The NIST NICE Framework: How to improve cybersecurity role clarity and recruiting

500,000.

It's a number all too familiar to those involved in cybersecurity hiring, one that grows year after year.

What does it represent? It's the current number of projected unfilled cybersecurity jobs in the United States, a figure that is only going to continue to grow as businesses continue to feel the direct impact of ransomware, cyberattacks and data breaches.

While some organizations may resign themselves to the fact that they may have to face this Sisyphean task alone, others are beginning to take a new approach: following the NIST NICE Workforce Framework for Cybersecurity. 

So what is the NICE Workforce Framework, and what could implementing it mean for your organization's hiring and employee development efforts? 

To help explain more about how to implement the NICE Workforce Framework and share his thoughts on best practices and lessons learned, Infosec sat down with Slim Beamon, Dean of CyberEDGE Academy and Senior Cybersecurity Program Manager at Leidos in a recent Infosec Inspire Session.

ChatGPT training built for everyone

We've created a training video and supplemental resources to educate every employee on how to use AI tools securely. Meet with a member of our team to get started.

Meet with Us

What is the NICE Framework?

Also known as the National Initiative for Cybersecurity Education (NICE), which is led by the National Institute of Standards and Technology (NIST), the Framework was the result of a government, private sector and academic partnership to help promote cybersecurity education, training and workforce development.

More of a reference structure than regulation or program of its own, the NICE Framework helps organizations to standardize and define cybersecurity roles based on the knowledge areas, skills, and abilities that comprise them. 

Defined in the NIST Special Publication 800-181, the NICE Framework breaks cybersecurity roles into what they call "building blocks that describe the work to be done (in the form of Tasks) and what is required to perform that work (through Knowledge and Skills)." In other words, as the Publication describes, Task statements describe the work, while Knowledge and Skill (K&S) statements describe the learner. 

Based on these building blocks, the NICE Framework has identified 52 cybersecurity work roles, each with its own detailed description of the knowledge, skill, and task statements that make them up. These work roles and their descriptions can be implemented by organizations or modified as needed.

"The beauty of the NIST NICE work role framework is that it is adaptable. And we have been able to create the Leidos cyber work roles that fit our mission across all of our groups," notes Beamon.

What does a NICE Framework implementation look like?

While every organization can use the NICE Framework in its own way, Beamon and the cyber workforce development team at Leidos have used the work roles that fit their mission across their groups, adapting them when they need to and utilizing the descriptions as a starting point.

In doing so, organizations of all sizes and industries can have a more concrete understanding of their cyber professionals' work and the skills they need to recruit and retain. 

"We all have a common understanding of what [each cyber work role] means to each other and the types of individuals that we're going to need in order to do the mission," notes Beamon, "It helps us to be efficient and effective in our communication so recruiters can now understand what you're looking for. Hiring managers can be effective at what they're looking for with the job descriptions, and program managers can now communicate priorities in the right places, based on these work roles."

Organizations can also use the NICE Framework to help with what Beamon refers to as "reskilling and upskilling," which is helping to identify the core elements of what makes for an effective cyber practitioner in a particular role and providing specific training to an individual looking to cross-train or career-change.

What are the benefits of implementing the NICE Framework?

While NIST initially designed the NICE Framework to help describe and share information about the work performed by those in cybersecurity roles, as Beamon points out, there are many other benefits to implementing it, at least in some form.

Some of those benefits include:

• Putting a consistent and recognized structure to their cyber work roles: The NICE Framework helps organizations categorize, organize, and describe key cybersecurity functions, ultimately helping to communicate needs, regardless of size or industry.
• Helping to build pathways for career and professional development: Identifying the knowledge, skills, and abilities (KSAs) that are important to help shape learning opportunities, facilitate cross-training, and pinpoint the real-life skills that make for an effective cyber professional.
• Quantifying the skills and attributes that make up a successful cyber professional: Helping hiring managers and managers to look past a resume and focus more on the passion, skills, and abilities of a potential hire (especially from a different career field) to find the right work role and organizational fit.

Beamon also highlights that having one organization poach an experienced professional from another will not solve the cyber skills gap.

It will mean finding new professionals — from other fields and backgrounds — who want to learn and apply their skills to solve a new kind of problem.

"It's about identifying the 'cyber DNA,' and when we say cyber DNA, again, we go back to the KSAs," Beamon describes CyberEDGE Academy's approach. "We meet a candidate where they are when they are there. If they're a business analyst, we understand that they have strengths as a business analyst that can translate into cyber security."

With the help of the knowledge areas, which map to the work roles, organizations can then identify the specific training required to get that employee operating effectively in their new cybersecurity position.

The NICE Framework: Taking the next step

The NIST NICE Framework is more than just a reference guide; when implemented and used as a standardized method to identify key job functions, share resource needs, and define what makes up a successful cyber professional, it makes for a powerful way to push back against the growing cyber skills gap.

In fact, according to a 2021 Infosec study, 57 percent of hiring managers utilizing at least part of the NICE Framework are more satisfied with their ability to fill open roles. 

To that end, Beamon also shared that if his organization could do the implementation over again, they would begin with a person-based skills assessment. 

"We would've put the assessment piece first and made sure that we understood the 'cyber DNA' of an individual and their KSAs as we go back to the NIST NICE work roles and then on for our roles. By doing that, now we can really tailor our training specifically for the individual and for the work role that we're looking to put them in."

It is perspective changes like these, enabled by the NICE Framework and demonstrated by Leidos, which focus more on the person than the resume, that may finally help reverse the tide toward creating a fulfilling and productive new generation of cyber professionals.

Sources:

• Predicting What 2022 Holds for Cybersecurity, Forbes Magazine
• Workforce Framework for Cybersecurity (NICE Framework), NIST Special Publication 800-181 Revision 1, National Initiative for Cybersecurity Education (NICE)