NICE Framework
United StatesThe US reference for cybersecurity work roles, used by employers, government, and NICCS.
NIST · v2.2.0
View the NICE Framework mapping →CCDL1 and CCDL2 mapped to leading cybersecurity workforce frameworks
CyberDefenders certifications are mapped to workforce frameworks used in the US, EU, UK, Canada, Saudi Arabia, and worldwide. Each mapping scores the framework's official tasks, knowledge, and skills against the live course content.
Last reviewed: October 2026
Which frameworks are CCDL1 and CCDL2 mapped to?
Frameworks across the US, the EU, the UK, Canada, Saudi Arabia, and global skills planning. Open any framework to see which roles CCDL1 and CCDL2 align to, the alignment labels, and the full statement mapping.
ECSF
European UnionENISA's 12 cybersecurity role profiles, linked to NIS2 skills needs across Europe.
ENISA · 2022 role profiles
View the ECSF mapping →SFIA
GlobalA global skills framework that describes each skill at seven levels of responsibility.
SFIA Foundation · SFIA 9
View the SFIA mapping →Canada's reference for cybersecurity work roles, including SOC tiers 1 to 3.
Canadian Centre for Cyber Security · ITSM.00.039, 2023 v2
View the Canadian framework mapping →UK GSP Career Framework
United KingdomUK government security roles, each with the skills and skill levels it requires.
Government Security Profession · Cyber security roles, October 2026
View the UK GSP mapping →SCyWF
Saudi ArabiaNCA's national framework for cybersecurity roles in Saudi Arabia.
National Cybersecurity Authority · 1.5:2026
View the SCyWF mapping →Find your role across frameworks
Each framework names the same jobs differently. This table matches common SOC and DFIR jobs to their closest role in each framework.
| Job | NICE | ECSF | SCyWF | Canada | UK GSP | SFIA skill |
|---|---|---|---|---|---|---|
| SOC analyst | Defensive Cybersecurity (PD-WRL-001) | Cyber Incident Responder | Cybersecurity Defense Analyst (PD-D-001) | Cyber security operations analyst | Monitoring | Security operations (SCAD) |
| Incident responder | Incident Response (PD-WRL-003) | Cyber Incident Responder | Cybersecurity Incident Responder (PD-IR-001) | Cyber incident responder | Incident Response | Incident management (USUP) |
| Digital forensics analyst | Digital Forensics (PD-WRL-002) | Digital Forensics Investigator | Digital Forensics Specialist (PD-IR-002) | Digital forensics analyst | Digital Forensics | Digital forensics (DGFS) |
| Threat hunter | Threat Analysis (PD-WRL-006) | Cyber Threat Intelligence Specialist | Threat Hunter (PD-TM-002) | Cyber security operations analyst, Tier 3 | Monitoring | Threat intelligence (THIN) |
How do these frameworks compare?
They describe the same kind of work in different ways. NICE, ECSF, SCyWF, and the Canadian framework are organized by work roles. The UK GSP framework pairs roles with required skill levels. SFIA is organized by skills and levels of responsibility.
| Framework | Region | Owner | Version | Organized by |
|---|---|---|---|---|
| NICE Framework | United States | NIST | v2.2.0 | Work roles |
| ECSF | European Union | ENISA | 2022 role profiles | Work roles |
| SFIA | Global | SFIA Foundation | SFIA 9 | Skills and levels |
| Canadian Cyber Security Skills Framework | Canada | Canadian Centre for Cyber Security | ITSM.00.039, 2023 v2 | Work roles |
| UK GSP Career Framework | United Kingdom | Government Security Profession | Cyber security roles, October 2026 | Roles and skill levels |
| SCyWF | Saudi Arabia | National Cybersecurity Authority | 1.5:2026 | Work roles |
What do the alignment labels mean?
Each framework page shows how strongly each certification fits each role.
- Primary alignmentThe certification is built for this role.
- Strong relevant alignmentThe certification covers a meaningful part of this role.
- Relevant alignmentThe certification covers some of this role.
SFIA uses levels instead, such as "Level 3" or "Level 2 + partial 3," because it describes skills rather than roles. The Canadian page also shows alignment by SOC tier.
How were the mappings made?
We scored each framework's official tasks, knowledge, and skills against the live, published lessons and labs of CCDL1 and CCDL2.
Every item is marked covered, partially covered, or not evidenced, with the lesson or lab that supports it. The mappings were captured in October 2026 and are reviewed yearly, and whenever a course or framework version changes.
How can teams use these mappings?
- Write job descriptions that name the framework role and the certification that builds it.
- Plan SOC training against the framework your regulator or market uses.
- Show HR, managers, and auditors which roles your training covers.
Training a SOC team? See our cybersecurity training for teams and enterprises.
Frequently asked questions
What is a cybersecurity workforce framework?
A shared list of cybersecurity roles or skills, with the tasks, knowledge, and skills each one needs. Employers use it to write job descriptions, plan teams, and choose training.
Which framework should my team use?
Use the one your market or regulator follows: NICE in the United States, ECSF in the European Union, SCyWF in Saudi Arabia, and SFIA where employers describe roles by skill level, such as the UK and Australia.