1. Working Group 7: Cybersecurity Workforce Status Update March 16, 2016 Bill Boni, Co-Chair T-Mobile Drew Morin, Co-Chair FCC Liaison: Erika Olsen

2. 2 WG7 Objectives Working Group Description: This working group will leverage existing work and best practices to enhance the volume and quality of the workforce. Deliverables: This working group will examine and develop recommendations for the CSRIC’s consideration regarding any actions that the FCC should take to improve the security of the nation’s critical communications infrastructure through actions to enhance the transparency, skill validation, and best practices relating to recruitment, training, retention, and job mobility of personnel within the cybersecurity field.

3. 3 WG7 Deliverables Demonstrate the application of the National Cybersecurity Workforce Framework (NCWF) to the common and specialized work roles with in the communications sector; Identify any gaps or improvements in the NCWF for evolving work roles or skill sets to be included in sector members’ workforce planning; and Identify, develop and recommend best practices and implementation thereof to mitigate insider threats, including through scalable means to enhance transparency, accountability and validation of skills, knowledge and abilities within the communications sector and particularly with respect to personnel having access to the most critical elements of the nation’s communications network assets; The working group should consider means to promote a common lexicon and roadmap that will promote more effective interface with academic institutions and other training environments.

4. 4 WG7 Members Bill Boni, Co-chair (T-Mobile) Chris Boyer (AT&T Services) Prentis Brooks (Time Warner Cable) Upendra Chivukula (State of New Jersey) Frank Cicio (CWA) Barbara Endicott-Popovsky (UW) Jay English (APCO International) Mike Geller (Cisco Systems) Kazuhiro Gomi (NTT America) Scott Haas (IID Security Central) Kathrina Hardy (Verizon) Shinishi Hirata (NTT Corporation) Anna Jackson (FireEye) Kim Keever (Cox) Masato Kimura (NTT) Drew Morin, Co-chair (Windup Ventures) Steven Leese (APCO International) Steve Mace (NCTA) Jennifer Manner (EchoStar) Shawn Matthews (PacOpticNetworks, LLC) Bill Newhouse (NIST) Daishi Sakakibara (NTT) Quentin Sa’Lay (Comcast NBC Universal) David Stienour (GWU) Matthew Straeb (Alert FM) Nobumitsu Takeuchi (NTT) Zachary Tudor (SRI International) Erik Wallace (Commtech Telecomm) Kathy Whitbeck (Nsight) Shinichi Yokohama (NTT) FCC Liaison: Erika Olsen

5. 5 Background Traditional approaches to training are not working: According to a joint survey published by ISACA® and the RSA® Conference, 82% of corporations expect a cyberattack in 2015; and 35% are unable to fill their open positions with qualified cybersecurity personnel Furthermore, less than half of those surveyed believe that their current security teams have the ability to detect and respond to complex incidents

6. Workforce Planning Process 1 1 Source: “Workforce Planning”, National Initiative for Cybersecurity Careers and Studies https://niccs.us-cert.gov/careers/workforce-planning

7. Focus on Skills and Competencies WG7 Members will focus on defining the role profiles from an extended baseline of the National Cybersecurity Workforce Framework Category, Specialty Area, Competencies and KSAs instead of developing from scratch WG7 plans to leverage the Cybersecurity Workforce Alliance (CWA) data set and process developed for the Financial Sector: Leverage extended Workforce Profiles and Roles already developed for the Finance sector as a starting point CWA representatives have direct experience in extending the taxonomy to address gaps or improvements The resulting taxonomy will be captured in an information base to be shared across the communications sector that could leverage using automated tools that already exist

8. 8 Evaluate the National Cybersecurity Workforce Framework (NCWF) – Complete Delivered as Interim Report – Demonstrate applicability of the NCWF to the Communications Sector – Identify Gaps and Improvements Electronic Model (Excel Spreadsheet) delivered under separate cover to FCC WG7 Status

9. 9 Starting with the NCWF from NICCS as Baseline Leverage extended Dataset developed for the Finance Sector Identify Gaps and Improvements for Communications Sector NCWF Evaluation Process NCWF Baseline Dataset Financial Sector Modified Dataset Communications Sector Recommended Dataset

10. 10 Interim Report includes the updated dataset with additions to the Categories, Specialty Areas, Competencies, and Knowledge/Skills/Abilities (KSAs) for the Communications Sector NCWF Evaluation Results Categories 78 Specialty Areas 3129 Competencies 6599 KSAs 369560 Baseline Framework Communications Sector

11. 11 WG7 Plans to segment the next phase to capture section specific best practices/challenges/opportunities in cybersecurity workforce development Next Phase – Best Practices Internal Survey Industry Public Safety Academia External Survey Federal Government State Government Financial Sector

12. 12 March 2016: Submission of Cybersecurity Framework with Extensions for Communication Sector in Interim Report [COMPLETE] December 2016: Submission of Draft WG7 Report on Best Practices and Implementation Recommendations – Update from initial milestone of September 2016 – The “lion’s share” of the work will be in gathering and analyzing the data March 2017: Submission of Final WG7 Report on Best Practices and Implementation Recommendations WG7 Schedule

13. 13 Next Steps Assign ownership for each of the segments Continue bi-weekly conference calls – Segment subgroups will hold separate meetings Review/Approve Final Report schedule milestones Gather segment specific data for analysis Review and approve content for report Draft and finalize for delivery Provide Quarterly status updates to Steering Committee and Council