CyberDefenders certifications mapped to the European Cybersecurity Skills Framework
CCDL1 and CCDL2 both align to two ECSF role profiles: Cyber Incident Responder and Digital Forensics Investigator. CCDL2 also has strong relevant alignment to Cyber Threat Intelligence Specialist.
Last reviewed: October 2026
What is the ECSF?
The European Cybersecurity Skills Framework is ENISA's common language for cybersecurity roles in Europe. It groups the field into 12 role profiles, each with a mission, tasks, key skills, and key knowledge.
Sources: ENISA, European Cybersecurity Skills Framework and ECSF Role Profiles (2022)
Why does the ECSF matter for NIS2?
ENISA has mapped NIS2 obligations to ECSF role profiles, so organizations can see which roles they need to meet NIS2.
Training aligned to those profiles helps show your team has the skills behind those roles.
Source: ENISA, NIS2 obligations mapped to ECSF role profiles
Which ECSF role profiles does CCDL1 align to?
CCDL1 aligns to Cyber Incident Responder and Digital Forensics Investigator. ENISA lists SOC Analyst as an alternative title for Cyber Incident Responder.
The course teaches network, endpoint, Active Directory, and Azure investigation, log analysis in Splunk and KQL, alert triage, containment, and escalation. On the forensics side, it covers evidence acquisition, chain of custody, registry and file system analysis, and timeline reconstruction. It is relevant to Cyber Threat Intelligence Specialist through MITRE ATT&CK and APT analysis, but it does not cover the full intelligence lifecycle.
Which ECSF role profiles does CCDL2 align to?
CCDL2 aligns to Cyber Incident Responder and Digital Forensics Investigator, with strong relevant alignment to Cyber Threat Intelligence Specialist.
The course teaches the NIST incident response lifecycle, response planning, containment and recovery, incident communication, and detailed incident reporting. It also covers disk, memory, and network forensics, malware analysis, intelligence-driven threat hunting, and actor and campaign analysis.
How did we map CCDL1 and CCDL2 to the ECSF?
We scored every Key skill and Key knowledge item in three ECSF role profiles, 60 items in total, against the live, published lessons and labs of each course.
Each item is marked Covered, Partially covered, or Not evidenced, with the lesson or lab that supports it. A title or a passing mention does not count as coverage. We also reviewed the other nine ECSF profiles, but did not score them because they are not the focus of the courses. The mapping was captured in October 2026 and is reviewed yearly.
How can European teams use this mapping?
- Match SOC and incident response hires to ECSF role profiles.
- Plan training against the profiles your organization needs for NIS2.
- Give HR and auditors a clear link between training and recognized EU roles.
Building an incident response team? See our cybersecurity training for teams and enterprises.
What ECSF skills and knowledge do the courses cover?
A sample of ECSF key skills and knowledge each course fully covers, with where they are taught.
| ECSF role profile | Key skill or knowledge | Type | Where it is taught |
|---|---|---|---|
| Cyber Incident Responder | Manage and analyse log files | Skill | CCDL1: Module 3, Log Collection |
| Cyber Incident Responder | Secure Operation Centres (SOCs) operation | Knowledge | CCDL1: Module 6, The SOC Decision Process |
| Digital Forensics Investigator | Collect information while preserving its integrity | Skill | CCDL1: Module 4, Introduction to Digital Forensics |
| Digital Forensics Investigator | Identify, analyse and correlate cybersecurity events | Skill | CCDL1: Module 4, Forensic Timeline Construction |
| Cyber Incident Responder | Incident handling standards, methodologies and frameworks | Knowledge | CCDL2: Incident Response, NIST Incident Response Lifecycle |
| Digital Forensics Investigator | Develop and communicate detailed and reasoned investigation reports | Skill | CCDL2: Incident Response, Incident Report |
| Cyber Threat Intelligence Specialist | Identify threat actors TTPs and campaigns | Skill | CCDL2: Threat Hunting, Intelligence-Driven Hunting: APT29 |
View the full CCDL1 and CCDL2 ECSF mapping
Every Key skill and Key knowledge item in the three scored ECSF role profiles. Items with no evidence in the live course are not listed.
CCDL1: 52 of 60 ECSF items covered or partially covered
| ECSF role profile | Key skill or knowledge | Type | Coverage | Where it is taught |
|---|---|---|---|---|
| Cyber Incident Responder | Practice all technical, functional and operational aspects of cybersecurity incident handling and response | Skill | Partial | Module 2: Network Fundamentals & Threat Detection: Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| Cyber Incident Responder | Collect, analyse and correlate cyber threat information originating from multiple sources | Skill | Covered | Module 3: SIEM: Lab 3.3.1: Threat Hunting Case 1 |
| Cyber Incident Responder | Work on operating systems, servers, clouds and relevant infrastructures | Skill | Covered | Module 2: Network Fundamentals & Threat Detection: Lab 2.2.2: Investigate Linux Security Logs with Auditd |
| Cyber Incident Responder | Work under pressure | Skill | Partial | Module 6: SOC Decision Method: Lab 6.1.2: From Alerts to Handover |
| Cyber Incident Responder | Communicate, present and report to relevant stakeholders | Skill | Covered | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Incident Responder | Manage and analyse log files | Skill | Covered | Module 3: SIEM: Lab 3.1.1: Log Collection |
| Cyber Incident Responder | Incident handling standards, methodologies and frameworks | Knowledge | Partial | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Incident Responder | Incident handling recommendations and best practices | Knowledge | Covered | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Incident Responder | Incident handling tools | Knowledge | Covered | Module 2: Network Fundamentals & Threat Detection: Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| Cyber Incident Responder | Incident handling communication procedures | Knowledge | Covered | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Incident Responder | Operating systems security | Knowledge | Covered | Module 2: Network Fundamentals & Threat Detection: Lab 2.2.1: Analyze Windows Process Activity and Event Logs |
| Cyber Incident Responder | Computer networks security | Knowledge | Covered | Module 2: Network Fundamentals & Threat Detection: Lab 2.1.4: Write and Test Basic IDS Rules |
| Cyber Incident Responder | Cyber threats | Knowledge | Covered | Module 1: Phishing: Lab 1.2.1: Email Threats |
| Cyber Incident Responder | Cybersecurity attack procedures | Knowledge | Covered | Module 6: SOC Decision Method: Lab 6.1.2: From Alerts to Handover |
| Cyber Incident Responder | Computer systems vulnerabilities | Knowledge | Covered | Module 1: Phishing: Lab 1.2.1: Email Threats |
| Cyber Incident Responder | Cybersecurity related laws, regulations and legislations | Knowledge | Partial | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Incident Responder | Secure Operation Centres (SOCs) operation | Knowledge | Covered | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Incident Responder | Computer Security Incident Response Teams (CSIRTs) operation | Knowledge | Partial | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Digital Forensics Investigator | Work ethically and independently; not influenced and biased by internal or external actors | Skill | Partial | Module 4: DFIR: Lab 4.2.3: User Activity and Browser Forensics |
| Digital Forensics Investigator | Collect information while preserving its integrity | Skill | Covered | Module 4: DFIR: Lab 4.1.1: Introduction to Digital Forensics |
| Digital Forensics Investigator | Identify, analyse and correlate cybersecurity events | Skill | Covered | Module 4: DFIR: Lab 4.2.5: Forensic Timeline Construction and Event Sequencing |
| Digital Forensics Investigator | Explain and present digital evidence in a simple, straightforward and easy to understand way | Skill | Covered | Module 4: DFIR: Lab 4.2.5: Forensic Timeline Construction and Event Sequencing |
| Digital Forensics Investigator | Develop and communicate, detailed and reasoned investigation reports | Skill | Partial | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Digital Forensics Investigator | Digital forensics recommendations and best practices | Knowledge | Covered | Module 4: DFIR: Lab 4.1.1: Introduction to Digital Forensics |
| Digital Forensics Investigator | Digital forensics standards, methodologies and frameworks | Knowledge | Covered | Module 4: DFIR: Lab 4.1.1: Introduction to Digital Forensics |
| Digital Forensics Investigator | Digital forensics analysis procedures | Knowledge | Covered | Module 4: DFIR: Lab 4.2.2: File System Artifacts and Execution Analysis |
| Digital Forensics Investigator | Testing procedures | Knowledge | Partial | Module 4: DFIR: Lab 4.1.1: Introduction to Digital Forensics |
| Digital Forensics Investigator | Cybersecurity related laws, regulations and legislations | Knowledge | Partial | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Digital Forensics Investigator | Malware analysis tools | Knowledge | Covered | Module 1: Phishing: Lab 1.3.1: Email Threat Detection and Analysis |
| Digital Forensics Investigator | Cyber threats | Knowledge | Covered | Module 1: Phishing: Lab 1.2.1: Email Threats |
| Digital Forensics Investigator | Computer systems vulnerabilities | Knowledge | Covered | Module 1: Phishing: Lab 1.2.1: Email Threats |
| Digital Forensics Investigator | Cybersecurity attack procedures | Knowledge | Covered | Module 6: SOC Decision Method: Lab 6.1.2: From Alerts to Handover |
| Digital Forensics Investigator | Operating systems security | Knowledge | Covered | Module 2: Network Fundamentals & Threat Detection: Lab 2.2.1: Analyze Windows Process Activity and Event Logs |
| Digital Forensics Investigator | Computer networks security | Knowledge | Covered | Module 2: Network Fundamentals & Threat Detection: Lab 2.1.4: Write and Test Basic IDS Rules |
| Cyber Threat Intelligence Specialist | Collaborate with other team members and colleagues | Skill | Partial | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Threat Intelligence Specialist | Collect, analyse and correlate cyber threat information originating from multiple sources | Skill | Covered | Module 3: SIEM: Lab 3.3.1: Threat Hunting Case 1 |
| Cyber Threat Intelligence Specialist | Identify threat actors TTPs and campaigns | Skill | Partial | Module 3: SIEM: Lab 3.1.2: Event Correlation |
| Cyber Threat Intelligence Specialist | Conduct technical analysis and reporting | Skill | Covered | Module 4: DFIR: Lab 4.2.5: Forensic Timeline Construction and Event Sequencing |
| Cyber Threat Intelligence Specialist | Model threats, actors and TTPs | Skill | Partial | Module 6: SOC Decision Method: Lab 6.1.2: From Alerts to Handover |
| Cyber Threat Intelligence Specialist | Communicate, coordinate and cooperate with internal and external stakeholders | Skill | Partial | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Threat Intelligence Specialist | Communicate, present and report to relevant stakeholders | Skill | Covered | Module 6: SOC Decision Method: Lab 6.1.1: The SOC Decision Process |
| Cyber Threat Intelligence Specialist | Use and apply CTI platforms and tools | Skill | Partial | Module 1: Phishing: Lab 1.3.1: Email Threat Detection and Analysis |
| Cyber Threat Intelligence Specialist | Operating systems security | Knowledge | Covered | Module 2: Network Fundamentals & Threat Detection: Lab 2.2.1: Analyze Windows Process Activity and Event Logs |
| Cyber Threat Intelligence Specialist | Computer networks security | Knowledge | Covered | Module 2: Network Fundamentals & Threat Detection: Lab 2.1.4: Write and Test Basic IDS Rules |
| Cyber Threat Intelligence Specialist | Cybersecurity controls and solutions | Knowledge | Covered | Module 3: SIEM: Lab 3.1.1: Log Collection |
| Cyber Threat Intelligence Specialist | Computer programming | Knowledge | Partial | Module 3: SIEM: Lab 3.2.2: SPL Basics |
| Cyber Threat Intelligence Specialist | Cross-domain and border-domain knowledge related to cybersecurity | Knowledge | Partial | Module 6: SOC Decision Method: Lab 6.1.2: From Alerts to Handover |
| Cyber Threat Intelligence Specialist | Cyber threats | Knowledge | Covered | Module 1: Phishing: Lab 1.2.1: Email Threats |
| Cyber Threat Intelligence Specialist | Cyber threat actors | Knowledge | Partial | Module 3: SIEM: Lab 3.1.2: Event Correlation |
| Cyber Threat Intelligence Specialist | Cybersecurity attack procedures | Knowledge | Covered | Module 6: SOC Decision Method: Lab 6.1.2: From Alerts to Handover |
| Cyber Threat Intelligence Specialist | Advanced and persistent cyber threats (APT) | Knowledge | Covered | Module 3: SIEM: Lab 3.1.2: Event Correlation |
| Cyber Threat Intelligence Specialist | Threat actors Tactics, Techniques and Procedures (TTPs) | Knowledge | Covered | Module 3: SIEM: Lab 3.3.1: Threat Hunting Case 1 |
CCDL2: 54 of 60 ECSF items covered or partially covered
| ECSF role profile | Key skill or knowledge | Type | Coverage | Where it is taught |
|---|---|---|---|---|
| Cyber Incident Responder | Practice all technical, functional and operational aspects of cybersecurity incident handling and response | Skill | Covered | Incident Response: NIST Incident Response Lifecycle |
| Cyber Incident Responder | Collect, analyse and correlate cyber threat information originating from multiple sources | Skill | Covered | Threat Hunting: How to Approach an Investigation: The Threat Hunter's Mindset |
| Cyber Incident Responder | Work on operating systems, servers, clouds and relevant infrastructures | Skill | Covered | Forensics Evidence Collection: Linux Memory Acquisition |
| Cyber Incident Responder | Work under pressure | Skill | Partial | Security Operations Fundamentals: Creating Effective Cybersecurity Training Plans |
| Cyber Incident Responder | Communicate, present and report to relevant stakeholders | Skill | Covered | Incident Response: Effective Incident Communication Planning in IR |
| Cyber Incident Responder | Manage and analyse log files | Skill | Covered | Threat Hunting: How to Approach an Investigation: The Threat Hunter's Mindset |
| Cyber Incident Responder | Incident handling standards, methodologies and frameworks | Knowledge | Covered | Incident Response: NIST Incident Response Lifecycle |
| Cyber Incident Responder | Incident handling recommendations and best practices | Knowledge | Covered | Incident Response: Containment |
| Cyber Incident Responder | Incident handling tools | Knowledge | Covered | Incident Response: Incident Management Platforms |
| Cyber Incident Responder | Incident handling communication procedures | Knowledge | Covered | Incident Response: Effective Incident Communication Planning in IR |
| Cyber Incident Responder | Operating systems security | Knowledge | Covered | Threat Hunting: PowerShell Process Tracking and Command Line Auditing |
| Cyber Incident Responder | Computer networks security | Knowledge | Covered | Security Operations Fundamentals: Network Firewall: Protecting Communication and Data |
| Cyber Incident Responder | Cyber threats | Knowledge | Covered | Threat Hunting: The Evolving Threat Landscape |
| Cyber Incident Responder | Cybersecurity attack procedures | Knowledge | Covered | Threat Hunting: MITRE ATT&CK: Mapping a Full Attack Scenario |
| Cyber Incident Responder | Computer systems vulnerabilities | Knowledge | Covered | Security Operations Fundamentals: Understanding Vulnerability Management Process. |
| Cyber Incident Responder | Cybersecurity related laws, regulations and legislations | Knowledge | Partial | Security Operations Fundamentals: Security Standards: Compliance is Mandatory |
| Cyber Incident Responder | Secure Operation Centres (SOCs) operation | Knowledge | Covered | Security Operations Fundamentals: SOC: Security Operations Center Overview |
| Cyber Incident Responder | Computer Security Incident Response Teams (CSIRTs) operation | Knowledge | Covered | Incident Response: IR Plan |
| Digital Forensics Investigator | Work ethically and independently; not influenced and biased by internal or external actors | Skill | Partial | Incident Response: Incident Report |
| Digital Forensics Investigator | Collect information while preserving its integrity | Skill | Covered | Forensics Evidence Collection: Acquisition |
| Digital Forensics Investigator | Identify, analyse and correlate cybersecurity events | Skill | Covered | Threat Hunting: How to Approach an Investigation: The Threat Hunter's Mindset |
| Digital Forensics Investigator | Explain and present digital evidence in a simple, straightforward and easy to understand way | Skill | Covered | Incident Response: Incident Report |
| Digital Forensics Investigator | Develop and communicate, detailed and reasoned investigation reports | Skill | Covered | Incident Response: Incident Report |
| Digital Forensics Investigator | Digital forensics recommendations and best practices | Knowledge | Covered | Forensics Evidence Collection: Acquisition |
| Digital Forensics Investigator | Digital forensics standards, methodologies and frameworks | Knowledge | Partial | Forensics Evidence Collection: Acquisition |
| Digital Forensics Investigator | Digital forensics analysis procedures | Knowledge | Covered | Disk Forensics: Exploring NTFS Master File Table |
| Digital Forensics Investigator | Testing procedures | Knowledge | Partial | Incident Response: Evidence Collection |
| Digital Forensics Investigator | Cybersecurity related laws, regulations and legislations | Knowledge | Partial | Security Operations Fundamentals: Security Standards: Compliance is Mandatory |
| Digital Forensics Investigator | Malware analysis tools | Knowledge | Covered | Malware Analysis: Unpacking Packed Malware |
| Digital Forensics Investigator | Cyber threats | Knowledge | Covered | Threat Hunting: The Evolving Threat Landscape |
| Digital Forensics Investigator | Computer systems vulnerabilities | Knowledge | Covered | Security Operations Fundamentals: Understanding Vulnerability Management Process. |
| Digital Forensics Investigator | Cybersecurity attack procedures | Knowledge | Covered | Threat Hunting: MITRE ATT&CK: Mapping a Full Attack Scenario |
| Digital Forensics Investigator | Operating systems security | Knowledge | Covered | Threat Hunting: PowerShell Process Tracking and Command Line Auditing |
| Digital Forensics Investigator | Computer networks security | Knowledge | Covered | Security Operations Fundamentals: Network Firewall: Protecting Communication and Data |
| Cyber Threat Intelligence Specialist | Collaborate with other team members and colleagues | Skill | Covered | Incident Response: Lessons Learned Meeting |
| Cyber Threat Intelligence Specialist | Collect, analyse and correlate cyber threat information originating from multiple sources | Skill | Covered | Threat Hunting: How to Approach an Investigation: The Threat Hunter's Mindset |
| Cyber Threat Intelligence Specialist | Identify threat actors TTPs and campaigns | Skill | Covered | Threat Hunting: Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Cyber Threat Intelligence Specialist | Automate threat intelligence management procedures | Skill | Partial | Security Operations Fundamentals: Threat Intelligence: Mitigating and Defending |
| Cyber Threat Intelligence Specialist | Conduct technical analysis and reporting | Skill | Covered | Incident Response: Incident Report |
| Cyber Threat Intelligence Specialist | Model threats, actors and TTPs | Skill | Covered | Threat Hunting: MITRE ATT&CK: Understanding How Attackers Operate |
| Cyber Threat Intelligence Specialist | Communicate, coordinate and cooperate with internal and external stakeholders | Skill | Covered | Incident Response: Effective Incident Communication Planning in IR |
| Cyber Threat Intelligence Specialist | Communicate, present and report to relevant stakeholders | Skill | Covered | Incident Response: Incident Report |
| Cyber Threat Intelligence Specialist | Use and apply CTI platforms and tools | Skill | Partial | Security Operations Fundamentals: Threat Intelligence: Mitigating and Defending |
| Cyber Threat Intelligence Specialist | Operating systems security | Knowledge | Covered | Threat Hunting: PowerShell Process Tracking and Command Line Auditing |
| Cyber Threat Intelligence Specialist | Computer networks security | Knowledge | Covered | Security Operations Fundamentals: Network Firewall: Protecting Communication and Data |
| Cyber Threat Intelligence Specialist | Cybersecurity controls and solutions | Knowledge | Covered | Security Operations Fundamentals: SOC Components: Tools and Technologies |
| Cyber Threat Intelligence Specialist | Computer programming | Knowledge | Covered | Malware Analysis: Exploring VBA Programming fundamentals |
| Cyber Threat Intelligence Specialist | Cyber Threat Intelligence (CTI) sharing standards, methodologies and frameworks | Knowledge | Partial | Security Operations Fundamentals: Threat Intelligence: Mitigating and Defending |
| Cyber Threat Intelligence Specialist | Cross-domain and border-domain knowledge related to cybersecurity | Knowledge | Partial | Incident Response: Incident Report |
| Cyber Threat Intelligence Specialist | Cyber threats | Knowledge | Covered | Threat Hunting: The Evolving Threat Landscape |
| Cyber Threat Intelligence Specialist | Cyber threat actors | Knowledge | Covered | Threat Hunting: Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Cyber Threat Intelligence Specialist | Cybersecurity attack procedures | Knowledge | Covered | Threat Hunting: MITRE ATT&CK: Mapping a Full Attack Scenario |
| Cyber Threat Intelligence Specialist | Advanced and persistent cyber threats (APT) | Knowledge | Covered | Threat Hunting: Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Cyber Threat Intelligence Specialist | Threat actors Tactics, Techniques and Procedures (TTPs) | Knowledge | Covered | Threat Hunting: MITRE ATT&CK: Understanding How Attackers Operate |