Develops and conducts training or education of personnel within cyber domain.
*Certification Declaration
Certification Declaration
Each certification is mapped to the NICE Framework, which organizes cybersecurity into seven high-level Categories, each comprised of several specialty areas, work roles, knowledge, skills, abilities, and tasks. These seven high-level Categories are aligned directly to the CCE® Program’s certification Concentration Areas. Candidates often prepare for an exam by using a variety of resources that familiarize them with the authoritative sources and the exam’s concentration area.
Third-party products and services, including course instructors have helped many candidates to close knowledge and skill gaps. The CCE® Program does not endorse any particular provider and encourages candidates to use a variety of tools and resources that will enhance their understanding of relevant principles and the exam’s concentration area.
NICE Framework Category
CCE® Concentration Area:
Oversee and Govern (OV)
NICE Specialty Area:
Training, Education, and Awareness (TEA)
NICE Work Role ID:
OV-TEA-002
OPM Code | DCWF Code:
712
KSA-T
Below are the Knowledge, Skills, Abilities and Tasks (KSA-T) identified as being required to perform this work role.
ID & Description
- K0001 - Knowledge of computer networking concepts and protocols, and network security methodologies.
- K0002 - Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
- K0003 - Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
- K0004 - Knowledge of cybersecurity and privacy principles.
- K0005 - Knowledge of cyber threats and vulnerabilities.
- K0006 - Knowledge of specific operational impacts of cybersecurity lapses.
- K0007 - Knowledge of authentication, authorization, and access control methods.
- K0059 - Knowledge of new and emerging information technology (IT) and cybersecurity technologies.
- K0115 - Knowledge that technology that can be exploited.
- K0124 - Knowledge of multiple cognitive domains and tools and methods applicable for learning in each domain.
- K0130 - Knowledge of virtualization technologies and virtual machine development and maintenance.
- K0146 - Knowledge of the organization’s core business/mission processes.
- K0147 - Knowledge of emerging security issues, risks, and vulnerabilities.
- K0204 - Knowledge of learning assessment techniques (rubrics, evaluation plans, tests, quizzes).
- K0208 - Knowledge of computer based training and e-learning services.
- K0213 - Knowledge of instructional design and evaluation models (e.g., ADDIE, Smith/Ragan model, Gagne’s Events of Instruction, Kirkpatrick’s model of evaluation).
- K0215 - Knowledge of organizational training policies.
- K0216 - Knowledge of learning levels (i.e., Bloom’s Taxonomy of learning).
- K0217 - Knowledge of Learning Management Systems and their use in managing learning.
- K0218 - Knowledge of learning styles (e.g., assimilator, auditory, kinesthetic).
- K0220 - Knowledge of modes of learning (e.g., rote learning, observation).
- K0226 - Knowledge of organizational training systems.
- K0239 - Knowledge of media production, communication, and dissemination techniques and methods, including alternative ways to inform via written, oral, and visual media.
- K0245 - Knowledge of principles and processes for conducting training and education needs assessment.
- K0246 - Knowledge of relevant concepts, procedures, software, equipment, and technology applications.
- K0250 - Knowledge of Test & Evaluation processes for learners.
- K0252 - Knowledge of training and education principles and methods for curriculum design, teaching and instruction for individuals and groups, and the measurement of training and education effects.
- K0287 - Knowledge of an organization’s information classification program and procedures for information compromise.
- K0313 - Knowledge of external organizations and academic institutions with cyber focus (e.g., cyber curriculum/training and Research & Development).
- K0319 - Knowledge of technical delivery capabilities and their limitations.
- K0628 - Knowledge of cyber competitions as a way of developing skills by providing hands-on experience in simulated, real-world situations.
ID & Description
- S0001 - Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.
- S0004 - Skill in analyzing network traffic capacity and performance characteristics.
- S0006 - Skill in applying confidentiality, integrity, and availability principles.
- S0051 - Skill in the use of penetration testing tools and techniques.
- S0052 - Skill in the use of social engineering techniques. (e.g., phishing, baiting, tailgating, etc.).
- S0053 - Skill in tuning sensors.
- S0055 - Skill in using knowledge management technologies.
- S0056 - Skill in using network management tools to analyze network traffic patterns (e.g., simple network management protocol).
- S0057 - Skill in using protocol analyzers.
- S0060 - Skill in writing code in a currently supported programming language (e.g., Java, C++).
- S0064 - Skill in developing and executing technical training programs and curricula.
- S0070 - Skill in talking to others to convey information effectively.
- S0073 - Skill in using virtual machines. (e.g., Microsoft Hyper-V, VMWare vSphere, Citrix XenDesktop/Server, Amazon Elastic Compute Cloud, etc.).
- S0075 - Skill in conducting forensic analyses in multiple operating system environments (e.g., mobile device systems).
- S0076 - Skill in configuring and utilizing software-based computer protection tools (e.g., software firewalls, antivirus software, anti-spyware).
- S0081 - Skill in using network analysis tools to identify vulnerabilities. (e.g., fuzzing, nmap, etc.).
- S0084 - Skill in configuring and utilizing network protection components (e.g., Firewalls, VPNs, network intrusion detection systems).
- S0097 - Skill in applying security controls.
- S0098 - WITHDRAWN: Skill in detecting host and network based intrusions via intrusion detection technologies. (See S0025)
- S0100 - Skill in utilizing or developing learning activities (e.g., scenarios, instructional games, interactive exercises).
- S0101 - Skill in utilizing technologies (e.g., SmartBoards, websites, computers, projectors) for instructional purposes.
- S0121 - Skill in system, network, and OS hardening techniques. (e.g., remove unnecessary services, password policies, network segmentation, enable logging, least privilege, etc.).
- S0131 - Skill in analyzing malware.
- S0156 - Skill in performing packet-level analysis.
- S0184 - Skill in analyzing traffic to identify network devices.
- S0270 - Skill in reverse engineering (e.g., hex editing, binary packaging utilities, debugging, and strings analysis) to identify function and ownership of remote tools.
- S0271 - Skill in reviewing and editing assessment products.
- S0281 - Skill in technical writing.
- S0293 - Skill in using tools, techniques, and procedures to remotely exploit and establish persistence on a target.
- S0301 - Skill in writing about facts and ideas in a clear, convincing, and organized manner.
- S0356 - Skill in communicating with all levels of management including Board members (e.g., interpersonal skills, approachability, effective listening skills, appropriate use of style and language for the audience).
- S0358 - Skill to remain aware of evolving technical infrastructures.
ID & Description
- A0006 -Ability to prepare and deliver education and awareness briefings to ensure that systems, network, and data users are aware of and adhere to systems security policies and procedures.
- A0011 - Ability to answer questions in a clear and concise manner.
- A0012 - Ability to ask clarifying questions.
- A0013 - Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.
- A0014 - Ability to communicate effectively when writing.
- A0015 - Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.
- A0016 - Ability to facilitate small group discussions.
- A0017 - Ability to gauge learner understanding and knowledge level.
- A0018 - Ability to prepare and present briefings.
- A0019 - Ability to produce technical documentation.
- A0020 - Ability to provide effective feedback to students for improving learning.
- A0022 - Ability to apply principles of adult learning.
- A0023 - Ability to design valid and reliable assessments.
- A0024 - Ability to develop clear directions and instructional materials.
- A0032 - Ability to develop curriculum for use within a virtual environment.
- A0055 - Ability to operate common network tools (e.g., ping, traceroute, nslookup).
- A0057 - Ability to tailor curriculum that speaks to the topic at the appropriate level for the target audience.
- A0058 - Ability to execute OS command line (e.g., ipconfig, netstat, dir, nbtstat).
- A0063 - Ability to operate different electronic communication systems and methods (e.g., e-mail, VOIP, IM, web forums, Direct Video Broadcasts).
- A0066 - Ability to accurately and completely source all data used in intelligence, assessment and/or planning products.
- A0070 - Ability to apply critical reading/thinking skills.
- A0083 - Ability to evaluate information for reliability, validity, and relevance.
- A0089 - Ability to function in a collaborative environment, seeking continuous consultation with other analysts and experts—both internal and external to the organization—to leverage analytical and technical expertise.
- A0105 - Ability to tailor technical and planning information to a customer’s level of understanding.
- A0106 - Ability to think critically.
- A0112 - Ability to monitor advancements in information privacy technologies to ensure organizational adaptation and compliance.
- A0114 - Ability to develop or procure curriculum that speaks to the topic at the appropriate level for the target.
- A0118 - Ability to understand technology, management, and leadership issues related to organization processes and problem solving.
- A0119 - Ability to understand the basic concepts and issues related to cyber and its organizational impact.
- A0171-Ability to conduct training and education needs assessment.
ID & Description
- T0030 - Conduct interactive training exercises to create an effective learning environment.
- T0073 - Develop new or identify existing awareness and training materials that are appropriate for intended audiences.
- T0101 - Evaluate the effectiveness and comprehensiveness of existing training programs.
- T0224 - Review training documentation (e.g., Course Content Documents [CCD], lesson plans, student texts, examinations, Schedules of Instruction [SOI], and course descriptions).
- T0230 - Support the design and execution of exercise scenarios..
- T0247 - Write instructional materials (e.g., standard operating procedures, production manual) to provide detailed guidance to relevant portion of the workforce.
- T0316 -Develop or assist in the development of computer based training modules or classes.
- T0317 - Develop or assist in the development of course assignments.
- T0318 - Develop or assist in the development of course evaluations.
- T0319 - Develop or assist in the development of grading and proficiency standards.
- T0320 - Assist in the development of individual/collective development, training, and/or remediation plans.
- T0321 - Develop or assist in the development of learning objectives and goals.
- T0322 - Develop or assist in the development of on-the-job training materials or programs.
- T0323 - Develop or assist in the development of written tests for measuring and assessing learner proficiency.
- T0352 - Conduct learning needs assessments and identify requirements.
- T0365 - Develop or assist in the development of training policies and protocols for cyber training.
- T0367 - Develop the goals and objectives for cyber curriculum.
- T0381 - Present technical information to technical and nontechnical audiences.
- T0382 - Present data in creative formats.
- T0395 - Write and publish after action reviews.
- T0443 - Deliver training courses tailored to the audience and physical/virtual environments.
- T0444 - Apply concepts, procedures, software, equipment, and/or technology applications to students.
- T0450 - Design training curriculum and course content based on requirements.
- T0451 - Participate in development of training curriculum and course content.
- T0467 - Ensure that training meets the goals and objectives for cybersecurity training, education, or awareness.
- T0519 - Plan and coordinate the delivery of classroom techniques and formats (e.g., lectures, demonstrations, interactive exercises, multimedia presentations) for the most effective learning environment.
- T0520 - Plan non-classroom educational techniques and formats (e.g., video courses, mentoring, web-based courses).
- T0535 - Recommend revisions to curriculum and course content based on feedback from previous training sessions.
- T0536 - Serve as an internal consultant and advisor in own area of expertise (e.g., technical, copyright, print media, electronic media).
- T0926 -Develop or assist with the development of privacy training materials and other communications to increase employee understanding of company privacy policies, data handling practices and procedures and legal obligations.
- Knowledge
-
ID & Description
- K0001 - Knowledge of computer networking concepts and protocols, and network security methodologies.
- K0002 - Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
- K0003 - Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
- K0004 - Knowledge of cybersecurity and privacy principles.
- K0005 - Knowledge of cyber threats and vulnerabilities.
- K0006 - Knowledge of specific operational impacts of cybersecurity lapses.
- K0007 - Knowledge of authentication, authorization, and access control methods.
- K0059 - Knowledge of new and emerging information technology (IT) and cybersecurity technologies.
- K0115 - Knowledge that technology that can be exploited.
- K0124 - Knowledge of multiple cognitive domains and tools and methods applicable for learning in each domain.
- K0130 - Knowledge of virtualization technologies and virtual machine development and maintenance.
- K0146 - Knowledge of the organization’s core business/mission processes.
- K0147 - Knowledge of emerging security issues, risks, and vulnerabilities.
- K0204 - Knowledge of learning assessment techniques (rubrics, evaluation plans, tests, quizzes).
- K0208 - Knowledge of computer based training and e-learning services.
- K0213 - Knowledge of instructional design and evaluation models (e.g., ADDIE, Smith/Ragan model, Gagne’s Events of Instruction, Kirkpatrick’s model of evaluation).
- K0215 - Knowledge of organizational training policies.
- K0216 - Knowledge of learning levels (i.e., Bloom’s Taxonomy of learning).
- K0217 - Knowledge of Learning Management Systems and their use in managing learning.
- K0218 - Knowledge of learning styles (e.g., assimilator, auditory, kinesthetic).
- K0220 - Knowledge of modes of learning (e.g., rote learning, observation).
- K0226 - Knowledge of organizational training systems.
- K0239 - Knowledge of media production, communication, and dissemination techniques and methods, including alternative ways to inform via written, oral, and visual media.
- K0245 - Knowledge of principles and processes for conducting training and education needs assessment.
- K0246 - Knowledge of relevant concepts, procedures, software, equipment, and technology applications.
- K0250 - Knowledge of Test & Evaluation processes for learners.
- K0252 - Knowledge of training and education principles and methods for curriculum design, teaching and instruction for individuals and groups, and the measurement of training and education effects.
- K0287 - Knowledge of an organization’s information classification program and procedures for information compromise.
- K0313 - Knowledge of external organizations and academic institutions with cyber focus (e.g., cyber curriculum/training and Research & Development).
- K0319 - Knowledge of technical delivery capabilities and their limitations.
- K0628 - Knowledge of cyber competitions as a way of developing skills by providing hands-on experience in simulated, real-world situations.
- Skills
-
ID & Description
- S0001 - Skill in conducting vulnerability scans and recognizing vulnerabilities in security systems.
- S0004 - Skill in analyzing network traffic capacity and performance characteristics.
- S0006 - Skill in applying confidentiality, integrity, and availability principles.
- S0051 - Skill in the use of penetration testing tools and techniques.
- S0052 - Skill in the use of social engineering techniques. (e.g., phishing, baiting, tailgating, etc.).
- S0053 - Skill in tuning sensors.
- S0055 - Skill in using knowledge management technologies.
- S0056 - Skill in using network management tools to analyze network traffic patterns (e.g., simple network management protocol).
- S0057 - Skill in using protocol analyzers.
- S0060 - Skill in writing code in a currently supported programming language (e.g., Java, C++).
- S0064 - Skill in developing and executing technical training programs and curricula.
- S0070 - Skill in talking to others to convey information effectively.
- S0073 - Skill in using virtual machines. (e.g., Microsoft Hyper-V, VMWare vSphere, Citrix XenDesktop/Server, Amazon Elastic Compute Cloud, etc.).
- S0075 - Skill in conducting forensic analyses in multiple operating system environments (e.g., mobile device systems).
- S0076 - Skill in configuring and utilizing software-based computer protection tools (e.g., software firewalls, antivirus software, anti-spyware).
- S0081 - Skill in using network analysis tools to identify vulnerabilities. (e.g., fuzzing, nmap, etc.).
- S0084 - Skill in configuring and utilizing network protection components (e.g., Firewalls, VPNs, network intrusion detection systems).
- S0097 - Skill in applying security controls.
- S0098 - WITHDRAWN: Skill in detecting host and network based intrusions via intrusion detection technologies. (See S0025)
- S0100 - Skill in utilizing or developing learning activities (e.g., scenarios, instructional games, interactive exercises).
- S0101 - Skill in utilizing technologies (e.g., SmartBoards, websites, computers, projectors) for instructional purposes.
- S0121 - Skill in system, network, and OS hardening techniques. (e.g., remove unnecessary services, password policies, network segmentation, enable logging, least privilege, etc.).
- S0131 - Skill in analyzing malware.
- S0156 - Skill in performing packet-level analysis.
- S0184 - Skill in analyzing traffic to identify network devices.
- S0270 - Skill in reverse engineering (e.g., hex editing, binary packaging utilities, debugging, and strings analysis) to identify function and ownership of remote tools.
- S0271 - Skill in reviewing and editing assessment products.
- S0281 - Skill in technical writing.
- S0293 - Skill in using tools, techniques, and procedures to remotely exploit and establish persistence on a target.
- S0301 - Skill in writing about facts and ideas in a clear, convincing, and organized manner.
- S0356 - Skill in communicating with all levels of management including Board members (e.g., interpersonal skills, approachability, effective listening skills, appropriate use of style and language for the audience).
- S0358 - Skill to remain aware of evolving technical infrastructures.
- Abilities
-
ID & Description
- A0006 -Ability to prepare and deliver education and awareness briefings to ensure that systems, network, and data users are aware of and adhere to systems security policies and procedures.
- A0011 - Ability to answer questions in a clear and concise manner.
- A0012 - Ability to ask clarifying questions.
- A0013 - Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means.
- A0014 - Ability to communicate effectively when writing.
- A0015 - Ability to conduct vulnerability scans and recognize vulnerabilities in security systems.
- A0016 - Ability to facilitate small group discussions.
- A0017 - Ability to gauge learner understanding and knowledge level.
- A0018 - Ability to prepare and present briefings.
- A0019 - Ability to produce technical documentation.
- A0020 - Ability to provide effective feedback to students for improving learning.
- A0022 - Ability to apply principles of adult learning.
- A0023 - Ability to design valid and reliable assessments.
- A0024 - Ability to develop clear directions and instructional materials.
- A0032 - Ability to develop curriculum for use within a virtual environment.
- A0055 - Ability to operate common network tools (e.g., ping, traceroute, nslookup).
- A0057 - Ability to tailor curriculum that speaks to the topic at the appropriate level for the target audience.
- A0058 - Ability to execute OS command line (e.g., ipconfig, netstat, dir, nbtstat).
- A0063 - Ability to operate different electronic communication systems and methods (e.g., e-mail, VOIP, IM, web forums, Direct Video Broadcasts).
- A0066 - Ability to accurately and completely source all data used in intelligence, assessment and/or planning products.
- A0070 - Ability to apply critical reading/thinking skills.
- A0083 - Ability to evaluate information for reliability, validity, and relevance.
- A0089 - Ability to function in a collaborative environment, seeking continuous consultation with other analysts and experts—both internal and external to the organization—to leverage analytical and technical expertise.
- A0105 - Ability to tailor technical and planning information to a customer’s level of understanding.
- A0106 - Ability to think critically.
- A0112 - Ability to monitor advancements in information privacy technologies to ensure organizational adaptation and compliance.
- A0114 - Ability to develop or procure curriculum that speaks to the topic at the appropriate level for the target.
- A0118 - Ability to understand technology, management, and leadership issues related to organization processes and problem solving.
- A0119 - Ability to understand the basic concepts and issues related to cyber and its organizational impact.
- A0171-Ability to conduct training and education needs assessment.
- Tasks
-
ID & Description
- T0030 - Conduct interactive training exercises to create an effective learning environment.
- T0073 - Develop new or identify existing awareness and training materials that are appropriate for intended audiences.
- T0101 - Evaluate the effectiveness and comprehensiveness of existing training programs.
- T0224 - Review training documentation (e.g., Course Content Documents [CCD], lesson plans, student texts, examinations, Schedules of Instruction [SOI], and course descriptions).
- T0230 - Support the design and execution of exercise scenarios..
- T0247 - Write instructional materials (e.g., standard operating procedures, production manual) to provide detailed guidance to relevant portion of the workforce.
- T0316 -Develop or assist in the development of computer based training modules or classes.
- T0317 - Develop or assist in the development of course assignments.
- T0318 - Develop or assist in the development of course evaluations.
- T0319 - Develop or assist in the development of grading and proficiency standards.
- T0320 - Assist in the development of individual/collective development, training, and/or remediation plans.
- T0321 - Develop or assist in the development of learning objectives and goals.
- T0322 - Develop or assist in the development of on-the-job training materials or programs.
- T0323 - Develop or assist in the development of written tests for measuring and assessing learner proficiency.
- T0352 - Conduct learning needs assessments and identify requirements.
- T0365 - Develop or assist in the development of training policies and protocols for cyber training.
- T0367 - Develop the goals and objectives for cyber curriculum.
- T0381 - Present technical information to technical and nontechnical audiences.
- T0382 - Present data in creative formats.
- T0395 - Write and publish after action reviews.
- T0443 - Deliver training courses tailored to the audience and physical/virtual environments.
- T0444 - Apply concepts, procedures, software, equipment, and/or technology applications to students.
- T0450 - Design training curriculum and course content based on requirements.
- T0451 - Participate in development of training curriculum and course content.
- T0467 - Ensure that training meets the goals and objectives for cybersecurity training, education, or awareness.
- T0519 - Plan and coordinate the delivery of classroom techniques and formats (e.g., lectures, demonstrations, interactive exercises, multimedia presentations) for the most effective learning environment.
- T0520 - Plan non-classroom educational techniques and formats (e.g., video courses, mentoring, web-based courses).
- T0535 - Recommend revisions to curriculum and course content based on feedback from previous training sessions.
- T0536 - Serve as an internal consultant and advisor in own area of expertise (e.g., technical, copyright, print media, electronic media).
- T0926 -Develop or assist with the development of privacy training materials and other communications to increase employee understanding of company privacy policies, data handling practices and procedures and legal obligations.