This document discusses the NATO MultiNational Smart Defence Project on Cyber Defence Education & Training (Project 1.36). It provides an overview of the project including its aims, participating nations, phases and deliverables. The project seeks to coordinate cyber defence education and training across NATO to address gaps and shortfalls. Key initiatives discussed include developing a unified cyber competence framework, new course offerings, an international cybersecurity and cyber defence masters' program, and establishing a "Cyber Academia and Innovation Hub."

9. NATO MultiNational Smart Defence Project on Cyber Defence Education & Training (Project 1.36)
MNCDE&T:
Lt Col Luis Salomão de Carvalho
luis.scarvalho@defesa.pt

10. NATO UNCLASSIFIED 11
What is a Cyber Defence Capability?
Doctrine
Training
Organization
Material
Leadership
Personnel
Facilities
Interop
8 Lines of
Development:

11. NATO UNCLASSIFIED
Agenda
01 From NCISS to NCI Academy
02 MN CD E&T contribution to NCI Academy
03 “Cyber Academia and Innovation Hub”
04 Future developments

12. NATO UNCLASSIFIED 13
From the beginning
• Strategic Concept 2010 - Transformation of the NATO Command Structure,
Agencies and Headquarters (2010 Lisbon summit)
• Defense Ministerial Meeting, 08 June 2011 - New NATO Command
Structure, including its Geographic Footprint
o Portugal is responsible for hosting the NATO Communications and Information Systems School
(NCISS)

13. NATO UNCLASSIFIED 14
NCI Academy Building in Oeiras, PRT
• Ground breaking - 23 May 2017
• Building ready by the end of October 2018
• Take over/Hand over - Oct 2018 to Jan 2019
• Academy fully operational - Sept 2019

14. NATO UNCLASSIFIED
15
Offers Allies CD E&T Activities (from
strategic to technical level) not available
through NATO, National, bilateral or
commercial arrangements;
Contributes to NCI Academy Capability
Building – links ACT Gap Analysis with NCI
Academy future activities;
Promotes NATO Certification –high quality
of courses and interoperability of experts;
Multinational Character – greater flexibility
and benefits with participation of EU, Industry
and Partners;
Open and Inclusive – New members could
join at later stage.
MN CD E&T Aim
Added Value
To fulfill Nations’ and NATO’s CD E&T
shortfalls identified in the GAP analysis that
will be performed in cooperation with ACT, in
order to support Nations and NATO to
comply with NDPP Capability Targets
NATO UNCLASSIFIED

15. NATO UNCLASSIFIED
MNCDE&T Members
16

16. NATO UNCLASSIFIED
Project 1.36 - MN CD E&T
PURPOSE
To create a CD E&T Coordination Platform and provide new initiatives to fulfil Nations’ and NATO’s CD E&T shortfalls
Hungary Lithuania Norway
Participating Nations (Formal Statement of Interest):
Portugal SloveniaRomania UK
Germany
Turkey
GreeceDenmark Latvia
Albania
Interested Partners:
EU FYROM
Bulgaria Czech Republic
Italy
PolandFrance
Spain
Belgium
Other Stakeholders and Interested Nations:
Estonia
NIAG
Canada
Finland
Austria Ireland
Main Stakeholders:
ACT NCISS
ACO NMSG -117 , IST PanelNSO
Slovakia
Netherlands
USA
Georgia
Luxembourg
Moldova
Ukraine
Japan
Switzerland
NATO UNCLASSIFIED
Brazil

17. NATO UNCLASSIFIED 18
Working Plan: Phases & Deliverables
Inputs Phases Deliverables
ToR and PoWCap Targets
NATO CD E&T Plan,
NATO CD Aw
and CD E&T Concepts
Final Report Preparation
(Phase 7)
New Initiatives
(Phase 6)
Proposed Solutions
(Phase 5)
Gap Analysis
(Phase 4)
Analysis of CD E&T Offer
(Phase 3)
CD E&T Requirements
(Phase 2)
Definition of CD
Competencies & Skills
(Phase 1)
Definition of ToR
and Working Plan
(Phase 0)
CDE&TCoord Platform(FOC)
+ Final Report
Report on Required
Competencies& Skills
Common E&T Curriculum
List of Available
CD E&T Activities
Report on Gap Analysis
CD E&T Shortfalls
CDE&TCoord Platform (IOC)
New Proposals CD E&T
New CD E&T Initiatives
201520162017
NATO and Nations
Inputs
and Proposals
2014
Documents and National
References
NATO UNCLASSIFIED

18. NATO UNCLASSIFIED 19
CD E&T Gaps – Problem Solving Formula
=-

19. NATO UNCLASSIFIED
Cyber Curriculum : Modular Approach
Cyber User
(Individuals)
BASIC INTERMEDIATE ADVANCED
Cyber Leader
(Leadership /Staff)
Cyber Security
(Cyber-Specialist)
Generation of
Competencies
D3
D2
D1
C1
C1
C2
SpecializationLevel
Education Level
E1
E1
Cyber Defence
(Cyber-Warior) E3E2
D1
C3
E1
AcademicPrograms
LawyersStrategicOperational TacticalTechnicalAllUsers
Cyber Law
(Cyber-Lawyer)
B1
A1
A1
A1
A3
B2 B3
B1
Tech Assistant
A2 A3
A4
A2
EXPERT
D4
E2
E4
C4
B4
A4
E2 E3
A4
NATO UNCLASSIFIED

20. NATO UNCLASSIFIED 21
NCWF
(US - NIST)
EDA
Frame-
work
(EU)
Unified Cyber Competence Framework (UCCF)

21. NATO UNCLASSIFIED 22
BASIC
INTERMEDIATE
ADVANCED
EXPERT
Target Audience - Education Level

22. NATO UNCLASSIFIED 23
Approach to create a combined framework
Source of Information
• EDA Landscaping study 2013
• NIST SP 800-181 NICE Cybersecurity Workforce 2 Framework (US)
The Process
• All ~900 tasks from NCWF have been sorted into EDA HTL Groupings
• All ~1100 KSAs link to the TA;
• Grouping KSAs into competencies.

23. 25
CAREER PATH COMPETENCY FRAMEWORK
A1 A2 A3 A4
B3
B4
C3
C4
D3
D4
E3
E4
BCD1
BCD3
BDE1
BDE2
BDE3
BCE1
BCE2
CDE3
BCD1
BCE1 CDE1
BDE1
BCE1
CDE1
A3
A3
BCD1
BDE1 CDE1
A3
A4
C2
D2
E2
BCD2
BDE2BCE2
A4
BCD2
BCE2
A4
BCD2
BDE2
A4
BDE3BCE3
CDE3
BCD3 BDE3
BCE3
BCD3 BCE3
CDE3
ICT User
C4 practitioners
Securely
Provision
Cyber Defence
Specialist
Leadership &
Governance
BASIC INTERMEDIATE ADVANCED EXPERT

24. NATO UNCLASSIFIED
MNCDE&T – New Initiatives
Cyber Law,
CS and CD
Master
Cyber
Awareness
Course
Cyber
Lab/Range
Cyber Security &
Cyber Defence
Master
CD Capability
Development
Course
CD Staff
Officers’ Course
(Cyber Advisor)
Technical
Courses
Cyber
Intelligence
Course
CD Workforce
Career
Path
CD E&T Accreditation
Process

25. Masters’ Program – Next Steps
Governance
(SoI/Protocol – Executive Board and Scientific Commission)
Institutional
Framework
(Professors, Resources, Facilities)
University N
(National)
University A
(National)
University X
(International)
University C
(National)
University B
(National)
University Y
(International)
University Z
(Internacional)
Disciplines
(Consolidated & Certified)
Discipline
A
Discipline
C
Professional Stage
Industry Y
CDef Centre
Organization A
CS Centre
Industry X
Organization A
Discipline
B
Visits,
Conferences
and Seminars
International
Cooperation
and
National
Sinergies
(NATO, EU, Bilateral)
“Federated Academia” Environment
Presential
(On-Site)
B-Learning
CD E&T Cloud
(“Academic Cloud”)
Mobile Training
Cyber Range
(CD&E, Simulation, etc)

26. NATO UNCLASSIFIED 28
May 14
Feb 15
Dec 15
Common Vision
CD E&T
Dec 15
Common
Curriculum
Dec 16
National
EU EUMTG – CD Discipline
• Masters
• Cyber Range
• Taxonomy
• Courses
NATO
PT CD EDA
MNCDE&T – Synergies and Coordination of Efforts
PoW
Apr 15
Apr15
MNCDE&T
National

27. NATO UNCLASSIFIED 29
New Initiatives
EPR
Identification
number
Course Title
Henrique/Sérgio Information Security Management
Rui Silva/Sérgio Crypto and COMSEC
Mark Frost/Ana Respício 0001CYB Software and Applications Security
Mark Frost/Rui Silva/ J. Saarisilta 0002CYB Digital Forensics
Sebastiaan/Vitor/Sergio 0003CYB Social Engineering
Mark Frost/Rui Silva/ J. Saarisilta
0004CYB Digital Crime and Investigation
Sofia Casimiro 0005CYB Cyberspace and Cyber Operations Legal Framework
Rui Silva/Mark Frost 0006CYB Penetration Testing and Ethical Hacking
Manuel Esteve 0007CYB Cyber-Intelligence and Situational Awareness
Casimiro and Paulo Moniz 0008CYB Protection of Critical Infrastructures and Systems
Mark /Paulo Nunes
0011CYB Cybersecurity and Cyberdefense capability Development
Mark Frost
0012CYB Cyberspace Crisis Management Exercises and Scenarios Development
Ana Respício/Mark Frost 0013CYB Risk and Incident Management
Paulo Nunes 0014CYB Information Warfare
Paulo Nunes/Mark Frost/Rocco
0015CYB Cyber Operations Planning
Mark Frost/Sebastiaan 0016CYB Digital Leadership and Team Management
Paulo Nunes/Mark Frost/Rocco
A0735
Cyber Defence Operations & Planning
Carlos Simões/Kay Mrosk A0730 NATO Cyber Defence Advisor

28. NATO UNCLASSIFIED 30
Cyber Academia and Innovation Hub
(Approved)
• CS & CD Masters’ Program;
• Cyber R&D Projects
(National and International)
• Innovation;
• Cyber R&D Projects
(National and International)
• Capability Building
Requirements and Needs;
• CS & CD Education,
Training and Exercises
(National, NATO, EU, …)
NATO UNCLASSIFIED

29. NATO UNCLASSIFIED
Cyber Academia and Innovation Hub
NATO
Smart Defence
NCI Academy
NCIA Interim
Facilities
Cyber Academia
and Innovation
Hub
NCISS
(Latina)
NCISS: NATO Communications and Information Systems School
MNCDET: MultiNaional Cyber Defense Education and Training
AM: Academia Militar (Campus da Lisboa)
NCIA: NATO Communications and Information Agency
MN CD E&T
1.36
AM
(CAMPUS - LISBOA)
Oeiras
2019
•Formação Nacional
• Forças Armadas
• Forças de Segurança
• Administração Pública
• Indústria
• Academia
•Formação Internacional
• Bilateral/Multilateral
• NATO
• UE
• CPLP
• Iniciativa 5+5
Educação e treino
nas áreas de Ciberdefesa
e Cibersegurança
Transferência
NCISS (Latina) -> NCI Academy (Oeiras)
• Cimeira Nato LX/Nov2010
• Decisão ministerial Jun/2011
• Desp 109/MDN/2014
Necessita
Até
Criou
Iniciativa Formação
Formação
Para início dos cursos
POW
/
New Initiatives

30. Latina
Glons
NATO CIS School
Relocation
2019
AirC2
2018 (COMNAV)
CIS e Cyber
2018 (CAIH)

31. NATO UNCLASSIFIED
Latest Workshops (up to 52 participants, with Industry and Academia)
Common Taxonomy approved;
Cyber Defence Competency
Framework – approved;
Cyber Academia WG ToR – approved;
Transform the courses/new initiatives
into NCISS Curriculum template;
Continue to update the
Questionnaires;
Gap Analysis clarification to “fill” the
Cyber Curriculum;
Framework for International Masters’
Program discussed to implement.
WS#14
07-08 November 2017
NCISS, Latina
(52 participants)
WS#15
30-31 January 2018
NATO HQ Brussels
(50 participants)
WS#16
17-18 April 2018
Military Academy, Amadora
(60 participants)

33. NATO UNCLASSIFIED 35
Poker Challenge
Acting on an anonymous phone call, the police raid a house to arrest a suspected
murderer. They know two things:
- The suspect’s name is John.
- He is inside the house.
Inside the house, the police find four people playing poker:
- a carpenter (wood-worker)
- a truck driver
- a mechanic
- a fireman
Without hesitation or communication, the police arrest the fireman. How do they know
he is the suspect?

34. NATO UNCLASSIFIED
Next Steps …
3636
Worshop #17 (Munich, 11-12 September 2018)
Focus:Common Cyber Curriculum (NATO-EU Alignment) and New CD E&T Initiatives - update
(Phase 5);
✓ Integration of WPs Results at CD TEXP Platform;
✓ The Cyber Curriculum to Build a Skilful and Savvy Cyber Defence Workforce
(recommendation).
Cyber Academia WG - International Masters’;
✓ New Initiatives certification processes;
✓ Three “new initiatives”: Cyber Governance, Cyber Med and Cyber Team Training applied to
a Security Operations Center (SOC);
✓ Final Report.
Next Events:
− Cyber Academia WG Workshop #02 and #03 (Lisbon/Latina (TBC) May and June 18)
− Workshop #18 (TBC, November 2018).

35. NATO MultiNational Smart Defence Project on Cyber Defence Education & Training (Project 1.36)
MNCDE&T:
Lt Col Luis Salomão de Carvalho
luis.scarvalho@defesa.pt