Comparison of Federal Cybersecurity Workforce Guidelines CAE Program NICE Workforce Framework DoD CWF Goal/ Objective Promotes higher education and research; and produces professionals with information assurance (IA) expertise in various disciplines Describes and categorizes cybersecurity work and identifies sample job titles, tasks and KSAs Provides the foundation for identifying education, training, and certification requirements to support cybersecurity personnel qualification Audience 2-year, 4-year and institutions in the U.S. seeking CAE designation students, employers, and hiring managers colleges training vendors students employers/employees policymakers military, civilian, and contractor cybersecurity personnel training vendors, certification bodies, colleges, and continuing education providers Mapping Components 2Y Core Knowledge 4Y Core + Optional 7 Categories 31 Specialty Areas Task/KSA level Job Titles DoD work roles, tasks, functions and baseline KSAs Under Development Integration The NICE Framework informed development of the CAE Knowledge (KUs); thus, many CAE Core KUs are core across the NICE Framework Specialty Areas. NICE Framework will also inform development and implementation of the DoD CWF. Important CAE re-designation required by December 2014 JBL maps will available to CAE customers January 2015 Version 2.0 released May 2014 NICCS Cybersecurity Training Catalog now open to all training providers Currently under development; no target date available 8570.01 to be revised JBL will monitor DoD initiatives in 2014 MAPPING THE ISSA SERIES TO FEDERAL REQUIREMENTS After reviewing current federal cybersecurity workforce initiatives, Jones and Bartlett Learning mapped the ISSA curriculum to the CAE IA/CD k. The logical place to begin our mapping exercise was to the CAE KUs, since the NICE Framework influenced development of the CAE Knowledge Units (KUs), and the DoD Cybersecurity Workforce Development Framework will also consider the NICE Framework.. Jones & Bartlett Learning will continue to monitor development of the DoD CWDF and map appropriate components to ISSA courses () as necessary in the future. Additionally, we are reviewing efforts to map to the NICE Framework. Our goal was to help our customers, whether colleges and universities or technology training providers, identify the cybersecurity workforce skills to which our ISSA curriculum uniquely maps. We also wanted to ease the burden of meeting government mapping standards. Our ISSA course mappings thus add value in the following ways:
They support CAE institutions in meeting CAE KU mapping requirements for CAE IA/CD designation. Since the CAE structure focuses on the knowledge requirements of academic course content, we will provide each customer with a completed KU Mapping Matrix (in an Excel spreadsheet) for each ISSA course used in the customer’s curriculum for submission to the NSA CAE application website. They facilitate training vendors’ submissions of ISSA courses mapped to the National Cybersecurity Workforce Framework. Once published in the Education and Training Catalog, courses will be visible to a nationwide audience, offering a marketing opportunity. They promote courses identified by Specialty Area, Focus Area, tasks, or job title so that students and employees can more easily search for courses appropriate to their needs and career paths. NOTE: Jones & Bartlett Learning will refresh our cybersecurity course mappings on a regular basis as new textbooks, lab manuals, and courseware are completed. ISSA Curriculum MapPING - CAE Knowledge Units and Focus Areas Jones & Bartlett Learning made it a priority to address the NSA/DHS Centers of Academic Excellence (CAE) IA/CD requirement to map to Core Knowledge Units (KUs). Our academic customers who are CAE-designated must meet the new curriculum-mapping requirements by the end of 2014. They must apply via the CAE IA/CD website for each course. To facilitate our customers’ submission of all courses (Topics and Outcomes) to NSA’s online database, Jones & Bartlett Learning will provide a completed KU Mapping Matrix (Excel spreadsheet format) for each ISSA course. These will be promoted via our sales representatives, webinars, and marketing on . ISSA Curriculum - KU Mapping Matrix The basic features of all CAE Knowledge Units, Core and Optional, are Topics, Outcomes and Courses. A minimum list of Topics to be covered and one or more Outcomes, or learning objectives, is required. CAE Core 2Y and Core 4Y KUs were mapped to the 13 courses in the ISSA curriculum: Access Control, Authentication, and Public Key Infrastructure Auditing IT Infrastructure for Compliance Systems Forensics, Investigation and Response Fundamentals of Information Systems Security (online course Introduction to Information Systems Security) Hacker Techniques, Tools, and Incident Handling Legal Issues in Information Security Security Strategies in Linux Platforms and Applications Network Communications Infrastructure Network Security, Firewalls, and VPNs Security Policies and Implementation Issues
Systems Requirements Planning Test and Evaluation Systems Development Oversee and Govern Legal Advice and Advocacy Strategic Planning and Policy Development Training, Education and Awareness Information Systems Security Operations Security Program Management Risk Management Knowledge Management Operate and Maintain Data Administration Customer Service and Technical Support Network Services System Administration Systems Security Analysis Protect and Defend Enterprise Network Defense (END) Analysis Incident Response Enterprise Network Defense (END) Infrastructure Support Vulnerability Assessment and Management Analyze All Source Intelligence Exploitation Analysis Targets Threat Analysis Collect and Operate Collection Operations Operations Planning Cyber Operations Investigate Investigation Digital Forensics the Cybersecurity Workforce Framework The Workforce Framework can be an important tool in building and maintaining a highly skilled and agile workforce because it provides the necessary structure and common language for standardizing the description of cybersecurity work. Benefits of having a common language include: Helping academic institutions and training providers develop relevant training for cybersecurity jobs Giving students and job candidates a better understanding of the skills needed for cybersecurity careers Providing employers with clear skill requirements to use for recruitment, selection, and workforce development Supporting policymakers who must set standards to promote workforce professionalization National Initiative for Cybersecurity Careers and Studies (NICCS)