1. Working Group 7: Cybersecurity Workforce Status Update December 03, 2015 Bill Boni, Co-Chair T-Mobile Drew Morin, Co-Chair FCC Liaison: Erika Olsen

2. 2 WG7 Objectives Working Group Description: This working group will leverage existing work and best practices to enhance the volume and quality of the workforce. Deliverables: This working group will examine and develop recommendations for the CSRIC’s consideration regarding any actions that the FCC should take to improve the security of the nation’s critical communications infrastructure through actions to enhance the transparency, skill validation, and best practices relating to recruitment, training, retention, and job mobility of personnel within the cybersecurity field.

3. 3 WG7 Deliverables Demonstrate the application of the NICE Cybersecurity Workforce Framework (CWF) to the common and specialized work roles with in the communications sector; Identify any gaps or improvements in the CWF for evolving work roles or skill sets to be included in sector members’ workforce planning; and Identify, develop and recommend best practices and implementation thereof to mitigate insider threats, including through scalable means to enhance transparency, accountability and validation of skills, knowledge and abilities within the communications sector and particularly with respect to personnel having access to the most critical elements of the nation’s communications network assets; The working group should consider means to promote a common lexicon and roadmap that will promote more effective interface with academic institutions and other training environments.

4. 4 WG7 Members Bill Boni, Co-chair (T-Mobile) Chris Boyer (AT&T Services) Prentis Brooks (Time Warner Cable) Upendra Chivukula (State of New Jersey) Renato Delatorre (Verizon Wireless) Kevin Dottley (CenturyLink) Barbara Endicott-Popovsky (UW) Jay English (APCO International) Mike Geller (Cisco Systems) Kazuhiro Gomi (NTT America) Scott Haas (IID Security Central) Shinishi Hirata (NTT Corporation) Anna Jackson (FireEye) Kim Keever (Cox) Masato Kimura (NTT) Drew Morin, Co-chair (TCS) Steven Leese (APCO International) Steve Mace (NCTA) Jennifer Manner (EchoStar) Shawn Matthews (PacOpticNetworks, LLC) Bill Newhouse (NIST) Daishi Sakakibara (NTT) Quentin Sa’Lay (Comcast NBC Universal) David Stienour (GWU) Matthew Straeb (Alert FM) Nobumitsu Takeuchi (NTT) Zachary Tudor (SRI International) Erik Wallace (TCS) Kathy Whitbeck (Nsight) Shinichi Yokohama (NTT) FCC Liaison: Erika Olsen

5. 5 Background Traditional approaches to training are not working: According to a joint survey published by ISACA® and the RSA® Conference, 82% of corporations expect a cyberattack in 2015; and 35% are unable to fill their open positions with qualified cybersecurity personnel Furthermore, less than half of those surveyed believe that their current security teams have the ability to detect and respond to complex incidents

6. Workforce Planning Process 1 1 Source: “Workforce Planning”, National Initiative for Cybersecurity Careers and Studies https://niccs.us-cert.gov/careers/workforce-planning

7. Focus on Skills and Competencies WG7 Members will focus on defining the role profiles from an extended baseline of the NICE framework Specialty Area Competencies and KSAs instead of developing from scratch WG7 plans to leverage the Cyber Security Workforce Alliance data set and process developed for the Financial Sector: Leverage extended Workforce Profiles and Roles already developed for the Finance sector as a starting point CWA representatives have direct experience in extending the taxonomy to address gaps or improvements The resulting taxonomy will be captured in an information base to be shared across the communications sector that could leverage using automated tools that already exist

8. 8 Vetting process continues; no issues to date Co-chairs worked with FCC Liaison and CWA representatives to gain access to CWA NICE Framework with Extensions Working Group members commencing review of KSAs (Knowledge, Skills, and Abilities) WG7 Status

9. 9 January 2016: KSA and Competencies review complete February 2016: Specialties and Categories review complete March 2016: Submission of NICE Framework with Extensions for Communication Sector September 2016: Submission of Draft WG7 Report on Best Practices and Implementation Recommendations March 2017: Submission of Final WG7 Report on Best Practices and Implementation Recommendations WG7 Schedule

10. 10 Next Steps Focus entire Working Group on completing NICE Framework KSA gap analysis – Three phase execution: KSAs, Competencies, Roles/Categories Continue bi-weekly conference calls (adjusted for the Holidays) Kick off planning for Best Practices Report development in 1Q2016 Provide Quarterly status updates to Steering Committee and Council