Attention: CISA Learning is now available for External Users! The Federal Virtual Training Environment (FedVTE) has been permanently decommissioned and replaced by CISA Learning. Please reference the CISA Learning page for the latest information. Please note: CISA Users should wait to access CISA Learning until the system is ready for internal use in the coming days.

IO-WRL-006

Systems Security Analysis

Responsible for developing and analyzing the integration, testing, operations, and maintenance of systems security. Prepares, performs, and manages the security aspects of implementing and operating a system.

Task statements

T0309: Assess the effectiveness of security controls
T1020: Determine the operational and safety impacts of cybersecurity lapses
T1023: Identify critical technology procurement requirements
T1075: Implement application cybersecurity policies
T1076: Implement system cybersecurity policies
T1077: Assess the organization's cybersecurity architecture
T1172: Determine if systems security operations and maintenance activities are property documented and updated
T1173: Determine that the application of security patches for commercial products meets timeline requirements
T1174: Document commercial product timeline requirements dictated by the management authority for intended operational environments
T1176: Determine if cybersecurity-enabled products reduce identified risk to acceptable levels
T1177: Determine if security control technologies reduce identified risk to acceptable levels
T1212: Implement cybersecurity countermeasures for systems and applications
T1218: Integrate automated capabilities for updating or patching system software
T1219: Develop processes and procedures for manual updating and patching of system software
T1255: Perform cybersecurity testing of developed applications and systems
T1263: Perform security reviews
T1264: Identify gaps in security architecture
T1265: Develop a cybersecurity risk management plan
T1278: Recommend system modifications
T1287: Document systems security activities
T1294: Advise on Risk Management Framework process activities and documentation
T1327: Update security documentation to reflect current application and system security design features
T1437: Determine effectiveness of configuration management processes
T1522: Determine if systems meet minimum security requirements
T1532: Develop procedures for system operations transfer to alternate sites
T1533: Test failover for system operations transfer to alternative sites
T1539: Analyze organizational cybersecurity posture trends
T1540: Develop organizational cybersecurity posture trend reports
T1541: Develop system security posture trend reports
T1548: Determine adequacy of access controls
T1550: Execute disaster recovery and continuity of operations processes
T1557: Implement security measures for systems and system components
T1559: Resolve vulnerabilities in systems and system components
T1560: Mitigate risks in systems and system components
T1563: Implement system security measures
T1568: Implement cross-domain solutions
T1574: Develop risk acceptance documentation for senior leaders and authorized representatives
T1583: Determine effectiveness of system implementation and testing processes
T1584: Establish minimum security requirements for applications
T1585: Determine if applications meet minimum security requirements
T1603: Recommend threat and vulnerability risk mitigation strategies
T1615: Advise stakeholders on vulnerability compliance
T1616: Resolve computer security incidents
T1618: Advise stakeholders on disaster recovery, contingency, and continuity of operations plans

Knowledge statements

K0018: Knowledge of encryption algorithms
K0674: Knowledge of computer networking protocols
K0675: Knowledge of risk management processes
K0676: Knowledge of cybersecurity laws and regulations
K0677: Knowledge of cybersecurity policies and procedures
K0678: Knowledge of privacy laws and regulations
K0679: Knowledge of privacy policies and procedures
K0680: Knowledge of cybersecurity principles and practices
K0681: Knowledge of privacy principles and practices
K0682: Knowledge of cybersecurity threats
K0683: Knowledge of cybersecurity vulnerabilities
K0684: Knowledge of cybersecurity threat characteristics
K0685: Knowledge of access control principles and practices
K0686: Knowledge of authentication and authorization tools and techniques
K0694: Knowledge of computer algorithm capabilities and applications
K0698: Knowledge of cryptographic key management principles and practices
K0707: Knowledge of database systems and software
K0710: Knowledge of enterprise cybersecurity architecture principles and practices
K0719: Knowledge of human-computer interaction (HCI) principles and practices
K0721: Knowledge of risk management principles and practices
K0723: Knowledge of vulnerability data sources
K0728: Knowledge of Confidentiality, Integrity and Availability (CIA) principles and practices
K0729: Knowledge of non-repudiation principles and practices
K0730: Knowledge of cyber safety principles and practices
K0731: Knowledge of systems security engineering (SSE) principles and practices
K0734: Knowledge of Risk Management Framework (RMF) requirements
K0735: Knowledge of risk management models and frameworks
K0736: Knowledge of information technology (IT) security principles and practices
K0739: Knowledge of mathematics principles and practices
K0742: Knowledge of identity and access management (IAM) principles and practices
K0744: Knowledge of operating system (OS) systems and software
K0745: Knowledge of parallel and distributed computing principles and practices
K0749: Knowledge of process engineering principles and practices
K0751: Knowledge of system threats
K0752: Knowledge of system vulnerabilities
K0756: Knowledge of security management principles and practices
K0757: Knowledge of system design tools and techniques
K0758: Knowledge of server administration principles and practices
K0759: Knowledge of client and server architecture
K0765: Knowledge of software engineering principles and practices
K0772: Knowledge of systems testing and evaluation tools and techniques
K0773: Knowledge of telecommunications principles and practices
K0778: Knowledge of enterprise information technology (IT) architecture principles and practices
K0779: Knowledge of systems engineering processes
K0791: Knowledge of defense-in-depth principles and practices
K0803: Knowledge of supply chain risk management principles and practices
K0820: Knowledge of supply chain risks
K0828: Knowledge of supply chain risk management standards and best practices
K0834: Knowledge of technology procurement principles and practices
K0840: Knowledge of hardware reverse engineering tools and techniques
K0842: Knowledge of software reverse engineering tools and techniques
K0848: Knowledge of network systems management principles and practices
K0849: Knowledge of network systems management tools and techniques
K0851: Knowledge of reverse engineering principles and practices
K0859: Knowledge of encryption tools and techniques
K0865: Knowledge of data classification standards and best practices
K0866: Knowledge of data classification tools and techniques
K0870: Knowledge of enterprise architecture (EA) reference models and frameworks
K0871: Knowledge of enterprise architecture (EA) principles and practices
K0872: Knowledge of service management principles and practices
K0873: Knowledge of service management standards and best practices
K0877: Knowledge of application firewall principles and practices
K0878: Knowledge of network firewall principles and practices
K0879: Knowledge of industry cybersecurity models and frameworks
K0880: Knowledge of access control models and frameworks
K0894: Knowledge of computer architecture principles and practices
K0915: Knowledge of network architecture principles and practices
K0917: Knowledge of Personally Identifiable Information (PII) data security standards and best practices
K0918: Knowledge of Payment Card Industry (PCI) data security standards and best practices
K0919: Knowledge of Personal Health Information (PHI) data security standards and best practices
K0920: Knowledge of risk management policies and procedures
K0924: Knowledge of network analysis tools and techniques
K0927: Knowledge of configuration management tools and techniques
K0928: Knowledge of systems engineering principles and practices
K0930: Knowledge of credential management systems and software
K0931: Knowledge of data-at-rest encryption (DARE) standards and best practices
K0932: Knowledge of cryptographic key storage systems and software
K0934: Knowledge of data classification policies and procedures
K0937: Knowledge of countermeasure design principles and practices
K0942: Knowledge of cryptology principles and practices
K0947: Knowledge of computer engineering principles and practices
K0948: Knowledge of embedded systems and software
K0983: Knowledge of computer networking principles and practices
K1014: Knowledge of network security principles and practices
K1050: Knowledge of critical information requirements
K1120: Knowledge of Confidentiality, Integrity, Availability, Authenticity, and Non-repudiation (CIAAN) principles and practices
K1216: Knowledge of service-oriented security architecture practices and principles
K1222: Knowledge of system availability requirements

Skill statements

S0141: Skill in assessing security systems designs
S0479: Skill in evaluating supplier trustworthiness
S0480: Skill in evaluating product trustworthiness
S0483: Skill in identifying software communications vulnerabilities
S0484: Skill in developing user credential management systems
S0485: Skill in implementing user credential management systems
S0486: Skill in implementing enterprise key escrow systems
S0543: Skill in scanning for vulnerabilities
S0544: Skill in recognizing vulnerabilities
S0570: Skill in designing the integration of hardware solutions
S0571: Skill in designing the integration of software solutions
S0574: Skill in developing security system controls
S0578: Skill in evaluating security designs
S0597: Skill in writing code in a currently supported programming language
S0667: Skill in assessing security controls
S0674: Skill in installing system and component upgrades
S0675: Skill in optimizing system performance
S0688: Skill in performing network data analysis

Source: Workforce Framework for Cybersecurity (NICE Framework) (NIST SP 800-181 Rev 1) (Version: 1.0.0)