NICE Framework Workshop
April 18, 2017
U.S. Office of Personnel Management
11/27/2023
1
NICE Framework Workshop
Welcome and Overview
April 18, 2017
April Davis,
Director of Classification and Assessment Policy
Recruitment and Hiring
Employee Services
U.S. Office of Personnel Management
2
The National Initiative for Cybersecurity Education (NICE)
The NICE Workforce Framework Overview
April 18, 2017
Bill Newhouse, Deputy Director of NICE
Applied Cybersecurity Division, Information Technology Laboratory, National Institute of Standards and Technology (NIST)
Framework Origins
4
Framework Background
The Framework provides a common understanding of
cybersecurity work. Defining the cybersecurity population
consistently, using standardized terms is an essential step in
ensuring that our country is able to educate, recruit, train,
develop, and retain a highly-qualified workforce.
5
Framework Purpose
To describe cybersecurity work irrespective of organizational
structures, job titles, or other potentially idiosyncratic
conventions. All cybersecurity work can be described using the
Framework, even though there may not always be a one-to-one
correspondence with a particular job or occupation.
6
Framework Development
developed consistent with professional guidelines and best
practices. Using a comprehensive job analytic approach, data
were collected from across the government and additional
information gathered from academia and the public and private
sectors.
7
Data Gathering
As early as 2002, the importance of identifying cybersecurity work and
worker requirements has been recognized and addressed
extensively at the individual agency, department, and intelligence
community (IC) levels, including the Department of Defense (DoD),
Office of Personnel Management (OPM), and others. Many of these
previous efforts involved rigorous job analyses. Therefore, the data
and information from these efforts provided a technically sound
foundation and efficient approach for developing the Framework.
8
Sources Used to Develop Initial Draft of Framework (as noted in 2012)
•
•
•
•
•
•
Department of Defense (DoD) Cybersecurity Workforce Framework is composed of cybersecurity functional roles, associated job
tasks, and the knowledges, skills, and abilities (KSAs) required to perform those tasks. This content was compiled by organizational
psychology experts and reviewed by subject matter experts (SMEs) through a series of focus groups. The final framework was reviewed
and revised by additional SMEs and stakeholders; 118 SMEs across Air Force, Army, Navy, Marines, and NSA participated in the
development of this framework.
Intelligence Community (IC) Cyber Subdirectory presents a comprehensive list of competencies and knowledges, skills, and abilities
(KSAs) needed by IC cybersecurity professionals to fulfill mission requirements. Subdirectory content was gathered through a data call
to 16 IC elements and was compiled by organizational psychology experts. A series of focus groups with 11 SMEs from across the IC
was conducted with an additional review from other SMEs and senior IC stakeholders. Finally, an electronic questionnaire was
completed by 51 cybersecurity professionals from across the IC (including Air Force, Army, CIA, DHS, DIA, DC3, FBI, ODNI, NSA, DoS) to
gather confirmatory data for the competencies and KSAs.
Office of Personnel Management (OPM) Cybersecurity Model includes core and technical competencies for cybersecurity professionals
across four occupational series. This competency model was developed through focus groups and an electronic questionnaire sent to
approximately 50,000 employees and supervisors with significant responsibilities for some aspect of cybersecurity. Participation for
both of these efforts was across the Federal government.
National Security Agency (NSA) Computer Network Operations (CNO) Training Roadmaps establish job tasks and KSAs for CNO work
roles and the training available to develop different levels of proficiency within those roles. A series of focus groups with SMEs from
each work role were conducted to refine work role definitions and draft lists of tasks and KSAs for the roadmap while National
Cryptologic School (NCS) curriculum managers, instructors, and other experts from 34 curricula reviewed the linkages and provided
proficiency information.
Department of Defense (DoD) 8570: Information Assurance Workforce Improvement Program Manual provides guidance and
procedures for training, certification, and workforce management of the DoD Information Assurance (IA) work functions. A series of
working groups helped to develop the manual by identifying public and private sector resources relevant to IA and then organizing the
resources by function and work level.
Department of Homeland Security (DHS) Information Technology (IT) Security Essential Body of Knowledge (EBK) summarizes the IT
security skill requirements for the IT security workforce and links competencies and functional perspectives to IT security roles. A
working group developed the EBK, and a series of role-specific focus groups were conducted to ensure content across IT security roles
was fully represented. Input from the private sector, government, and academia was obtained. In addition, public comment was
provided through the Federal Register and incorporated into the final document.
9
Expert Review and Analysis
• The bodies of work in the previous slide, along with other collected
reports, studies, documents, and discussions with Subject Matter Experts
(SMEs) were used to develop the first draft of the Framework.
• NICE leadership reviewed the draft Framework throughout the
development effort identified additional SMEs to participate in the review
process.
• Experts from other government agencies and working groups (e.g., NIST
800-16 Working Group), and from private industry (e.g., Booz Allen
Hamilton and CompTIA) were identified to provide additional input on the
initial draft. W
• hen possible, quantitative data were gathered on the relevance of the draft
specialty areas, and the importance of the tasks and KSAs considered for
inclusion in the Framework.
• Focus groups were also conducted to refine Framework content.
10
Public Comment Period for first Framework
• Public Comment Period The draft Framework was released for public
comment in September, 2011.
• The draft was posted on the National Institutes for Standards and
Technology (NIST) website with a request for comments.
• Concurrently, the Framework was presented at a variety of industry and
government meetings and conferences.
• The Framework was also briefed to numerous stakeholder groups
throughout the federal organizations participating in NICE.
• Over 1,300 formal written comments were received and additional
feedback was also gathered in targeted focus groups.
• Over 90 organizations participated in the review and feedback process.
These included multiple federal organizations (including agencies in DoD
and the IC) as well as interagency federal groups such as the Federal Chief
Information Officer Council, and state and local governments. Experts from
private industry (e.g., CompTIA, C3, Dell, and IBM) also provided input.
11
Finalizing the first Framework
• Finalizing the Framework Once all comments were analyzed, the
Framework was updated to incorporate the feedback that reflected new
information or provided clarification or other meaningful input.
• As in any large-scale adjudication process, some contradictory feedback
was received. In these instances additional review was conducted to
reconcile the feedback and identify the optimal revision to be made to the
Framework.
• Ultimately most of the edits that were made involved renaming specialty
areas and categories to better reflect the cybersecurity work conducted in
that area, adding tasks and KSAs, removing tasks and KSAs that were noted
as unimportant, and revising tasks and KSAs to improve clarity.
• The limited extent of the revisions needed to finalize the Framework is a
reflection of the robust development process
12
Federal Department and Agency Support
Over 20 Federal Departments and Agencies supported
framework development, including:
Department of State
Department of Education
Department of Labor
Office of Management and Budget
Office of Personnel Management
Department of Defense
Department of Justice
Information Sciences & Technologies
Department of Homeland Security
(including NPPD, TSA, USSS, Coast
Guard, ICE, CBP, CIS, DHS OI&A).
Central Intelligence Agency
Defense Intelligence Agency
Director of National Intelligence
Federal Bureau of Investigation
National Security Agency
National Science Foundation
Department of Defense /DC3x
National Counterintelligence Executive
Federal CIO Council
13
Non-Profit & Government Organizations
In addition, NICE has worked very closely with non-profit and
governmental organizations to socialize the framework. A nonexhaustive list:
•FedCIO Council IT Work Force Committee
(ITWFC)
• Committee of National Systems Security
(CNSS)
• FedCIO Council Information Security and
Identity Management Committee (ISIMC)
• National Cybersecurity Alliance (NCSA)
• Federal Information Systems Security
Educators Association (FISSEA)
• Colloquium for Information Systems
Security Educators (CISSE)
• Colloquium for Advanced Cybersecurity
Education (CACE)
• Washington Cyber Roundtable
• CyberWatch
•US Cyber Challenge
• National Association of State Chief
Information Officers (NASCIO)
• Multi-State Information Sharing and
Analysis Center (MS-ISAC)
•Information Systems Security Association
(ISSA)
• National Board of Information security
Examiners (NBISE)
• Cybersecurity Certification Collaborative
(C3)
• Institute for Information Infrastructure
Protection (I3P)
• Association for Computing machinery
(ACM)
• Institute of Electrical and Electronics
Engineers (IEEE)
14
FRAMEWORK
DEEP DIVE
15
Framework Development Process
1
Conducting Internet searches and collecting
documents (reports, websites, briefings, etc.) from
across the government related to workforce constructs
such as:
Computer network defense (CND) service provider
organizations, Computer network operations (CNO),
Cyber investigation, Cybersecurity , Counterintelligence,
Counterintelligence in Cyberspace, IT infrastructure,
operations, development and information assurance.
2
3
Refine existing definitions of cybersecurity specialty
areas based on collected information
4
5
New specialty areas included Investigation,
Technology Demonstration, Information Systems
Security Management, etc.
6
Review existing task and KSA statements that define
the work within specialty areas.
Sample reviewed documents included: Some of the
reviewed documents were:
Office of Personnel Management’s occupational
standards (OPM, 2010), Job descriptions from the
Department of Labor’s O*NET database (2010), DoD
8570.01-M Information Assurance Workforce
Improvement Program (DoD, 2010), DoD Cybersecurity
Workforce Framework, DoD Counterintelligence in
Cyberspace Training and Professional Development
Plan, Federal Cybersecurity Workforce Transformation
Working Group Report on Cybersecurity Competencies
Conduct focus groups with subject matter experts
to identify and define specialty areas not noted in
previous documents
7
Identify, collect, write new task and KSA statements
where appropriate.
8
Gather SME input on task and KSA statements.
9
Refine framework as necessary through workshops,
meetings, and stakeholder input.
ongoing
16
Framework Relative Specificity
Very
Broad
Cybersecurity
Category
Very
Specific
Specialty
Area
Competency
KSA
Task
17
Framework Categories
The first Framework
organized cybersecurity
into seven high-level
categories, each
comprised of several
specialty areas.
18
Original 7 Categories - Defined
Securely
Provision
Specialty areas concerned with conceptualizing, designing,
and building secure IT systems.
Operate and
Maintain
Specialty areas responsible for providing the support,
administration, and maintenance necessary to ensure effective
and efficient IT system performance and security.
Protect and
Defend
Specialty area responsible for the identification, analysis and
mitigation of threats to IT systems and networks.
Investigate
Specialty areas responsible for the investigation of cyber
events or crimes which occur within IT Systems and networks.
Operate and
Collect
Specialty areas responsible for the highly specialized and
largely classified collection of cybersecurity information that
may be used to develop intelligence.
Analyze
Specialty area responsible for highly specialized and largely
classified review and evaluation of incoming cybersecurity
information.
Support
Specialty areas that provide critical support so that others may
effectively conduct their cybersecurity work.
19
National Cybersecurity Workforce Framework - Timeline
• September 2011 - Draft posted for public comment
• December – August 2012 - Comment adjudication used to update
framework
• September 2012 – framework entered into OMB process for gov’t wide
review
• April 2013 – National Cybersecurity Workforce Framework (version 1.0)
posted as interactive pdf booklet
– Printed versions became known as the paint chip book
– Based on feedback during gov’t wide review, DHS agreed to lead an update/review of
selected specialty areas
• April 2014 – DHS drafted National Cybersecurity Workforce Framework
(version 2.0) as a spreadsheet
• April 2015 – DoD Cyber Strategy kicks off work to draft a defense cyber
workforce framework (DCWF) using NCWF version 2.0 as the starting point
• December 2015 – October 2016, NIST leads process to draft NIST Special
Publication 800-181 using DCWF as the starting point
• November 2016 – NIST releases draft Special Publication 800-181
20
July 2013 OPM Special Cybersecurity
Workforce Project and 2014 OPM Guide to
Data Standards A-103
• OPM defined two-digit Cybersecurity Category/Specialty Area
codes pulled from NICE Cybersecurity Workforce Framework
– 31 of 41 codes match specialty areas in the NICE Framework
– 7 of 41 codes are the categories in which those specialty areas reside in
NICE Framework
– 2 codes not from NICE Framework were added after consultation with
CIO Council
• Cybersecurity Program/Project Management value (80).
• Supervisors, managers, and leaders engaged in supervision of a cybersecurity function
or staff performing cybersecurity work
– 1 code for Not Applicable - Position does not involve work in one or more
cybersecurity functions
21
NICE Strategic Goals - http://csrc.nist.gov/nice/about/strategicplan.html
Accelerate Learning and Skills Development
• Inspire a sense of urgency in both the public and private sectors
to address the shortage of skilled cybersecurity workers
Nurture A Diverse Learning Community
• Strengthen education and training across the ecosystem to
emphasize learning, measure outcomes, and diversify the
cybersecurity workforce
Guide Career Development & Workforce Planning
• Support employers to address market demands and enhance
recruitment, hiring, development, and retention of
cybersecurity talent
22
NICE Strategic Goal #3: Guide Career Development and Workforce Planning
Support employers to address market demands and enhance recruitment, hiring,
development, and retention of cybersecurity talent
Objectives:
3.1 Identify and analyze data sources that support projecting present and
future demand and supply of qualified cybersecurity workers
3.2 Publish and raise awareness of the NICE Cybersecurity Workforce
Framework and encourage adoption
3.3 Facilitate state and regional consortia to identify cybersecurity pathways
addressing local workforce needs
3.4 Promote tools that assist human resource professionals and hiring
managers with recruitment, hiring, development, and retention of
cybersecurity professionals
3.5 Collaborate internationally to share best practices in cybersecurity career
development and workforce planning
23
NICE Workforce Framework
Categories
The NICE Workforce
Framework, (NIST Special
Publication 800-181, now
organizes cybersecurity
into seven high-level
categories, each
comprised of several
specialty areas and work
roles.
24
NICE Workforce Framework Categories
Categories
Descriptions
Securely Provision (SP)
Conceptualizes, designs, and builds secure information technology (IT)
systems, with responsibility for aspects of systems and/or networks
development.
Operate and Maintain
(OM)
Provides the support, administration, and maintenance necessary to
ensure effective and efficient information technology (IT) system
performance and security.
Oversee and Govern (OV)
Provides leadership, management, direction, or development and
advocacy so the organization may effectively conduct cybersecurity
work.
Protect and Defend (PR)
Identifies, analyzes, and mitigates threats to internal information
technology (IT) systems and/or networks.
Performs highly specialized review and evaluation of incoming
cybersecurity information to determine its usefulness for intelligence.
Provides specialized denial and deception operations and collection of
cybersecurity information that may be used to develop intelligence.
Investigates cybersecurity events or crimes related to information
technology (IT) systems, networks, and digital evidence.
Analyze (AN)
Collect and Operate (CO)
Investigate (IN)
25
NICE Cybersecurity Workforce Framework – Draft NIST SP 800-181
Cybersecurity Work Roles Work Categories (7)
SECURELY
PROVISION
OPERATE
AND
MAINTAIN
OVERSEE
AND
GOVERN
PROTECT
AND
DEFEND
ANALYZE
COLLECT
AND
OPERATE
INVESTIGATE
• Specialty Areas (33) – Distinct areas of cybersecurity work;
• Work Roles (52) – The most detailed groupings of IT, cybersecurity or cyber-related work, which
include specific knowledge, skills, and abilities required to perform a set of tasks.
• Tasks – Specific work activities that could be assigned to a professional working in one of the
NCWF’s Work Roles; and,
• Knowledge, Skills, and Abilities (KSAs) – Attributes required to perform Tasks, generally
demonstrated through relevant experience or performance-based education and training.
• Audience:
• Employers
• Current and Future Cybersecurity Workers
• Training and Certification Providers
• Education Providers
• Technology Providers
NIST SP 800-181 NICE Workforce Framework Relative Specificity
Very
Broad
Cybersecurity
Category
Very
Specific
Specialty
Area
Work Roles
KSA
Task
27
Securely Provision (7 Specialty Areas, 11 Work Roles)
Category
Specialty Area
Work Role
Authorizing Official/Designating Representative
Risk Management
Security Control Assessor
Software Development
Securely
Provision
Systems Architecture
Software Developer
Secure Software Assessor
Enterprise Architect
Security Architect
Technology R&D
Research & Development Specialist
Systems Requirements
Planning
Systems Requirements Planner
Test and Evaluation
Testing and Evaluation Specialist
Systems Development
Information Systems Security Developer
Systems Developer
28
Operate and Maintain (6 Specialty Areas, 7 Work Roles)
Category
Specialty Area
Data Administration
Operate and
Maintain
Work Role
Database Administrator
Data Analyst
Knowledge Management
Knowledge Manager
Customer Service and
Technical Support
Technical Support Specialist
Network Services
Network Operations Specialist
Systems Administration
System Administrator
Systems Analysis
Systems Security Analyst
29
Oversee and Govern (6 Specialty Areas, 14 Work Roles)
Category
Specialty Area
Legal Advice and Advocacy
Training, Education, and
Awareness
Cybersecurity Management
Oversee
and Govern
Strategic Planning and Policy
Work Role
Cyber Legal Advisor
Privacy Compliance Manager
Cyber Instructional Curriculum Developer
Cyber Instructor
Information Systems Security Manager
COMSEC Manager
Cyber Workforce Developer and Manager
Cyber Policy and Strategy Planner
Executive Cyber Leadership
Executive Cyber Leadership
Program Manager
Acquisition and
Program/Project
Management
IT Project Manager
Product Support Manager
IT Investment/Portfolio Manager
IT Program Auditor
30
Protect and Defend (4 Specialty Areas, 4 Work Roles)
Category
Specialty Area
Work Role
Cyber Defense Analysis
Cyber Defense Analyst
Cyber Defense Infrastructure
Support
Protect and
Defend
Incident Response
Vulnerability Assessment and
Management
Cyber Defense Infrastructure Support Specialist
Cyber Defense Incident Responder
Vulnerability Assessment Analyst
31
Analyze (5 Specialty Areas, 7 Work Roles)
Category
Specialty Area
Work Role
Threat Analysis
Warning Analyst
Exploitation Analysis
Exploitation Analyst
All-Source Analyst
Analyze
All-Source Analysis
Mission Assessment Specialist
Targets
Target Developer
Target Network Analyst
Language Analysis
Multi-Disciplined Language Analyst
32
Operate and Collect (3 Specialty Areas, 6 Work Roles)
Category
Specialty Area
Collection Operations
Work Role
All Source-Collection Manager
All Source-Collection Requirements Manager
Cyber Intel Planner
Collect and
Cyber Operational Planning
Operate
Cyber Ops Planner
Partner Integration Planner
Cyber Operations
Cyber Operator
33
Investigate (2 Specialty Areas, 3 Work Roles)
Category
Specialty Area
Work Role
Cyber Investigation
Cyber Crime Investigator
Investigate
Forensics Analyst
Digital Forensics
Cyber Defense Forensics Analyst
34
Building Blocks for a Capable and Ready Cybersecurity Workforce
35
National Initiative for Cybersecurity Education (NICE)
• The NICE strategic plan http://csrc.nist.gov/nice/about/strategicplan.html
• The NICE Cybersecurity Workforce Framework
http://csrc.nist.gov/publications/PubsDrafts.html#SP-800-181
Resources (for industry, gov’t, and academia)
• The NICE Working Group and subgroups (K-12, Collegiate, Competitions, Training
and Certifications, and Workforce Management)
http://csrc.nist.gov/nice/nicewg/index.html
– Forum to identify and share best practices that help us as a nation make progress towards
the NICE Strategic goals and objectives.
• NICE grants to 5 Regional Alliances and Multistakeholder Partnerships to Stimulate
(RAMPS) Cybersecurity Education and Workforce Development
• NICE grant for the creation of Cyberseek http://cyberseek.org/
• NICE challenge Project https://www.nice-challenge.com/
– cyber challenge labs emphasize real world skills like problem solving, self-learning, and
documentation over regurgitating step-by-step instructions and limited simulations.
36
Cybersecurity
Position Coding
Cyber HR Cadre Training
April 18, 2017
11/27/202
37
Cybersecurity Position Coding
Incorporate new NICE codes
Requirements
of Federal
Cybersecurity
Workforce
Assessment Act
Use codes to identify positions
performing IT, cybersecurity, cyberrelated functions
Identify critical needs functions /
work roles
11/27/2023
38
Cybersecurity Position Coding
Intended Outcomes of
Federal Cybersecurity
Workforce Assessment
Act and Coding
Establish
workforce
planning
mechanisms
Address
cybersecurity
critical needs
and close skill
gaps
Strengthen
mission
accomplishment
11/27/2023
39
Cybersecurity Position Coding
Framework
11/27/2023
40
Cybersecurity Position Coding
New Coding Structure
Category
Securely
Provision
Specialty Area
Work Role
Risk
Authorizing
Management Official/
Designating
Representative
Security
Control
Assessor
Software
Development
Software
Developer
Secure
Software
Assessor
11/27/202
OPM Code
Work Role Description
611
Senior official or executive with the authority to
formally assume responsibility for operating an
information system at an acceptable level of risk to
organizational operations (including mission,
functions, image, or reputation), organizational
assets, individuals, other organizations, and the
Nation (CNSSI 4009).
612
Conducts independent comprehensive assessments
of the management, operational, and technical
security controls and control enhancements
employed within or inherited by an information
technology (IT) system to determine the overall
effectiveness of the controls (as defined in NIST SP
800-37).
621
Develops, creates, maintains, and writes/codes new
(or modifies existing) computer applications,
software, or specialized utility programs.
622
Analyzes the security of new or existing computer
applications, software, or specialized utility programs
and provides actionable results.
41
Cybersecurity Position Coding
• Codes align to NICE Cybersecurity Workforce Framework
• Codes and Framework are Beneficial for:
Identifying
critical needs
11/27/202
Justifying action
to retain or gain
critical skills
Enhancing
recruitment and
selection of
needed skills
Training and
development
42
Cybersecurity Position Coding
Timeline
JANUARY 2017: OPM issued Government-wide
implementation guidance for cybersecurity position coding
APRIL 2017: Agencies establish procedures to identify and
code positions requiring performance of IT, cybersecurity, or
other cyber-related functions
DECEMBER 2017: Shared service providers have systems
reprogrammed and able to report new codes
APRIL 2018: Agencies complete coding
April 2019: Agencies identify and report work roles of critical
need in cybersecurity workforce, including vacancies; OPM
and agencies begin addressing work roles of critical need
11/27/202
43
Cybersecurity Position Coding
Collaboration & Resources
Partnership
Resources
Partnership
CIO
MAX Site
Managers
Advisory Group
Agency/OPM
Check Ins
Classifiers
Service Providers
HR
11/27/202
44
Cybersecurity Position Coding
MAX Site
https://community.max.gov/pages
/viewpage.action?spaceKey=Huma
nCapital&title=Cybersecurity+Work
force+Assessment+Law
11/27/2023
45
Cybersecurity Position Coding
Points of Contact
Jodi.Guss@opm.gov
Erika.Viola@opm.gov
11/27/2023
46
Applying the NICE Framework:
Cybersecurity Recruiting and Hiring Policy
and Tools/Department of Homeland Security
PD Push Button Tool
April 18, 2017
April Davis, Director of Classification and Assessment Policy
U.S. Office of Personnel Management
Keith T. Hall, Developer, DHS PushButtonPD™
Department of Homeland Security
47
Classification Policy
• OPM has been proactively collaborating since
2008 with its stakeholders to better
understand the governmentwide
cybersecurity workforce.
• Cybersecurity is an evolving area and
positions may be classified in several
different occupational series, based on the
nature of the work.
11/27/2023
48
Job Family Standard (JFS) for
Administrative Work in the Information
Technology Group
• The majority of cybersecurity work in the
Federal government is classified to the Job
Family Standard (JFS) for Administrative Work
in the Information Technology Group, GS2200 .
11/27/2023
49
Interpretive Guidance for Cybersecurity
Positions
OPM is issuing this policy update and guidance to
assist agencies as they:
• Identify cybersecurity positions;
• Clarify cybersecurity roles and duties;
• Address position management issues;
• Recruit, hire, and develop a qualified cybersecurity
workforce to meet their agency needs;
• Implement training, performance, and retention
programs; and
• Conduct cybersecurity workforce assessments.
11/27/2023
50
2200 JFS and Interpretive Guidance
• Official/basic position title of IT Cybersecurity
• Cybersecurity as a parenthetical title for
other occupations;
• Cybersecurity functions - job codes in the
Guide to Data Standards and the National
Cybersecurity Workforce Framework; and
• Position classification, job evaluation, and
qualifications for cybersecurity positions.
11/27/2023
51
SCENARIO I
• After having collaborated with the hiring manager, you
have determined that the existing position description
for your Information Technology Cybersecurity
Specialist (InfoSec), GS-2210-13 is accurately classified
and coded under the 2-digit cybersecurity coding
process. The position is unique in that it also includes
penetration testing responsibilities.
• The current 2-digit cybersecurity coding is categorized:
– 60 under Securely Provision and assigned 61 under Risk
Management as the specialty area.
– 50 under Protect and Defend and assigned 54 under
Vulnerability Assessment and Management
11/27/2023
52
Information Technology Cybersecurity
Specialist (InfoSec), GS-2210-13
• Major duties
– Develops policies and procedures to ensure information systems reliability and
accessibility and to prevent and defend against unauthorized access to systems, networks,
and data;
– Conducts risk and vulnerability assessments of planned and installed information systems
to identify vulnerabilities, risks, protection needs and ensures integrity of cybersecurity
systems;
– Promotes awareness of security issues among management and ensuring sound security
principles are reflected in organizations’ visions and goals;
– Conducts systems security evaluations, audits, and reviews;
– Develops systems security contingency plans and disaster recovery procedures;
– Develops and implementing programs to ensure that systems, network, and data users
are aware of, understand, and adhere to systems security policies and procedures;
– Conducts and/or supports authorized penetration testing on enterprise network assets.
– Performs penetration testing as required for new or updated applications.
– Evaluates total information protection environment and protocols.
11/27/2023
53
Information Technology Cybersecurity
Specialist (InfoSec), GS-2210-13
• Factor 1, Knowledge Required by the Position
– Mastery of and skill in applying IT systems security
principles, concepts, and methods.
– Mastery of and skill in applying new IT security
developments.
– Mastery of and skill in applying total infrastructure
protection environments sufficient to integrate information
systems security with other security disciplines.
– Knowledge of and skill in applying penetration testing
principles, tools, and techniques.
11/27/2023
54
DHS PushButtonPD™
(Pre-Existing PD Scenario)
1.
2.
3.
4. In the tool, select at least one
Competency / KSA using SELECT KSAs
(BUTTON 4).
5. In the old PD, determine the % of time
performed for each Major Duty in a
In the tool, prepare the tool by
NCWF Code or Occupational Series.
selecting an ORGANIZATION (BUTTON
6. In the tool, allocate the % of time using
1) and PAY PLAN (BUTTON 2).
% OF TIME (BUTTON 5A).
In the old PD, identify the Major Duties
7. In the tool, select the appropriate Titles
within the same NCWF Code or
that match the old PD using Titles
Occupational Series.
(BUTTON 5B).
In the tool, select at least one Task
8. In the tool, select the appropriate Factor
using SELECT TASKS (BUTTON 3) in
Levels that match the old PD using
each Major Duty category
FACTOR LEVELS (BUTTON 5C).
corresponding to the old PD.
9. In the tool, press DRAFT PD (BUTTON 7C)
to view the output.
DHS PushButtonPD™
(Pre-Existing PD Scenario)
• Button 1: Select Organization
• Button 2: Select Pay Plan
DHS PushButtonPD™
(Pre-Existing PD Scenario)
• Button 1: Select Organization
• Button 2: Select Pay Plan
DHS PushButtonPD™
(Pre-Existing PD Scenario)
• Find Tasks and KSAs
DHS PushButtonPD™
(Pre-Existing PD Scenario)
• Find Tasks and KSAs
DHS PushButtonPD™
(Pre-Existing PD Scenario)
• Find Tasks and KSAs
DHS PushButtonPD™
(Pre-Existing PD Scenario)
– Button 5A: Allocate % of Time to
Major Duties
11/27/2023
61
DHS PushButtonPD™
(Pre-Existing PD Scenario)
– Button 5B: Select Title
11/27/2023
62
DHS PushButtonPD™
(Pre-Existing PD Scenario)
– Button 5C: Select Factor Levels
11/27/2023
63
DHS PushButtonPD™
(Pre-Existing PD Scenario)
– Button 7C: Print Draft PD
11/27/2023
64
DHS PushButtonPD™
(Pre-Existing PD Scenario)
– Button 7C: Print Draft PD
– PRIMARY: 541
– PRIMARY (alt): 612
11/27/2023
65
ADDITIONAL SAMPLE CROSSWALKS
ADDITIONAL SAMPLE CROSSWALKS (continued)
ADDITIONAL SAMPLE CROSSWALKS (continued)
SCENARIO II
Based on discussions with your hiring manager
regarding an upcoming reorganization, you have
identified tasks and developed job analyses for
proposed positions associated with the newly
structured organization.
DHS PushButtonPD™
(New PD Scenario)
5. Allocate the % OF TIME (BUTTON 5A).
6. Select the TITLE (BUTTON 5B).
7. Select the FACTOR LEVELS (BUTTON 5C).
–
1. Select an ORGANIZATION (BUTTON 1).
2. Select a PAY PLAN (BUTTON 2).
3. Select TASKS (BUTTON 3 or Task Tabs):
–
–
If a PM, ITPM, Supervisor, or Lead, select tasks
from the OC-5 TAB
If a COR, select tasks from the FAC-COR button
on the ACQ tasks tab
4. Select KSAs (BUTTON 4 or KSA Tabs):
–
OPM Mosaics, select from the OC-5 TAB
If needed, select Selective Placement Factors
(BUTTON 5D).
8. Use other features as needed (BUTTONS
6 through 7A/B).
9. Press DRAFT PD (BUTTON 7C) to view
the output.
10. Use supplemental forms as needed
(BUTTON 7D).
LIVE DEMO
71
Self-Instructed Cybersecurity Training
Federal Virtual Training Environment (FedVTE)
▸ Free, online, on-demand
cybersecurity training
▸ Available to U.S. government
employees and veterans
▸ 60+ courses including prep for
certification exams such as:
• Network +
• Security +
• CISSP
• Certified Ethical Hacker
Sign-up for an account at
fedvte.usalearning.gov
72
Instructor-led Cybersecurity Training
FedVTE Live! offers free, instructor-led online cybersecurity
training to all government employees and veterans
Sign-up by sending an email to fedvtelive@hq.dhs.gov
73
Cybersecurity Training Catalog
The NICCS Website Training Catalog locates nearby
cybersecurity courses, allowing all users to find courses that
help them stay up-to-date on their knowledge and skills
Visit niccs.us-cert.gov to find your next course!
74
Application of Cybersecurity Workforce
Framework and Coding
• Workforce Planning
– FCWAA establishes common workforce planning
approach with focus on Work Roles
– Accepted approach for demonstrating critical
needs and justifying action to hire, develop,
retain talent
– Important during times of robust or lean budgets
11/27/202
75
Questions
76
Resources
Federal Cybersecurity Workforce Assessment Act and Coding:
• MAX site –
https://community.max.gov/pages/viewpage.action?spaceKey=Hu
manCapital&title=Cybersecurity+Workforce+Assessment+Law
Federal Cybersecurity Coding Structure –
• http://csrc.nist.gov/nice/framework/opm_codes/OPM.pdf
Guidance Memo for Assigning New Cybersecurity Codes –
• https://www.chcoc.gov/content/guidance-assigning-newcybersecurity-codes-positions-information-technologycybersecurity
Resources (cont.)
Workforce Planning (DHS resources):
• Cybersecurity Workforce Development Toolkit:
https://niccs.us-cert.gov/workforcedevelopment/cybersecurity-workforce-development-toolkit
• Cybersecurity Workforce Planning Diagnostic: https://niccs.uscert.gov/sites/default/files/Cybersecurity%20Workforce%20Pl
anning%20Diagnostic_1.pdf?trackDocs=Cybersecurity%20Wor
kforce%20Planning%20Diagnostic_1.pdf
11/27/2023
78
Resources (cont.)
• Cybersecurity Capability Maturity Model: https://niccs.uscert.gov/sites/default/files/Capability%20Maturity%20Model
%20White%20Paper.pdf?trackDocs=Capability%20Maturity%2
0Model%20White%20Paper.pdf
• Best Practices for Planning a Cybersecurity Workforce White
Paper: https://niccs.uscert.gov/sites/default/files/documents/pdf/best_practices_fo
r_planning_a_cybersecurity_workforce_white%20paper_0_0.
pdf?trackDocs=best_practices_for_planning_a_cybersecurity_
workforce_white%20paper_0_0.pdf
11/27/2023
79
Wrap-Up and Next Steps
• Upcoming Cyber HR Cadre Sessions
– Interpretive Guidance for Cybersecurity; Hiring
Official/HR Collaboration; Effective Job Opportunity
Announcements; Guide to Better Occupational
Questionnaires; Hiring Authorities; Pay and Leave
Flexibilities, etc.
– Email notifications from FEDCLASS@opm.gov
• Check-ins with agencies
11/27/2023
80