Guidance, practices and programmes
NIST NICE Framework
A common language for cybersecurity work roles, tasks, knowledge and skills.
Official source Published by US National Institute of Standards and Technology. US government work in the public domain.
What it is
The NICE Workforce Framework for Cybersecurity is a common language for describing cybersecurity work, using work roles, tasks, knowledge and skills. It exists to help organisations hire, train and develop people consistently, and to help education providers align courses with job needs.
Who it applies to
- Security leaders defining team roles and job descriptions
- HR and recruitment teams writing vacancies and career paths
- Training providers, universities and certification bodies
- Organisations comparing it with the European Cybersecurity Skills Framework (ECSF) published by ENISA
- Status
- Voluntary NIST guidance, documented in SP 800-181 Revision 1 (2020), with the detailed components (work roles, tasks, knowledge and skills) maintained separately and updated over time.
- Enforcement
- Voluntary, with no certification. US federal agencies use it to code their cybersecurity positions; elsewhere it is a reference for workforce planning.
Key points
- Roles are not job titles: one job may combine several work roles
- Task statements help write clearer job descriptions and objectives
- Knowledge and skill statements can drive training plans and assessments
- The ECSF is the European counterpart with fewer, broader role profiles and may suit EU organisations better
- Using a shared vocabulary makes it easier to compare certifications and training
Where to start
- 1Map your current security positions to NICE work roles or ECSF profiles
- 2Identify missing roles or overloaded people
- 3Use task and skill statements to update job descriptions and development plans
- 4Align training budgets with the gaps you found
How it is structured
| Work role categories | High level groupings such as oversight and governance, design and development, and protection and defence |
|---|---|
| Work roles | Groups of tasks that make up a job function, such as incident responder |
| Task, knowledge and skill statements | Building blocks describing the work and what people need to perform it |
| Competency areas | Broader areas of capability used for learning and assessment |
A plain-language overview to help you learn, written by ThreatNoir. The official source prevails; this is not legal advice.
Items explained (1)
Ordered by how often our lessons cite them.