What Is the NICE Workforce Framework for Cybersecurity?

The NICE Workforce Framework for Cybersecurity is the national standard, published by the National Institute of Standards and Technology as Special Publication 800-181 Revision 1, that describes and organizes cybersecurity work using a shared vocabulary employers, educators, and job seekers can all rely on.¹ Federal agencies are legally required to use it when coding cybersecurity positions, and private employers rely on it to write job descriptions, plan training programs, and identify workforce gaps.

How the Framework Is Structured

The framework rests on four components. At the top sit Work Role Categories, broad groupings of related cybersecurity functions. Within each category, individual Work Roles describe specific clusters of responsibilities. Those roles are defined in detail by Task, Knowledge, and Skill (TKS) statements. Alongside all of this, Competency Areas describe cybersecurity capabilities that cut across multiple roles.²

Work Roles are the practical building blocks, but a Work Role is not the same as a job title. A single job posting might combine responsibilities from more than one Work Role, and a large organization might split a Work Role across several employees. The framework describes what needs to get done without dictating how any employer builds its org chart.

The Seven Work Role Categories

Every Work Role falls into one of seven categories that together cover the full range of cybersecurity activity.³

Securely Provision (SP) covers designing, building, and deploying secure IT systems, from software development through systems architecture.
Operate and Maintain (OM) covers the day-to-day work of administration, configuration, and patching that keeps systems running.
Oversee and Govern (OV) covers leadership, policy, and strategic planning, including risk management and regulatory alignment.
Protect and Defend (PR) covers real-time threat identification and response, including network monitoring, alert analysis, and incident containment.
Analyze (AN) covers review of intelligence data to identify patterns, emerging threats, and vulnerabilities.
Collect and Operate (CO) covers specialized technical operations for gathering intelligence, often overlapping with intelligence community functions.
Investigate (IN) covers digital forensics and post-breach analysis, including evidence handling that will hold up in court.

These seven categories have remained stable since the framework’s 2017 release, even as NIST has revised how individual Work Roles are organized within them.

Task, Knowledge, and Skill Statements

Each Work Role is defined by three types of statements that spell out exactly what the job involves and what a person needs to perform it.²

Task statements describe the actual work performed, such as configuring a firewall, reviewing access logs, or developing an incident response plan.
Knowledge statements capture the theoretical understanding required, such as how encryption protocols work or how federal privacy regulations apply.
Skill statements define demonstrated ability to apply tools and techniques, the kind of hands-on competence that comes from practice.

Together, these statements make the framework usable. An employer can pull the TKS statements for a Work Role and build a job posting around what the person will actually do. Interviewers can use the same statements as benchmarks. Educators can map curriculum directly to them, and students can compare their current abilities against them to find their gaps.

Competency Areas

Competency Areas group related Knowledge and Skill statements to describe capability in a particular domain of cybersecurity work.⁴ They are published separately from SP 800-181 Revision 1, which lets NIST update them independently as the field changes.

The difference from Work Roles is flexibility. A Work Role describes a specific cluster of tasks. A Competency Area describes a transferable capability that might apply across several roles, or even to staff outside cybersecurity who need certain security knowledge to do their jobs safely. A non-technical manager, for instance, might need competency in risk assessment without ever holding a cybersecurity Work Role.⁵ Competency Areas also give people transitioning from other fields a way to identify domains where their existing skills already fit.

How the Framework Gets Used

Employers use the framework to write job descriptions that reflect real work rather than a wish list of buzzwords, and to plan training around measurable Knowledge and Skill benchmarks. Universities and training providers map their curriculum to the Task statements for the Work Roles their graduates aim to fill. Job seekers use the same statements in reverse, checking their own experience against the roles they want.

One of the framework’s most practical outputs is a credentials-to-Work-Role mapping that connects industry certifications from bodies like CompTIA, (ISC)², ISACA, and SANS/GIAC to specific positions. The Incident Response Work Role, for example, maps to certifications including CompTIA CySA+, (ISC)² CISSP, and SANS GCIH. The Cybersecurity Architecture role maps to (ISC)² CISSP-ISSAP and CompTIA SecurityX.⁶ For someone deciding which certification to pursue, that mapping turns an open-ended question into a focused list tied to a target role.

NIST also points to several interactive tools built around the framework. CyberSeek shows a heat map of cybersecurity job openings and salary data across the country. The NICCS Cyber Career Pathways Tool lets you explore Work Roles inside the framework, and CyberCareers.gov focuses specifically on federal positions.⁷

Where the Framework Is Mandatory

For federal agencies, the framework is not optional. The Federal Cybersecurity Workforce Assessment Act of 2015 requires the Office of Personnel Management, working with NIST, to establish a coding structure for identifying all federal positions that involve cybersecurity work. Agencies then use that structure to assess their cybersecurity workforce annually and flag roles of critical need.⁸ The NICE Framework supplies the vocabulary that entire process runs on.

The Department of Defense goes further. DoD Directive 8140.01 established the DoD Cyberspace Workforce Framework, which aligns with NICE and applies to military personnel, DoD civilians, and contractors performing cyber-related work. Under the implementing manual (DoDM 8140.03), personnel assigned to a coded cybersecurity position must meet foundational qualification requirements within nine months and resident qualification requirements within twelve months. The full compliance deadline for the IT, cyber effects, intelligence, and cyber enabler workforce elements was February 15, 2026.⁹

Private employers face no comparable mandate. They adopt the framework because a shared vocabulary makes hiring and training easier, not because they are legally obligated to use it.

Keeping the Framework Current

NIST’s NICE program office manages the framework and coordinates updates with government, academic, and industry stakeholders.¹ Proposed changes go out for public comment, and Work Roles and Competency Areas are revised as new cybersecurity domains emerge. The current data version, 2.2.0, was released in April 2025. Keeping Competency Areas separate from the core publication lets NIST add new domains without waiting for a full revision of SP 800-181, so the framework can keep pace with how the field actually changes.

1
National Institute of Standards and Technology. NICE Framework Resource Center
2
National Initiative for Cybersecurity Careers and Studies. NICE Workforce Framework for Cybersecurity
3
National Institute of Standards and Technology. NICE Framework Work Role Categories and Work Roles – An Introduction and Summary of Proposed Updates
4
National Institute of Standards and Technology. NICE Framework Competency Areas – Preparing a Job-Ready Cybersecurity Workforce
5
National Institute of Standards and Technology. NICE Framework – Preparing a Job-Ready Cybersecurity Workforce
6
National Institute of Standards and Technology. C3 Credentials NICE Framework Work Role Mapping
7
National Institute of Standards and Technology. Cybersecurity Career Pathway Resources
8
U.S. Government Accountability Office. Cyber Workforce – Evidence-Based Decision Needed for the Future of OPM’s Dashboard
9
Cyber Exchange. DoD 8140 FAQ