How to Manage Cybersecurity Teams With NICE

TL;DR

Use the NICE Framework’s common language of tasks, knowledge, skills, work roles, and competencies to define cybersecurity work and align hiring, development, and assessment. Its agile, flexible, interoperable, and modular structure lets organizations adapt workforce practices to their operating context while communicating consistently across teams, sectors, and related workforce frameworks.

Transcript

And welcome to this edition of our RSAC 365 Webcast Series. We are joined today by, by a special guest, Karen Wetzel, and, uh, she's going to be talking to us about how to use the NICE Framework to help you manage your cybersecurity workforce. Before we get started, please note that during the webcast, all participants will be in listen-only mode. ... Read More

Key Insights

• The NICE Framework is a common lexicon for describing and sharing information about cybersecurity work. Its terminology supports clearer communication when organizations identify workforce needs, recruit candidates, develop employees, assess capabilities, and retain cybersecurity talent across different sectors and organizational sizes.
• Task, knowledge, and skill statements are the framework’s core building blocks. Task statements define work that must be completed, skill statements describe what someone must be able to do, and knowledge statements describe what someone must know to perform that work.
• A NICE Framework work role is a grouping of tasks for which someone is responsible. It is not the same as a job title or position, because a single employee or position may carry responsibilities associated with multiple work roles.
• A NICE Framework competency is a grouping of task, knowledge, and skill statements that represents a broad workforce need. Competencies can support learner assessment, provide starting points for foundational learning, or guide the development of higher-level expertise in a cybersecurity domain.
• The framework’s agility supports adaptation as people, processes, and technologies mature. Organizations can use its descriptions of necessary cybersecurity work to keep their workforce planning aligned with a constantly evolving cybersecurity ecosystem.
• The framework’s flexibility allows organizations to account for their unique operating contexts. It does not prescribe a single workforce solution, even though organizations may encounter similar cybersecurity challenges and need comparable ways to describe the work involved.
• The framework’s interoperability comes from using consistent terms that enable information exchange across organizations. Its modularity also allows cybersecurity workforce information to work alongside related areas such as privacy, risk management, and software engineering.
• NICE focuses specifically on the cybersecurity workforce through partnerships involving government, academia, and the private sector. Its activities include leadership, coordination, community engagement, events, career awareness, school outreach, education, training, apprenticeships, and industry and government outreach.

Questions & Answers

Q: What is the NICE Framework for cybersecurity?

The NICE Workforce Framework for Cybersecurity is a fundamental resource for describing and sharing information about cybersecurity work. It provides a common and consistent lexicon that organizations can use to identify, recruit, develop, assess, and retain talent. It is designed for dedicated cybersecurity professionals as well as other people whose work includes responsibility for managing cybersecurity risks.

Q: How can the NICE Framework improve cybersecurity hiring?

The NICE Framework can improve hiring by giving organizations consistent language for defining the work a position must cover. Employers can use its tasks and work roles to clarify responsibilities, then connect those responsibilities with the knowledge and skills candidates need. This approach can make job descriptions more precise and improve communication among hiring managers, workforce planners, candidates, and training providers.

Q: What are task, knowledge, and skill statements in NICE?

Task, knowledge, and skill statements are the NICE Framework’s foundational building blocks. A task statement identifies work that must be performed. A skill statement describes what a person must be able to do to complete that work. A knowledge statement identifies what the person must know. Organizations can combine these statements into work roles and competencies for workforce planning and assessment.

Q: How is a NICE work role different from a job title?

A NICE work role groups the tasks for which a person is responsible, while a job title or position is an organization-specific employment label. One position may include responsibilities from several NICE work roles. A title may occasionally match a framework role title, but that match is coincidental rather than required. The framework focuses on performed work, not organizational naming conventions.

Q: What are competencies in the NICE Framework?

Competencies are groupings of task, knowledge, and skill statements that provide a higher-level view of cybersecurity work and a means of assessing a learner. They can represent broad organizational needs, guide foundational study, or support advanced expertise. A competency can also be overlaid on a work role when an organization needs additional domain-specific capability, such as cloud security.

Q: How can NICE competencies supplement cybersecurity work roles?

A competency can supplement a work role by adding knowledge, skills, and tasks needed in a particular operating context. The webcast gives the example of adding a cloud security competency to a system administrator work role. This allows an organization to retain a broadly applicable role definition while representing additional expertise required for its technologies, risks, or workforce objectives.

Q: Why is the NICE Framework designed to be flexible?

The NICE Framework is flexible because organizations face similar cybersecurity challenges but do not share one universal operating model. Its building blocks can be applied in ways that reflect an organization’s specific context, workforce structure, and needs. This flexibility supports organizations of different sizes and sectors without forcing every employer to use identical job titles, positions, team designs, or development practices.

Q: How does the NICE Framework support workforce development and assessment?

The NICE Framework supports development and assessment by connecting defined work with the knowledge and skills needed to perform it. Work roles can help organizations describe jobs, build teams, and target training needs. Competencies can provide a basis for assessing learners, beginning study in a cybersecurity area, or building deeper expertise. Together, these elements help reveal capability requirements and development priorities.

Summary & Key Takeaways

• The NICE Framework is a fundamental resource for describing cybersecurity work and sharing workforce information. It establishes consistent terminology that organizations can apply when identifying, recruiting, developing, and retaining talent. Its intended audience includes government, academia, private-sector organizations, dedicated cybersecurity professionals, and other workers whose responsibilities involve managing cybersecurity risks.

• The framework describes work through task, knowledge, and skill statements. Tasks specify work to be completed, skills describe what a person must be able to do, and knowledge identifies what a person must know. Organizations can combine these building blocks into work roles or competencies for different workforce management applications.

• Work roles group tasks assigned to a person, but they are not equivalent to job titles or positions. One position may include several work roles. Competencies group task, knowledge, and skill statements around broader needs and can supplement roles, such as adding cloud security competency to a system administrator role.