ABCDEFGHIJKLMNOPQRSTUVWXYZ
1
NICE Framework Request for Comments:
Insider Threat Analysis Work Role (October 2023)
2
COMMENT PERIOD: October 30, 2023 - December 22, 2023
3
4
HOW TO REVIEW AND SUBMIT COMMENTS
5
1. Review the introduction and the proposed NICE Framework Work Role.
6
2. Send Comments to NICEFramework@nist.gov no later than December 22, 2023, at 11:59 p.m. ET.
7
Feedback received during this comment period will be used to inform any necessary updates to the proposed Work Role. Comments will be reviewed and adjudicated, and changes may be made based on feedback. Once the Work Role name, description, category, and Task statements presented here are confirmed, NICE will work with stakeholders and subject matter experts to identify existing and develop new statements to assign to the determined Competency Areas.
8
9
10
INTRODUCTION
11
NICE is soliciting feedback on a proposed new Work Role, “Insider Threat Analysis,” to be included in the Workforce Framework for Cybersecurity (NICE Framework) (NIST SP 800-181r1) [1]. The NICE Framework defines a common language for describing and sharing information about cybersecurity work. It is used in career discovery, education, and training; for hiring and workforce assessment; and in career planning and development. At its foundation are Task, Knowledge, and Skill (TKS) statements that describe the work to be done as well as what someone needs to know and be able to do in order to complete that work. These statements are the building blocks for Work Roles (groupings of tasks for which someone is responsible) and Competency Areas (clusters of related Knowledge and Skill statements that correlate with one’s capability to perform Tasks in a particular domain). The NICE Framework is built in such a way as to be agile, flexible, modular, and interoperable. That includes being responsive to changes in the cybersecurity workforce environment, whether it be adjusting existing content to address these changes or when new content is needed to reflect the needs of an effective, prepared cybersecurity workforce.

Insider Threat Analysis has evolved and shifted with the advent of digital technologies to become a multi-disciplinary role that includes cybersecurity as a key risk area that needs to be addressed. As insider threats and their tactics have evolved to encompass network and digital assets, analysts with cybersecurity skills are required to examine and respond to those threats. This area of work previously relied upon knowledge and skills that did not require significant cybersecurity skillsets. However, cybersecurity analysts with unique skills in detection, escalation, mitigation, and reporting are now needed to reduce organizations’ insider risks to. Codifying the Insider Threat Analysis Work Role in the NICE Framework supports learning and career pathways that help ensure that organizations are well equipped to address insider threats.

The Insider Threat Analysis Work Role and associated statements presented here were developed in coordination with subject matter experts from the Federal Government and in consultation with insider threat professionals from the private sector and academia. They comprise a combination of existing NICE Framework statements that are pertinent to this role as well as newly proposed statements that are needed to fully represent the responsibilities this Work Role represents. The statements were developed using the Task, Knowledge, and Skill (TKS) Statements Authoring Guide for Workforce Frameworks.

The NICE Framework is intended for use by public and private sectors, across industries, and in organizations large and small. Primary stakeholder audiences include employers; education, training, and certification providers; and learners, including both students and those looking for jobs or already in the workforce.

Thank you for your review and feedback of this new Work Role.
12
13
[1] https://csrc.nist.gov/pubs/sp/800/181/r1/final
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100