What it covers. The NICE Workforce Framework for Cybersecurity, published as NIST SP 800-181 Revision 1, provides a common language for describing cybersecurity work and the people who do it. It is built from task, knowledge and skill statements, which can be grouped into work roles and competency areas. NIST maintains the detailed content separately so it can be updated more often than the publication.
In practice. Organisations use the framework to define roles and job descriptions, identify skills gaps, plan training and certification paths and design career progression. It also helps in workforce planning and in describing staffing needs to suppliers. Evidence includes role definitions mapped to work roles, skills assessments and training plans linked to identified gaps.
Common gaps. Organisations sometimes map job titles to work roles without assessing actual skills. Roles combining several areas, common in smaller teams, are hard to represent.