subgroup meeting is scheduled	for December 9th at	2:30

ET.

e.	 Workforce Management – reference	“New	Business” below.

VI. Project	Progress Reports

a.	 National	K-12	Cybersecurity	Education	Conference – Amber Lindsay,	

Ikeepsafe, provided	a planning update. Great	feedback on the 2016

conference was received from participants through surveys. Based on the	

feedback, there is consideration to schedule the conference on

December	4-5, 2017 to piggy back on	the ACTE conference.	Once a	venue

is	locked	in, a	save the date notice will	be	sent.	The committee is also	

working on theme and welcome suggestions.	Feel free to reach out	

directly to Amber Lindsay at	amber@ikeepsafe.org.

b.	 NICE	Challenge	Project – James Ashley, Project	Manager, let	members

know that	ten education units have been added with over 85 entities

using the NICE challenges,	most	being universities.	The largest	in content	

has just	been released. The challenges have undergone a complete

remapping so that	they map to the new framework including the new

work	roles. Find out	more here: https://www.nice-challenge.com
	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 		

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 				

	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	

	 	 	 	

	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 		

	 	 	 	 	 	 	 	 	

	 	 	 	

c.	 CyberSeek – Randi Parker, CompTIA, spoke about	the CyberSeek launch

at	the NICE conference.

•	 Last	year, funding for CompTIA, in partnership with Burning Glass,

was granted for the development	of a	cybersecurity jobs heat	map

showing	demand and supply.

•	 This	idea	came out	of discussion over the many years of shortcomings

in	the cybersecurity workforce. New	variables such as the Internet	of	

Things, addressed weak links and human errors. CyberSeek looks to

connect	employers with employees.	CyberSeek	is	powered	by

certified bodies of data and discussion to include more. This tool also	

assists displaced workers.

•	 There is not	a	cycle for the data	set	so that	it	can be flexible and to

keep the data	in real time as possible. The data	is leveraged from

DOL. Will Markow, Burning Glass, has additional information.

•	 There is an email address for comments located on the website. Find

out	more here: http://cyberseek.org/

VII.	 New	Business - Kristin Judge, Workforce Management	co-chair, kicked off

the discussion on their Human Factors Mapping Project (HFMP).

•	 The	vision	for this idea	is	that	individuals in an organization can fulfill

their cybersecurity responsibilities and mitigate risk. The	deliverable

is to integrate the NIST and NICE frameworks with the business and

functional roles of an organization.

•	 Most	executives assume their IT or	cyber	divisions take care of risks.

This project	information aims to help	non-technical persons

understand problems and start	addressing them. Many have no

awareness of the NICE or NIST framework. By developing a	bridge

between cyber functions and the rest	of the organization, a	construct

can be developed, as an entry point, to mitigate cybersecurity risk.

•	 All workforce will be considered and an understanding	of how all

positions at	all levels affect	cyber	risk.

•	 Steve Woskov provided an overview	of	the framework	which	looks	

from	a	horizontal and vertical cyber lense. There	were	seven	business	

functions that	can be found in any organization. Three are different

position levels and categories such as executive leadership, middle

management	and individual contributor. What	is the risk to an

organization if a	role is not	fulfilled the importance of position and

function and once identified, what	are the mitigations and how do

they tie back to the frameworks?

•	 Rachael provided an example of how the information applies to

business functions. The	example drills	down	the different	positions to
	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 		

	 	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	

	 	 	 	

	 	 	 	

	 	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	 	 	

	 	 	 		

	 	 	 	 	 	 	 	 	 	

	 	 	 	 	 	 	 	 	 	

show	how the end user can process information. Shown are what	

cyber	risks	in	these positions may need to consider. For example,

working with a	3rd party introduces information risk.	A	mitigation

strategy is	to have the proper planning and to make sure all

employees understand how to keep the information secure.

•	 The source of the business functions derive from the project	team

and their experiences.	

•	 This subgroup also has a	literature review team that	will ask these

questions to reinforce what	we’re doing.

•	 With the new release of the NICE framework we’ll need to relook and

map against	this new construct. The	hope	is this tool will introduce

persons to the NICE Cybersecurity Framework.	The best	intersection

will be in area	of describing why we don’t	have job titles in

framework.	

•	 This project	team is defining mitigation strategies and roles across the

various business functions. The hope is that	this working	group

meeting generates additional interest.	Members look across other

subgroups to pull	information on	other tasks.	For example, training

could be more intense with security or there could be different	types.

The critical mass can flesh out	the twenty-one permeations of	training

at	different	levels.

•	 The subgroup asks for feedback on this model. To	review,	go to

SharePoint	

(https://nistgov.sharepoint.com/sites/NICEProgram/NICEWG/Workfo

rceManagement/) and add commentary or reach out	to Pilar, Steve,

and Rachael etc. We also welcome volunteers. If this project	interests

you and you wish to help	drill	down	the seven functional areas, let	us

know.

•	 For more information see attached presentation and go here:	

Cybersecurity Human Factors Mapping Project

VIII.	 Summary of Action Items

•	 Comments on the NICE Cybersecurity Framework are due by January 6th.

•	 Feedback on both the model and construct	of the HFMP is welcomed as

well as additional volunteers.

IX.	 Next Meeting Reminder –The next	NICEWG meeting is scheduled for January

25th, 2017. Reminder that	there will be no meeting in December.