Designs, develops, tests, and evaluates information systems throughout the systems development life cycle.
*Read our disclaimer
Disclaimer
Each certification is mapped to the NICE Framework, which organizes cybersecurity into seven high-level Categories, each comprised of several specialty areas, work roles, knowledge, skills, abilities, and tasks. These seven high-level Categories are aligned directly to the CCE® Program’s certification Concentration Areas. Candidates often prepare for an exam by using a variety of resources that familiarize them with the authoritative sources and the exam’s concentration area.
Third-party products and services, including course instructors have helped many candidates to close knowledge and skill gaps. The CCE® Program does not endorse any particular provider and encourages candidates to use a variety of tools and resources that will enhance their understanding of relevant principles and the exam’s concentration area.
NICE Framework Category
CCE® Concentration Area:
Securely Provision (SP)
NICE Specialty Area:
Systems Requirements Planning (SRP)
NICE Work Role ID:
SP-SRP-001
OPM Code | DCWF Code:
641
Cloud Security and FedRAMP (PR108)
Cloud Security and FedRAMP – SP (PR108-SP)
Cloud Security Fundamentals (PR109)
Healthcare Security & Privacy for IT Professionals (OV105)
HIPAA / HITECH Compliance (OV110)
HIPAA / HITECH Compliance – WBT (OV010-WBT)
Implementing and Securing Your Virtual Environment (OM112)
Implementing and Securing Your Virtual Environment – WBT (OM012-WBT)
Privacy for IT/ISS Professionals (OV231)
Privacy for IT/ISS Professionals – SP (OV231-SP)
System Administration and Development (OM267)
Systems Requirements Planner (SP303-RBT)
KSA-T
Below are the Knowledge, Skills, Abilities and Tasks (KSA-T) identified as being required to perform this work role.
ID & Description
- K0001 – Knowledge of computer networking concepts and protocols, and network security methodologies.
- K0002 – Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
- K0003 – Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
- K0004 – Knowledge of cybersecurity and privacy principles.
- K0005 – Knowledge of cyber threats and vulnerabilities.
- K0006 – Knowledge of specific operational impacts of cybersecurity lapses.
- K0008 – Knowledge of applicable business processes and operations of customer organizations.
- K0012 – Knowledge of capabilities and requirements analysis.
- K0018 – Knowledge of encryption algorithms.
- K0019 – Knowledge of cryptography and cryptographic key management concepts.
- K0032 – Knowledge of resiliency and redundancy.
- K0035 – Knowledge of installation, integration, and optimization of system components.
- K0038 – Knowledge of cybersecurity and privacy principles used to manage risks related to the use, processing, storage, and transmission of information or data.
- K0043 – Knowledge of industry-standard and organizationally accepted analysis principles and methods.
- K0044 – Knowledge of cybersecurity and privacy principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
- K0045 – Knowledge of information security systems engineering principles (NIST SP 800-160).
- K0047 – Knowledge of information technology (IT) architectural concepts and frameworks.
- K0055 – Knowledge of microprocessors.
- K0056 – Knowledge of network access, identity, and access management (e.g., public key infrastructure, Oauth, OpenID, SAML, SPML).
- K0059 – Knowledge of new and emerging information technology (IT) and cybersecurity technologies.
- K0060 – Knowledge of operating systems.
- K0061 – Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).
- K0063 – Knowledge of parallel and distributed computing concepts.
- K0066 – Knowledge of Privacy Impact Assessments.
- K0067 – Knowledge of process engineering concepts.
- K0073 – Knowledge of secure configuration management techniques. (e.g., Security Technical Implementation Guides (STIGs), cybersecurity best practices on cisecurity.org).
- K0074 – Knowledge of key concepts in security management (e.g., Release Management, Patch Management).
- K0086 – Knowledge of system design tools, methods, and techniques, including automated systems analysis and design tools.
- K0087 – Knowledge of system software and organizational design standards, policies, and authorized approaches (e.g., International Organization for Standardization [ISO] guidelines) relating to system design.
- K0090 – Knowledge of system life cycle management principles, including software security and usability.
- K0091 – Knowledge of systems testing and evaluation methods.
- K0093 – Knowledge of telecommunications concepts (e.g., Communications channel, Systems Link Budgeting, Spectral efficiency, Multiplexing).
- K0101 – Knowledge of the organization’s enterprise information technology (IT) goals and objectives.
- K0102 – Knowledge of the systems engineering process.
- K0126 – Knowledge of Supply Chain Risk Management Practices (NIST SP 800-161).
- K0163 – Knowledge of critical information technology (IT) procurement requirements.
- K0164 – Knowledge of functionality, quality, and security requirements and how these will apply to specific items of supply (i.e., elements and processes).
- K0168 – Knowledge of applicable laws, statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures.
- K0169 – Knowledge of information technology (IT) supply chain security and supply chain risk management policies, requirements, and procedures.
- K0170 – Knowledge of critical infrastructure systems with information communication technology that were designed without system security considerations.
- K0180 – Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.
- K0200 – Knowledge of service management concepts for networks and related standards (e.g., Information Technology Infrastructure Library, current version [ITIL]).
- K0267 – Knowledge of laws, policies, procedures, or governance relevant to cybersecurity for critical infrastructures.
- K0287 – Knowledge of an organization’s information classification program and procedures for information compromise.
- K0325 – Knowledge of Information Theory (e.g., source coding, channel coding, algorithm complexity theory, and data compression).
- K0332 – Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.
- K0333 – Knowledge of network design processes, to include understanding of security objectives, operational objectives, and trade-offs.
- K0622 – Knowledge of controls related to the use, processing, storage, and transmission of data.
ID & Description
- S0005 – Skill in applying and incorporating information technologies into proposed solutions.
- S0006 – Skill in applying confidentiality, integrity, and availability principles.
- S0008 – Skill in applying organization-specific systems analysis principles and techniques.
- S0010 – Skill in conducting capabilities and requirements analysis.
- S0050 – Skill in design modeling and building use cases (e.g., unified modeling language).
- S0134 – Skill in conducting reviews of systems.
- S0367 – Skill to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
ID & Description
- A0064 – Ability to interpret and translate customer requirements into operational capabilities.
- A0123 – Ability to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
- A0170 – Ability to identify critical infrastructure systems with information communication technology that were designed without system security considerations.
ID & Description
- T0033 – Conduct risk analysis, feasibility study, and/or trade-off analysis to develop, document, and refine functional requirements and specifications.
- T0039 – Consult with customers to evaluate functional requirements.
- T0045 – Coordinate with systems architects and developers, as needed, to provide oversight in the development of design solutions.
- T0052 – Define project scope and objectives based on customer requirements.
- T0062 – Develop and document requirements, capabilities, and constraints for design procedures and processes.
- T0127 – Integrate and align information security and/or cybersecurity policies to ensure that system analysis meets security requirements.
- T0156 – Oversee and make recommendations regarding configuration management.
- T0174 – Perform needs analysis to determine opportunities for new and improved business process solutions.
- T0191 – Prepare use cases to justify the need for specific information technology (IT) solutions.
- T0235 – Translate functional requirements into technical solutions.
- T0273 – Develop and document supply chain risks for critical system elements, as appropriate.
- T0300 – Develop and document User Experience (UX) requirements including information architecture and user interface requirements.
- T0313 – Design and document quality standards.
- T0325 – Document a system’s purpose and preliminary system security concept of operations.
- T0334 – Ensure that all systems components can be integrated and aligned (e.g., procedures, databases, policies, software, and hardware).
- T0454 – Define baseline security requirements in accordance with applicable guidelines.
- T0463 – Develop cost estimates for new or modified system(s).
- T0497 – Manage the information technology (IT) planning process to ensure that developed solutions meet customer requirements.
- Knowledge
-
ID & Description
- K0001 – Knowledge of computer networking concepts and protocols, and network security methodologies.
- K0002 – Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
- K0003 – Knowledge of laws, regulations, policies, and ethics as they relate to cybersecurity and privacy.
- K0004 – Knowledge of cybersecurity and privacy principles.
- K0005 – Knowledge of cyber threats and vulnerabilities.
- K0006 – Knowledge of specific operational impacts of cybersecurity lapses.
- K0008 – Knowledge of applicable business processes and operations of customer organizations.
- K0012 – Knowledge of capabilities and requirements analysis.
- K0018 – Knowledge of encryption algorithms.
- K0019 – Knowledge of cryptography and cryptographic key management concepts.
- K0032 – Knowledge of resiliency and redundancy.
- K0035 – Knowledge of installation, integration, and optimization of system components.
- K0038 – Knowledge of cybersecurity and privacy principles used to manage risks related to the use, processing, storage, and transmission of information or data.
- K0043 – Knowledge of industry-standard and organizationally accepted analysis principles and methods.
- K0044 – Knowledge of cybersecurity and privacy principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
- K0045 – Knowledge of information security systems engineering principles (NIST SP 800-160).
- K0047 – Knowledge of information technology (IT) architectural concepts and frameworks.
- K0055 – Knowledge of microprocessors.
- K0056 – Knowledge of network access, identity, and access management (e.g., public key infrastructure, Oauth, OpenID, SAML, SPML).
- K0059 – Knowledge of new and emerging information technology (IT) and cybersecurity technologies.
- K0060 – Knowledge of operating systems.
- K0061 – Knowledge of how traffic flows across the network (e.g., Transmission Control Protocol [TCP] and Internet Protocol [IP], Open System Interconnection Model [OSI], Information Technology Infrastructure Library, current version [ITIL]).
- K0063 – Knowledge of parallel and distributed computing concepts.
- K0066 – Knowledge of Privacy Impact Assessments.
- K0067 – Knowledge of process engineering concepts.
- K0073 – Knowledge of secure configuration management techniques. (e.g., Security Technical Implementation Guides (STIGs), cybersecurity best practices on cisecurity.org).
- K0074 – Knowledge of key concepts in security management (e.g., Release Management, Patch Management).
- K0086 – Knowledge of system design tools, methods, and techniques, including automated systems analysis and design tools.
- K0087 – Knowledge of system software and organizational design standards, policies, and authorized approaches (e.g., International Organization for Standardization [ISO] guidelines) relating to system design.
- K0090 – Knowledge of system life cycle management principles, including software security and usability.
- K0091 – Knowledge of systems testing and evaluation methods.
- K0093 – Knowledge of telecommunications concepts (e.g., Communications channel, Systems Link Budgeting, Spectral efficiency, Multiplexing).
- K0101 – Knowledge of the organization’s enterprise information technology (IT) goals and objectives.
- K0102 – Knowledge of the systems engineering process.
- K0126 – Knowledge of Supply Chain Risk Management Practices (NIST SP 800-161).
- K0163 – Knowledge of critical information technology (IT) procurement requirements.
- K0164 – Knowledge of functionality, quality, and security requirements and how these will apply to specific items of supply (i.e., elements and processes).
- K0168 – Knowledge of applicable laws, statutes (e.g., in Titles 10, 18, 32, 50 in U.S. Code), Presidential Directives, executive branch guidelines, and/or administrative/criminal legal guidelines and procedures.
- K0169 – Knowledge of information technology (IT) supply chain security and supply chain risk management policies, requirements, and procedures.
- K0170 – Knowledge of critical infrastructure systems with information communication technology that were designed without system security considerations.
- K0180 – Knowledge of network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools.
- K0200 – Knowledge of service management concepts for networks and related standards (e.g., Information Technology Infrastructure Library, current version [ITIL]).
- K0267 – Knowledge of laws, policies, procedures, or governance relevant to cybersecurity for critical infrastructures.
- K0287 – Knowledge of an organization’s information classification program and procedures for information compromise.
- K0325 – Knowledge of Information Theory (e.g., source coding, channel coding, algorithm complexity theory, and data compression).
- K0332 – Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.
- K0333 – Knowledge of network design processes, to include understanding of security objectives, operational objectives, and trade-offs.
- K0622 – Knowledge of controls related to the use, processing, storage, and transmission of data.
- Skills
-
ID & Description
- S0005 – Skill in applying and incorporating information technologies into proposed solutions.
- S0006 – Skill in applying confidentiality, integrity, and availability principles.
- S0008 – Skill in applying organization-specific systems analysis principles and techniques.
- S0010 – Skill in conducting capabilities and requirements analysis.
- S0050 – Skill in design modeling and building use cases (e.g., unified modeling language).
- S0134 – Skill in conducting reviews of systems.
- S0367 – Skill to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
- Abilities
-
ID & Description
- A0064 – Ability to interpret and translate customer requirements into operational capabilities.
- A0123 – Ability to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation).
- A0170 – Ability to identify critical infrastructure systems with information communication technology that were designed without system security considerations.
- Tasks
-
ID & Description
- T0033 – Conduct risk analysis, feasibility study, and/or trade-off analysis to develop, document, and refine functional requirements and specifications.
- T0039 – Consult with customers to evaluate functional requirements.
- T0045 – Coordinate with systems architects and developers, as needed, to provide oversight in the development of design solutions.
- T0052 – Define project scope and objectives based on customer requirements.
- T0062 – Develop and document requirements, capabilities, and constraints for design procedures and processes.
- T0127 – Integrate and align information security and/or cybersecurity policies to ensure that system analysis meets security requirements.
- T0156 – Oversee and make recommendations regarding configuration management.
- T0174 – Perform needs analysis to determine opportunities for new and improved business process solutions.
- T0191 – Prepare use cases to justify the need for specific information technology (IT) solutions.
- T0235 – Translate functional requirements into technical solutions.
- T0273 – Develop and document supply chain risks for critical system elements, as appropriate.
- T0300 – Develop and document User Experience (UX) requirements including information architecture and user interface requirements.
- T0313 – Design and document quality standards.
- T0325 – Document a system’s purpose and preliminary system security concept of operations.
- T0334 – Ensure that all systems components can be integrated and aligned (e.g., procedures, databases, policies, software, and hardware).
- T0454 – Define baseline security requirements in accordance with applicable guidelines.
- T0463 – Develop cost estimates for new or modified system(s).
- T0497 – Manage the information technology (IT) planning process to ensure that developed solutions meet customer requirements.