The Workforce Framework for Cybersecurity, commonly referred to as the NICE Framework, is a nationally focused resource to help employers develop their cybersecurity workforce. It establishes a common lexicon that describes cybersecurity work and workers regardless of where or for whom the work is performed. The NICE Framework applies across public, private, and academic sectors.

The NICE program of the National Institute for Standards and Technology (NIST) released NICE Framework Components v1.0.0 in March 2024. This data includes changes to Work Role Categories and Work Role names and descriptions; 11 Competency Areas; new Insider Threat Analysis Work Role; and updates to align Task, Knowledge, and Skill (TKS) statements with the TKS Authoring Guide principles.

The NICE Framework includes the following components: 

  • Work Role Categories (7): A high-level grouping of common cybersecurity functions
  • Work Roles (52): A grouping of work for which someone is responsible or accountable. Please note, Work Roles are not synonymous to job titles or occupations.
  • TKS Statements (2,200+): A set of discrete building blocks that describe the work to be done (in the form of Tasks) and what is required to perform that work (through Knowledge and Skills).
  • Competency Areas (11): Clusters of related Knowledge and Skill statements that correlate with one’s capability to perform Tasks in a particular domain.

To explore the updated version of the NICE Framework, click on the Work Role Categories below or use the links at the top of this page to search within the NICE Framework components. To learn more, visit the NICE Framework Resource Center and review the NICE Framework Overview PDF.

Work Role Categories

Work Roles

Cyberspace Operations

Responsible for gathering evidence on criminal or foreign intelligence entities to mitigate and protect against possible or real-time threats. Conducts collection, processing, and geolocation of systems to exploit, locate, and track targets. Performs network navigation and tactical forensic analysis and executes on-net operations when directed.

Cyber Operations Planning

Responsible for developing cybersecurity operations plans; participating in targeting selection, validation, and synchronization; and enabling integration during the execution of cyber actions.

Exploitation Analysis

Responsible for identifying access and intelligence collection gaps that can be satisfied through cyber collection and/or preparation activities. Leverages all authorized resources and analytic techniques to penetrate targeted networks.

Mission Assessment

Responsible for developing assessment plans and performance measures; conducting strategic and operational effectiveness assessments for cyber events; determining whether systems perform as expected; and providing input to the determination of operational effectiveness.

Partner Integration Planning

Responsible for advancing cooperation across organizational or national borders between cyber operations partners. Provides guidance, resources, and collaboration to develop best practices and facilitate organizational support for achieving objectives in integrated cyber actions.

Target Analysis

Responsible for conducting target development at the system, component, and entity levels. Builds and maintains electronic target folders to include inputs from environment preparation and/or internal or external intelligence sources. Coordinates with partner target working groups and intelligence community members, and presents candidate targets for vetting and validation. Assesses and reports on damage resulting from the application of military force and coordinates federal support as required.

Target Network Analysis

Responsible for conducting advanced analysis of collection and open-source data to ensure target continuity; profiling targets and their activities; and developing techniques to gain target information. Determines how targets communicate, move, operate, and live based on knowledge of target technologies, digital networks, and applications.

The NICE Framework data used for this tool is from the NICE Framework Components v1.0.0.