Making SFIA easier to consumer

• We have published a dedicated landing page to highlight SFIA's support for cybersecurity skills and to aid navigation
• This includes extensive mappings to national and international cyber security frameworks
• See SFIA - a framework for cyber security skills

SFIA cyber security evolution

SFIA skills cover a wide range of professional cyber security activities

• SFIA skill descriptions span the professional landscape of cybersecurity, addressing needs for both specialist and non-specialist roles.
• They outline the fundamental security skills and responsibilities central to dedicated cybersecurity jobs, along with the cybersecurity elements required in other roles and jobs.
• This includes general skills adaptable to security contexts and the responsibilities and know-how for integrating security into diverse areas such as software development, infrastructure management, and managing the supply chain for technology.
• SFIA facilitates a comprehensive embedding of secure practices across an organisation, ensuring all roles are equipped with the appropriate level of cybersecurity understanding and capabilities.

SFIA 9 changes for cyber security

Identity and access management (IAMT)

Identity and access management has been part of the Security operations (SCAD) skill in previous versions of SFIA.

There are specialist roles and responsibilities associated with IAM which means it is better being separated from security operations.

• SFIA 9 Identity and access management - now a standalone skill
• SFIA 9 Security operations - revisions to separate out IAM responsibilities 

Cybercrime Investigation (CRIM)

This skill is focused on identifying, investigating, and building cases against cyber criminals to protect organisational assets and ensure digital security. It provides organisations with the capability to effectively respond to and prosecute cybercrime incidents while maintaining evidence integrity for legal proceedings.

Offensive Cyber Operations (OCOP)

This skill involves planning and executing proactive cybersecurity measures to identify vulnerabilities and strengthen defences through controlled offensive operations. It provides organisations with the capability to assess their security posture from an attacker's perspective and develop more robust defence strategies.

Cryptography

We were asked to include cryptography - based on NICE competency areas.

We considered whether this should this be a standalone skill or something which is part of other skills. 

As a standalone skill its quite hard to create something which sensibly covers tasks and responsibilities for the full spectrum of cryptography across the range of research, design/architecture and operations. We decided to update the guidance notes of the 4 existing skills as below

Update the references to cryptography in Security Operations SCAD:

• • • The current reference to cryptography in SCAD is limited to "administering cryptographic and certificate management activities."
    • This has been expanded to: implementing, managing, and monitoring cryptographic solutions to protect data, ensure compliance, and manage cryptographic keys securely.

Update three other SFIA skills to  reference tasks/activities related to cryptography:

• • • Information Assurance (INAS):  assessing the effectiveness of cryptographic controls, ensuring their proper integration into the assurance framework, providing guidance on the selection and implementation of appropriate cryptographic methods and technologies.
    • Penetration Testing (PENT): assessing the strength and effectiveness of cryptographic implementations, identifying and exploiting weaknesses, and providing recommendations for remediation
    • Vulnerability Research (VURE): conducting research to identify and evaluate new or emerging cryptographic vulnerabilities and identify and share potential mitigations

Additional level 2 SFIA cyber security skills to support entry-level roles

We have introduced additional Level 2 skill descriptions in response to feedback from the global SFIA community.

These new descriptions aim to define the skills and expectations for entry-level roles.

This includes a wide range of skills  including cyber security-related skills

Key Features of Level 2 Descriptions:

• Focus on assisting others with tasks
• Emphasis on following standard procedures
• Work performed under routine guidance and supervision

Context:

• Level 2 descriptions go beyond mere awareness or knowledge of the domain.
• Individuals at this level are actively learning while performing work tasks.
• Professionals are expected to engage in hands-on work but without the full responsibility associated with Level 3 skills.
• The value and impact of Level 3 skills are not reduced or underestimated.

See also SFIA level 1 to 3 expectations of employees and managers

New Additions:

Cybersecurity - combining skills frameworks and role frameworks

The illustration below shows how SFIA - a common language for skills - can be used to support a range of national and international cybersecurity role frameworks.

• identify skills and adding levels of roles within the role frameworks
• SFIA skills are available for all roles - not just cybersecurity specialists
• Each of the images can be clicked for a pdf version of the diagrams

NICE work roles	UKCSC specialisms	ENISA European CSF
SFIA - a framework for cyber security skills … building security skills into every professional job for a security-minded culture ...

NICE Components 1.0.0

• we have just published an updated SFIA NICE mapping to reflect the publication of NICE 1.0.0  and the new NICE work role names, descriptions and categories.

SFIA Partners in the field of cybersecurity

• ISC2, CIISec, CompTIA, ISACA, SANS | GIAC, UKCSC, and CREST.