The presentation discusses how auditors can conduct cybersecurity skills audits to improve organizational cybersecurity. It outlines challenges with current controls and the need to audit skills in addition to technology and processes. Various cybersecurity skills frameworks are presented, including NIST NICE, the EU e-CF, and SFIA models. Methods for implementing a skills audit through questionnaires and skills assessments are described. The output of a skills audit would be a list of existing skills coverage and identification of skills gaps to guide remediation actions.

1. Dr. Vilius Benetis, CISA, CRISC
NRD CS, vb@nrd.no
Mon. 10:30-11:45

2. #EUROCACS
Problem
• Cybersecurity controls are failing to protect organizations.
• Controls consist of skills, process, and technology.
• Audit of technology and process is well understood.
• Audit is expected to assist organizations.
• How to approach the skills audit for better cybersecurity result?

3. #EUROCACS
Cybersecurity Skills Audit:
When and Where?
From recent ISACA publication:
Information Systems Auditing: Tools and Techniques—Creating Audit Programs

4. #EUROCACS
Cybersecurity Skills Audit:
When and Where?
From recent ISACA publication:
Information Systems Auditing: Tools and Techniques—Creating Audit Programs
Automation of
business
functions

5. #EUROCACS
Cybersecurity Skills Audit:
When and Where?
From recent ISACA publication:
Information Systems Auditing: Tools and Techniques—Creating Audit Programs
Automation of
business
functions
Ex. Assess
org/IS resilience
to cyber treats

6. #EUROCACS
Cybersecurity Skills Audit:
When and Where?
From recent ISACA publication:
Information Systems Auditing: Tools and Techniques—Creating Audit Programs
Should we include
skills audit?
Automation of
business
functions
Ex. Assess
org/IS resilience
to cyber treats

7. #EUROCACS
Cybersecurity Skills Audit:
When and Where?
From recent ISACA publication:
Information Systems Auditing: Tools and Techniques—Creating Audit Programs
1) Risk: Lack of
skilled people
2) Skills required
to assess
Should we include
skills audit?
Automation of
business
functions
Ex. Assess
org/IS resilience
to cyber treats

8. #EUROCACS
Cybersecurity Skills Audit:
When and Where?
From recent ISACA publication:
Information Systems Auditing: Tools and Techniques—Creating Audit Programs
1) Risk: Lack of
skilled people
2) Skills required
to assess
Methodologies
(NICE, CSC, e-
CF, SFIA)
Should we include
skills audit?
Automation of
business
functions
Ex. Assess
org/IS resilience
to cyber treats

9. #EUROCACS
Other Reasons for Skills Audit
HR:
• Re-organization preparation. What skillsets we need to plan?
• What skillset to hire?
CISO office:
• Information security should be handled better. What skills are
missing?
Career planning:
• What should I focus for my cybersecurity career?

10. #EUROCACS
Cybersecurity Skills Models
• NIST NICE
United States
• e-CF
European Union / Dutch
• SFIA6
– Matthew Burrows / SFIA6 Design Authority, design@sfia-
online.org / EuroCACS/ISRM 2015 presentation

11. #EUROCACS
NIST NICE

12. #EUROCACS
NIST NICE

13. #EUROCACS
NIST NICE

14. #EUROCACS
What skills required for Cybersecurity?
https://www.cisecurity.org/workforce/workplace/

15. #EUROCACS

16. #EUROCACS
EU model e-CF
www.ecompetences.eu
16

17. #EUROCACS

18. #EUROCACS
CSC operation: Security vs. IT roles
18
2%
17%
25%
17%
39%
0%
Total
Developer
ICT Security Manager
ICT Security Specialist
Network Specialist
Systems Administrator
Systems Architect
(blank)

19. #EUROCACS
CSC operation: Alternatively
1%1%
5%
67%
7%
1%
14%
1%3%
Total
Developer
Enterprise Architect
ICT Security Manager
ICT Security Specialist
Network Specialist
Service Desk Agent
Systems Administrator
Systems Architect
Trainer
(blank)

20. #EUROCACS
PvIB/e-CF modelISACA CISM
e-Competences
Job Profiles
D.1. Information
Security Strategy
Development
Domains
E.3. Risk
Management
E.8. Information
Security
Management
CISO ICTSMISO ICTSS
D1. Information
Security
Governance
D3. Information
Security Program
Development and
Management
D2. Information Risk
Management and
Compliance
D4. Incident
Management and
Response
Not Available
Level 5
Level 4
Level 5
Level 3
Level 4
Level 3
Level 4 Level 3

21. #EUROCACS
C. RUN (ICTSS e-CF
only: C.2 Change
Support, C.3 Service
Delivery)
PvIB/e-CF modelISACA CISA
e-Competences
Job Profiles, proficiency
E.8. Information
Security
Management
Domains
E.9. IS Governance
B. BUILD
(ICTSS: B.4. Solution
Deployment)
CISO ICTSMISO ICTSS
D1. The Process of
Auditing
Information
Systems (14%)
D3. Information
Systems Acquisition,
Development, and
Implementation
(19%)
D2. Governance and
Management of IT
(14%)
D4. Information
Systems Operations,
Maintenance and
Support (23%)
Level 5 Level 4 Level 4
Level 4
(e-CF only)
Level 3
Level 2
Level 3
(e-CF only)

22. #EUROCACS
PvIB/e-CF modelISACA CRISC
e-Competences
Job Profiles, proficiency
E.3. Risk
Management
Domains CISO ICTSMISO ICTSS
D1. Risk
Identification (27%)
D3. Risk Response
and Mitigation
(23%)
D2. Risk Assessment
(28%)
D4. Risk and Control
Monitoring and
Reporting (22%)
Level 4 Level 3 Level 3

23. #EUROCACS
PvIB REALM ISACA REALM
PvIB does not cover
PvIB Model
e-Competences
A.7. Technology Trend
Monitoring
B.4. Solution Deployment
D.1. Information Security
Strategy Development
E.3. Risk Management
E.4. Relationship Management
E.8. Information Security
Management
General competences:
G.1. Leadership
G.2. Project management
G.3. Communication and
persuasion
G.4. Technical research
G.5. Organisational sensitivity
G.6. Management
G.7. Analytical skills
G.8. Integrity
ISACA CISM
Domains
D1. Information Security Governance
(24%)
D3. Information Security Program
Development and Management (25%)
D2. Information Risk Management and
Compliance (33%)
D4. Incident Management and Response
(18%)
Generic competences, proven experience and continuous education
D1. The Process of Auditing Information
Systems (14%)
D3. Information Systems Acquisition,
Development, and Implementation(19%)
D2. Governance and Management of IT
(14%)
D4. Information Systems Operations,
Maintenance and Support (23%)
D1. Risk Identification (27%)
D3. Risk Response and Mitigation (23%)
D2. Risk Assessment (28%)
D4. Risk and Control Monitoring and
Reporting (22%)
D1. Framework for the Governance of
Enterprise IT (25%)
D3. Benefits Realization (16%)
D2. Strategic Management (20%)
D4. Risk Optimization (24%)
ISACA CISA ISACA CRISCISACA CGEIT
E.9. IS Governance
NA
NA
PvIB Job Profiles, Proficiency levels
CISO ICTSMISO ICTSS
Level 3 Level 3
Level 2
Level 5
Level 4 Level 3 Level 3
Level 4
Level 5 Level 4 Level 4 Level 3
Level 4 Level~3 Level~3 Level~3

24. #EUROCACS
SFIA6

25. #EUROCACS
SFIA6 (sample)

26. #EUROCACS
How to run skills audit?
Simplest:
• Ask: what skills are missing to reach the goals?
Medium:
• Inventory/assess existing skills via questionnaires (list
competences, ask to self-assess)
Sophisticated:
• Run serious tests to assess

27. #EUROCACS
Output of skills audit
Simplest:
• List of skills/competences and who covers them
• Items without people – missing competences
Medium:
• Skills/competences with required levels, and fulfilled levels
• Gap is visible
Sophisticated:
• Detail report of professional skills assessors

28. #EUROCACS
Summary
Main cybersecurity challenges are in governance, workforce
skillset, and technology inability to be resilient.
Presentation is geared for auditors to learn how to use different
cybersecurity workforce models to prepare better for cybersecurity
audits.
Differences of the NIST NICE, EU e-CF, SFIA models are
presented, along with how to modify these frameworks for own
use, along with Critical Security Controls integration

29. #EUROCACS
Assertion on your capabilities after presentation:
1. create own adjustments to cybersecurity workforce skillset
2. connect cybersecurity tasks with skills
3. recommend to organizations remediation actions for
cybersecurity workforce problems
4. apply US and EU cybersecurity skills, job profiles and e-
competences models to own internal and external audits

30. #EUROCACS
Thank you!
• Dr. Vilius Benetis, CISA, CISM
• vb@nrd.no, NRD CS
• https://www.linkedin.com/in/viliusbenetis