What is the NIST NICE Framework?

The NICE Workforce Framework for Cybersecurity, or the NICE Framework for short, is a framework developed by the National Institute for Standards and Technology (NIST) under the United States Department of Commerce.

This resource is designed to help employers develop their own cybersecurity workforces by defining a "common-language" database that describes cybersecurity work and the people who do it, regardless of what it is for.

The NICE framework applies across public, private, and academic sectors- and is broken into the following components:

Work Roles

These groupings of common cybersecurity functions are used to separate work and tasks into types or roles. Each role has an ID that shows it's category:

• PROTECTION and DEFENSE (PD) – Protects against, identifies, and analyzes risks to technology systems or networks. Includes investigation of cybersecurity events or crimes related to technology systems and networks.
• IMPLEMENTATION and OPERATION (IO) – Provides implementation, administration, configuration, operation, and maintenance to ensure effective and efficient technology system performance and security.
• DESIGN and DEVELOPMENT (DD) – Conducts research, conceptualizes, designs, develops, and tests secure technology systems, including on perimeter and cloud-based networks.
• OVERSIGHT and GOVERNANCE (OG) – Provides leadership, management, direction, and advocacy so the organization may effectively manage cybersecurity-related risks to the enterprise and conduct cybersecurity work.
• INVESTIGATION (IN) – Collects, processes, analyzes, and disseminates information from all sources of intelligence on foreign actors' cyberspace programs, intentions, capabilities, research and development, and operational activities

OPM Codes

These 3-digit numbers are from the Office of Personnel Management's (OPM) Federal Cybersecurity Coding Structure. These codes are used by federal agencies to classify cybersecurity positions, which is why each NICE work role maps to one or more codes. For example, Incident Response maps to OPM 531.

These codes allow federal employees, veterans, and agencies find content that fits a position's official code.

Competency Areas

These broad clusters consist of applicable Knowledge and Skill statements that cut across many work roles, including one's capability to perform Tasks within a particular domain. While work roles provide an answer to "What job is this for?", competency areas answer "What area of knowledge does this build?".

Each area has its own description:

• Access Controls - This Competency Area describes a learner's capabilities to define, manage, and monitor the roles and secure access privileges of who is authorized to access protected data and resources and understand the impact of different types of access controls.
• Artificial Intelligence (AI) Security - This Competency Area describes a learner's capability to understand Artificial Intelligence (AI) systems and to use them in a secure manner that maximizes AI's benefits while minimizing potential negative risks.
• Asset Management - This Competency Area describes a learner's capabilities to conduct and maintain an accurate inventory of all digital assets, to include identifying, developing, operating, maintaining, upgrading, and disposing of assets.
• Cloud Security - This Competency Area describes a learner's capabilities to protect cloud data, applications, and infrastructure from internal and external threats.
• Communications Security - This Competency Area describes a learner's capabilities to secure the transmissions, broadcasting, switching, control, and operation of communications and related network infrastructures.
• Cryptography - This Competency Area describes a learner's capabilities to transform data using cryptographic processes to ensure it can only be read by the person who is authorized to access it.
• Cyber Resiliency - This Competency Area describes a learner's capability related to architecting, designing, developing, implementing, and maintaining the trustworthiness of systems that use or are enabled by cyber resources in order to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises.
• DevSecOps - This Competency Area describes a learner's capabilities to integrate security as a shared responsibility throughout the development, security, and operations (DevSecOps) life cycle of technologies.
• Operating Systems (OS) Security - This Competency Area describes a learner's capabilities to install, administer, troubleshoot, backup, and conduct recovery of Operating Systems (OS), including in simulated environments.
• Operational Technology (OT) Security - This Competency Area describes a learner's capabilities to improve and maintain the security of Operational Technology (OT) systems while addressing their unique performance, reliability, and safety requirements.
• Supply Chain Security - This Competency Area describes a learner's capabilities to analyze and control digital and physical risks presented by technology products or services purchased from parties outside your organization.