CyberDefenders certifications mapped to the NICE Framework
CCDL1 aligns to the NICE v2.2 Defensive Cybersecurity and Incident Response work roles. CCDL2 aligns to Incident Response and Digital Forensics. Both also cover part of Digital Evidence Analysis. Both certifications are listed in the NICCS Education and Training Catalog: CCDL1 and CCDL2.
Last reviewed: October 2026
What is the NICE Framework?
The NICE Framework is the US reference for describing cybersecurity work. NIST develops it, and it breaks work into roles, then each role into Task, Knowledge, and Skill statements.
Employers use it to write job descriptions, plan security teams, and choose training. The current version is v2.2.0.
Source: NICCS, NICE Framework
Which NICE work roles does CCDL1 align to?
CCDL1 aligns to Defensive Cybersecurity (PD-WRL-001) and Incident Response (PD-WRL-003), at a junior SOC analyst level.
The course teaches alert triage, packet analysis, SIEM correlation, phishing analysis, and first response. It also builds foundations for Digital Forensics and Digital Evidence Analysis, such as evidence acquisition, file signature analysis, and browser forensics.
CCDL1 is listed in the NICCS Education and Training Catalog.
Which NICE work roles does CCDL2 align to?
CCDL2 aligns to Incident Response (PD-WRL-003) and Digital Forensics (PD-WRL-002).
The course teaches threat hunting, timeline analysis, malware analysis, and disk, memory, and network forensics. It also covers much of Defensive Cybersecurity and parts of Digital Evidence Analysis.
CCDL2 is listed in the NICCS Education and Training Catalog.
How did we map CCDL1 and CCDL2 to NICE?
We scored every Task, Knowledge, and Skill statement in four NICE v2.2.0 work roles against the live, published lessons and labs of each course.
Each statement is marked Covered, Partially covered, or Not covered, with the lesson or lab that supports it. A statement is covered only when the course directly teaches or practices it. We also reviewed Threat Analysis and Vulnerability Analysis, which overlap with parts of the courses but were not scored. The mapping was captured in October 2026 and is reviewed yearly.
Statement wording: official NICE v2.2.0 components (NIST)
How can teams use this mapping?
- Write job descriptions that name the NICE role and the certification that builds it.
- Find skill gaps by role across a SOC team.
- Show managers and auditors which NICE roles your training covers.
Training a SOC team? See our cybersecurity training for teams and enterprises.
What NICE tasks, knowledge, and skills do the courses cover?
A sample of NICE v2.2.0 statements each course fully covers, with where they are taught.
| Statement ID | NICE statement | Type | Where it is taught |
|---|---|---|---|
| T0020 | Develop content for cyber defense tools | Task | CCDL1: Module 2, Write and Test Basic IDS Rules |
| T1084 | Identify anomalous network activity | Task | CCDL1: Module 2, Detect Port Scans |
| S0156 | Skill in performing packet-level analysis | Skill | CCDL1: Module 2, Capture and Analyze Traffic |
| T0167 | Perform file signature analysis | Task | CCDL1: Module 1, Email Threat Detection and Analysis |
| T0510 | Coordinate incident response functions | Task | CCDL2: Incident Response, Incident Communication Planning |
| T0173 | Perform timeline analysis | Task | CCDL2: Network Forensics, full attack chain |
| S0378 | Skill in decrypting information | Skill | CCDL2: Network Forensics, Endpoint Capture and TLS Decryption |
| K0068 | Knowledge of programming language structures and logic | Knowledge | CCDL2: Malware Analysis, VBA programming fundamentals |
View the full CCDL1 and CCDL2 NICE mapping
Roles: DC = Defensive Cybersecurity, IR = Incident Response, DF = Digital Forensics, DEA = Digital Evidence Analysis. Statements with no evidence in the live course are not listed.
CCDL1: 329 statements covered or partially covered
| ID | NICE statement | Type | Coverage | Roles | Where it is taught |
|---|---|---|---|---|---|
| T0020 | Develop content for cyber defense tools | Task | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| T0164 | Perform cyber defense trend analysis and reporting | Task | Partial | DC, IR | Module 3: SIEM |
| T0167 | Perform file signature analysis | Task | Covered | DEA, DF | Module 1: Phishing |
| T0168 | Perform data comparison against established database | Task | Covered | DEA, DF | Module 6: SOC Decision Method |
| T0172 | Perform real-time forensic analysis (e.g., using Helix in conjunction with LiveView) | Task | Partial | DEA, DF | Module 4: DFIR |
| T0173 | Perform timeline analysis | Task | Covered | DEA, DF | Module 4: DFIR |
| T0179 | Perform static media analysis | Task | Covered | DEA, DF | Module 4: DFIR |
| T0182 | Perform tier 1, 2, and 3 malware analysis | Task | Partial | DEA, DF | Module 1: Phishing |
| T0262 | Employ approved defense-in-depth principles and practices (e.g., defense-in-multiple places, layered defenses, security robustness) | Task | Partial | IR | Module 1: Phishing |
| T0292 | Recommend computing environment vulnerability corrections | Task | Partial | DC | Module 6: SOC Decision Method |
| T0299 | Identify network mapping and operating system (OS) fingerprinting activities | Task | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| T0397 | Perform Windows registry analysis | Task | Covered | DF | Module 4: DFIR |
| T0510 | Coordinate incident response functions | Task | Partial | IR | Module 6: SOC Decision Method |
| T1020 | Determine the operational and safety impacts of cybersecurity lapses | Task | Covered | DC, DF, IR | Module 6: SOC Decision Method |
| T1051 | Set up a forensic workstation | Task | Partial | DF | Module 4: DFIR |
| T1064 | Determine data specifications | Task | Partial | DEA | Module 6: SOC Decision Method |
| T1065 | Determine data capacity requirements | Task | Partial | DEA | Module 4: DFIR |
| T1084 | Identify anomalous network activity | Task | Covered | DC, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| T1085 | Identify potential threats to network resources | Task | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| T1090 | Determine best methods for identifying the perpetrator(s) of a network intrusion | Task | Partial | DEA, DF | Module 4: DFIR |
| T1102 | Identify intrusions | Task | Covered | DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| T1103 | Analyze intrusions | Task | Covered | DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| T1104 | Document what is known about intrusions | Task | Covered | DEA, DF | Module 6: SOC Decision Method |
| T1109 | Resolve cyber defense incidents | Task | Partial | IR | Module 2: Network Fundamentals & Threat Detection |
| T1112 | Validate network alerts | Task | Covered | DC | Module 5: Cloud Security |
| T1118 | Identify vulnerabilities | Task | Covered | DF, IR | Module 2: Network Fundamentals & Threat Detection |
| T1119 | Recommend vulnerability remediation strategies | Task | Partial | DC, DF, IR | Module 6: SOC Decision Method |
| T1120 | Create forensically sound duplicates of evidence | Task | Covered | DEA, DF | Module 4: DFIR |
| T1121 | Decrypt seized data | Task | Partial | DEA, DF | Module 1: Phishing |
| T1159 | Create technical summary of findings reports | Task | Covered | DEA, DF | Module 6: SOC Decision Method |
| T1176 | Determine if cybersecurity-enabled products reduce identified risk to acceptable levels | Task | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| T1177 | Determine if security control technologies reduce identified risk to acceptable levels | Task | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| T1191 | Determine relevance of recovered data | Task | Covered | DEA, DF | Module 6: SOC Decision Method |
| T1199 | Identify digital evidence for analysis | Task | Covered | DEA, DF | Module 6: SOC Decision Method |
| T1207 | Collect documentary or physical evidence of cyber intrusion incidents, investigations, and operations | Task | Covered | DEA | Module 4: DFIR |
| T1241 | Document cybersecurity incidents | Task | Covered | DC | Module 6: SOC Decision Method |
| T1242 | Escalate incidents that may cause ongoing and immediate impact to the environment | Task | Covered | DC | Module 6: SOC Decision Method |
| T1250 | Perform cyber defense incident triage | Task | Covered | IR | Module 6: SOC Decision Method |
| T1251 | Recommend incident remediation strategies | Task | Covered | IR | Module 6: SOC Decision Method |
| T1252 | Determine the scope, urgency, and impact of cyber defense incidents | Task | Covered | IR | Module 6: SOC Decision Method |
| T1254 | Determine the effectiveness of an observed attack | Task | Covered | DC | Module 5: Cloud Security |
| T1256 | Perform forensically sound image collection | Task | Covered | DEA, IR | Module 4: DFIR |
| T1257 | Recommend mitigation and remediation strategies for enterprise systems | Task | Partial | IR | Module 6: SOC Decision Method |
| T1260 | Perform real-time cyber defense incident handling | Task | Partial | DF, IR | Module 2: Network Fundamentals & Threat Detection |
| T1266 | Recommend risk mitigation strategies | Task | Partial | DC | Module 6: SOC Decision Method |
| T1278 | Recommend system modifications | Task | Partial | DC | Module 6: SOC Decision Method |
| T1282 | Prepare digital media for imaging | Task | Covered | DEA, DF | Module 4: DFIR |
| T1290 | Communicate daily network event and activity reports | Task | Partial | DC | Module 6: SOC Decision Method |
| T1299 | Determine causes of network alerts | Task | Covered | DC, IR | Module 5: Cloud Security |
| T1301 | Report forensic artifacts indicative of a particular operating system | Task | Covered | DEA, DF | Module 4: DFIR |
| T1315 | Track cyber defense incidents from initial detection through final resolution | Task | Partial | IR | Module 2: Network Fundamentals & Threat Detection |
| T1316 | Document cyber defense incidents from initial detection through final resolution | Task | Partial | IR | Module 2: Network Fundamentals & Threat Detection |
| T1322 | Capture network traffic associated with malicious activities | Task | Partial | DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| T1323 | Analyze network traffic associated with malicious activities | Task | Covered | DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| T1324 | Process digital evidence | Task | Covered | DEA, DF | Module 4: DFIR |
| T1325 | Document digital evidence | Task | Covered | DEA, DF | Module 4: DFIR |
| T1332 | Produce incident findings reports | Task | Covered | DEA, IR | Module 6: SOC Decision Method |
| T1333 | Communicate incident findings to appropriate constituencies | Task | Covered | IR | Module 6: SOC Decision Method |
| T1347 | Detect cybersecurity attacks and intrusions | Task | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| T1348 | Distinguish between benign and potentially malicious cybersecurity attacks and intrusions | Task | Covered | DC | Module 5: Cloud Security |
| T1349 | Communicate cybersecurity attacks and intrusions alerts | Task | Covered | DC | Module 6: SOC Decision Method |
| T1350 | Perform continuous monitoring of system activity | Task | Partial | DC | Module 3: SIEM |
| T1351 | Determine impact of malicious activity on systems and information | Task | Covered | DC | Module 5: Cloud Security |
| T1370 | Collect intrusion artifacts | Task | Covered | DEA, DF, IR | Module 4: DFIR |
| T1371 | Mitigate potential cyber defense incidents | Task | Covered | DF, IR | Module 2: Network Fundamentals & Threat Detection |
| T1381 | Scan digital media for viruses | Task | Partial | DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| T1383 | Utilize deployable forensics toolkit | Task | Covered | DEA, DF | Module 4: DFIR |
| T1386 | Analyze network traffic anomalies | Task | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| T1387 | Validate intrusion detection system alerts | Task | Covered | DC, DF | Module 2: Network Fundamentals & Threat Detection |
| T1388 | Isolate malware | Task | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| T1389 | Remove malware | Task | Partial | DC | Module 1: Phishing |
| T1390 | Identify network device applications and operating systems | Task | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| T1391 | Reconstruct malicious attacks | Task | Covered | DC | Module 4: DFIR |
| T1406 | Construct cyber defense network tool signatures | Task | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| T1407 | Correlate threat assessment data | Task | Covered | DF, IR | Module 6: SOC Decision Method |
| T1428 | Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cybersecurity incidents | Task | Covered | DC | Module 6: SOC Decision Method |
| T1485 | Prepare after action reviews (AARs) | Task | Partial | IR | Module 6: SOC Decision Method |
| T1486 | Process forensic images | Task | Covered | DEA, DF | Module 4: DFIR |
| T1487 | Perform file and registry monitoring on running systems | Task | Partial | DF | Module 2: Network Fundamentals & Threat Detection |
| T1488 | Enter digital media information into tracking databases | Task | Partial | DF | Module 4: DFIR |
| T1489 | Correlate incident data | Task | Covered | DF, IR | Module 4: DFIR |
| T1490 | Prepare cyber defense toolkits | Task | Partial | DF | Module 4: DFIR |
| T1510 | Preserve digital evidence | Task | Covered | DF | Module 4: DFIR |
| T1516 | Detect concealed data | Task | Covered | DEA | Module 4: DFIR |
| T1539 | Analyze organizational cybersecurity posture trends | Task | Partial | DC | Module 3: SIEM |
| T1540 | Develop organizational cybersecurity posture trend reports | Task | Partial | DC | Module 3: SIEM |
| T1541 | Develop system security posture trend reports | Task | Partial | DC | Module 3: SIEM |
| T1542 | Document original condition of digital evidence | Task | Covered | DEA | Module 4: DFIR |
| T1548 | Determine adequacy of access controls | Task | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| T1582 | Maintain currency of cyber defense threat conditions | Task | Partial | DC, IR | Module 6: SOC Decision Method |
| T1583 | Determine effectiveness of system implementation and testing processes | Task | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| T1603 | Recommend threat and vulnerability risk mitigation strategies | Task | Partial | DC | Module 6: SOC Decision Method |
| T1607 | Recover information from forensic data sources | Task | Covered | DEA, DF | Module 4: DFIR |
| T1615 | Advise stakeholders on vulnerability compliance | Task | Partial | DC | Module 6: SOC Decision Method |
| T1616 | Resolve computer security incidents | Task | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| T1617 | Prepare cyber defense reports | Task | Covered | DF, IR | Module 6: SOC Decision Method |
| T2012 | Check network connections | Task | Covered | DEA | Module 4: DFIR |
| T2013 | Look for indicators of intrusions | Task | Covered | DEA | Module 2: Network Fundamentals & Threat Detection |
| T2014 | Identify devices and networks on scene | Task | Partial | DEA | Module 4: DFIR |
| T2016 | Identify areas of compromise | Task | Covered | DEA | Module 2: Network Fundamentals & Threat Detection |
| T2017 | Acquire digital evidence | Task | Covered | DEA | Module 4: DFIR |
| T2018 | Create a digital footprint of raw or physical data | Task | Covered | DEA | Module 4: DFIR |
| T2019 | Process data into readable format | Task | Covered | DEA | Module 4: DFIR |
| T2020 | Prepare data for ingestion into application systems | Task | Partial | DEA | Module 3: SIEM |
| T2021 | Recover deleted or overwritten data files | Task | Partial | DEA | Module 4: DFIR |
| K0068 | Knowledge of programming language structures and logic | Knowledge | Partial | DC | Module 3: SIEM |
| K0635 | Knowledge of decryption | Knowledge | Partial | DF | Module 4: DFIR |
| K0636 | Knowledge of decryption tools and techniques | Knowledge | Covered | DF | Module 1: Phishing |
| K0637 | Knowledge of data repositories | Knowledge | Partial | DF | Module 4: DFIR |
| K0674 | Knowledge of computer networking protocols | Knowledge | Covered | DC, DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| K0675 | Knowledge of risk management processes | Knowledge | Partial | DC, DEA, DF, IR | Module 6: SOC Decision Method |
| K0676 | Knowledge of cybersecurity laws and regulations | Knowledge | Partial | DC, DEA, DF, IR | Module 6: SOC Decision Method |
| K0677 | Knowledge of cybersecurity policies and procedures | Knowledge | Covered | DC, DEA, DF, IR | Module 1: Phishing |
| K0678 | Knowledge of privacy laws and regulations | Knowledge | Partial | DC, DEA, DF, IR | Module 6: SOC Decision Method |
| K0680 | Knowledge of cybersecurity principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Module 6: SOC Decision Method |
| K0681 | Knowledge of privacy principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Module 1: Phishing |
| K0682 | Knowledge of cybersecurity threats | Knowledge | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K0683 | Knowledge of cybersecurity vulnerabilities | Knowledge | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K0684 | Knowledge of cybersecurity threat characteristics | Knowledge | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K0685 | Knowledge of access control principles and practices | Knowledge | Covered | DC, IR | Module 5: Cloud Security |
| K0686 | Knowledge of authentication and authorization tools and techniques | Knowledge | Covered | DC, IR | Module 5: Cloud Security |
| K0689 | Knowledge of network infrastructure principles and practices | Knowledge | Partial | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0691 | Knowledge of cyber defense tools and techniques | Knowledge | Covered | DC | Module 6: SOC Decision Method |
| K0694 | Knowledge of computer algorithm capabilities and applications | Knowledge | Partial | DC | Module 3: SIEM |
| K0696 | Knowledge of digital forensic data principles and practices | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0697 | Knowledge of encryption algorithm capabilities and applications | Knowledge | Partial | DEA, DF | Module 4: DFIR |
| K0698 | Knowledge of cryptographic key management principles and practices | Knowledge | Partial | DC | Module 4: DFIR |
| K0707 | Knowledge of database systems and software | Knowledge | Partial | DC | Module 4: DFIR |
| K0710 | Knowledge of enterprise cybersecurity architecture principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Module 6: SOC Decision Method |
| K0716 | Knowledge of host access control (HAC) systems and software | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0718 | Knowledge of network communications principles and practices | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0724 | Knowledge of incident response principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Module 1: Phishing |
| K0725 | Knowledge of incident response tools and techniques | Knowledge | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K0726 | Knowledge of incident handling tools and techniques | Knowledge | Covered | DC, DEA, DF, IR | Module 1: Phishing |
| K0728 | Knowledge of Confidentiality, Integrity and Availability (CIA) principles and practices | Knowledge | Partial | DC | Module 6: SOC Decision Method |
| K0730 | Knowledge of cyber safety principles and practices | Knowledge | Covered | DC | Module 6: SOC Decision Method |
| K0732 | Knowledge of intrusion detection tools and techniques | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0736 | Knowledge of information technology (IT) security principles and practices | Knowledge | Covered | DC | Module 6: SOC Decision Method |
| K0742 | Knowledge of identity and access management (IAM) principles and practices | Knowledge | Covered | DC | Module 5: Cloud Security |
| K0743 | Knowledge of new and emerging technologies | Knowledge | Partial | DC | Module 5: Cloud Security |
| K0744 | Knowledge of operating system (OS) systems and software | Knowledge | Covered | DC, DEA, DF | Module 4: DFIR |
| K0746 | Knowledge of policy-based access controls | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0747 | Knowledge of Risk Adaptive (Adaptable) Access Controls (RAdAC) | Knowledge | Partial | DC, IR | Module 5: Cloud Security |
| K0751 | Knowledge of system threats | Knowledge | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K0752 | Knowledge of system vulnerabilities | Knowledge | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K0756 | Knowledge of security management principles and practices | Knowledge | Partial | DC | Module 1: Phishing |
| K0758 | Knowledge of server administration principles and practices | Knowledge | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| K0759 | Knowledge of client and server architecture | Knowledge | Covered | DC, DEA, DF | Module 1: Phishing |
| K0760 | Knowledge of server diagnostic tools and techniques | Knowledge | Partial | DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| K0770 | Knowledge of system administration principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K0772 | Knowledge of systems testing and evaluation tools and techniques | Knowledge | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| K0773 | Knowledge of telecommunications principles and practices | Knowledge | Partial | DC | Module 1: Phishing |
| K0778 | Knowledge of enterprise information technology (IT) architecture principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Module 6: SOC Decision Method |
| K0781 | Knowledge of virtual private network (VPN) systems and software | Knowledge | Partial | DC | Module 5: Cloud Security |
| K0783 | Knowledge of network attack characteristics | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0785 | Knowledge of insider threat tools and techniques | Knowledge | Partial | DC | Module 4: DFIR |
| K0786 | Knowledge of physical computer components | Knowledge | Partial | DEA, DF | Module 4: DFIR |
| K0788 | Knowledge of adversarial tactics principles and practices | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K0789 | Knowledge of adversarial tactics tools and techniques | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K0791 | Knowledge of defense-in-depth principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Module 1: Phishing |
| K0792 | Knowledge of network configurations | Knowledge | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| K0793 | Knowledge of file extensions | Knowledge | Covered | DC, DEA, DF | Module 1: Phishing |
| K0794 | Knowledge of file system implementation principles and practices | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0795 | Knowledge of digital evidence seizure policies and procedures | Knowledge | Partial | DEA, DF | Module 4: DFIR |
| K0796 | Knowledge of digital evidence preservation policies and procedures | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0797 | Knowledge of ethical hacking tools and techniques | Knowledge | Partial | DEA, DF | Module 1: Phishing |
| K0800 | Knowledge of evidence admissibility laws and regulations | Knowledge | Partial | DEA, DF | Module 4: DFIR |
| K0802 | Knowledge of chain of custody policies and procedures | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0804 | Knowledge of persistent data principles and practices | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0805 | Knowledge of command-line tools and techniques | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K0806 | Knowledge of machine virtualization tools and techniques | Knowledge | Partial | DEA, DF | Course Introduction |
| K0808 | Knowledge of system file characteristics | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0809 | Knowledge of digital forensics data characteristics | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0810 | Knowledge of deployable forensics principles and practices | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0812 | Knowledge of digital communication systems and software | Knowledge | Partial | DC, DEA, DF | Module 1: Phishing |
| K0813 | Knowledge of interpreted and compiled programming language characteristics | Knowledge | Partial | DC | Module 1: Phishing |
| K0817 | Knowledge of event correlation tools and techniques | Knowledge | Covered | DF | Module 3: SIEM |
| K0829 | Knowledge of account creation policies and procedures | Knowledge | Partial | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0830 | Knowledge of password policies and procedures | Knowledge | Partial | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0831 | Knowledge of network attack vectors | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K0832 | Knowledge of cyberattack characteristics | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0833 | Knowledge of cyberattack actor characteristics | Knowledge | Partial | DC, IR | Module 4: DFIR |
| K0837 | Knowledge of hardening tools and techniques | Knowledge | Partial | DC, DEA, DF, IR | Module 6: SOC Decision Method |
| K0842 | Knowledge of software reverse engineering tools and techniques | Knowledge | Partial | DC, DEA, DF | Module 1: Phishing |
| K0844 | Knowledge of cyber attack stages | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0845 | Knowledge of cyber intrusion activity phases | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0848 | Knowledge of network systems management principles and practices | Knowledge | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| K0849 | Knowledge of network systems management tools and techniques | Knowledge | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| K0850 | Knowledge of data carving tools and techniques | Knowledge | Partial | DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| K0851 | Knowledge of reverse engineering principles and practices | Knowledge | Partial | DC, DEA, DF | Module 1: Phishing |
| K0852 | Knowledge of anti-forensics tools and techniques | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0855 | Knowledge of debugging tools and techniques | Knowledge | Partial | DEA, DF | Module 1: Phishing |
| K0856 | Knowledge of filename extension abuse | Knowledge | Covered | DEA, DF | Module 1: Phishing |
| K0857 | Knowledge of malware analysis tools and techniques | Knowledge | Covered | DEA, DF, IR | Module 1: Phishing |
| K0859 | Knowledge of encryption tools and techniques | Knowledge | Partial | DC, DEA, DF | Module 4: DFIR |
| K0860 | Knowledge of malware signature principles and practices | Knowledge | Covered | DC | Module 1: Phishing |
| K0861 | Knowledge of network port capabilities and applications | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K0865 | Knowledge of data classification standards and best practices | Knowledge | Partial | IR | Module 6: SOC Decision Method |
| K0878 | Knowledge of network firewall principles and practices | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K0879 | Knowledge of industry cybersecurity models and frameworks | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K0880 | Knowledge of access control models and frameworks | Knowledge | Covered | DC | Module 5: Cloud Security |
| K0892 | Knowledge of cyber defense laws and regulations | Knowledge | Partial | DC, DEA, DF | Module 6: SOC Decision Method |
| K0898 | Knowledge of cloud service models and frameworks | Knowledge | Covered | IR | Module 5: Cloud Security |
| K0911 | Knowledge of remote access tools and techniques | Knowledge | Partial | DEA | Module 2: Network Fundamentals & Threat Detection |
| K0914 | Knowledge of binary analysis tools and techniques | Knowledge | Partial | DEA, DF | Module 1: Phishing |
| K0915 | Knowledge of network architecture principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K0916 | Knowledge of malware analysis principles and practices | Knowledge | Covered | DEA, DF, IR | Module 1: Phishing |
| K0917 | Knowledge of Personally Identifiable Information (PII) data security standards and best practices | Knowledge | Partial | DC | Module 6: SOC Decision Method |
| K0918 | Knowledge of Payment Card Industry (PCI) data security standards and best practices | Knowledge | Partial | DC | Module 6: SOC Decision Method |
| K0923 | Knowledge of operating system structures and internals | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K0924 | Knowledge of network analysis tools and techniques | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0934 | Knowledge of data classification policies and procedures | Knowledge | Partial | IR | Module 6: SOC Decision Method |
| K0937 | Knowledge of countermeasure design principles and practices | Knowledge | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| K0938 | Knowledge of network mapping principles and practices | Knowledge | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| K0939 | Knowledge of packet-level analysis tools and techniques | Knowledge | Covered | DC, DF | Module 2: Network Fundamentals & Threat Detection |
| K0941 | Knowledge of data concealment tools and techniques | Knowledge | Covered | DEA | Module 4: DFIR |
| K0942 | Knowledge of cryptology principles and practices | Knowledge | Partial | DC | Module 4: DFIR |
| K0950 | Knowledge of Intrusion Detection System (IDS) tools and techniques | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K0955 | Knowledge of penetration testing principles and practices | Knowledge | Partial | DC | Module 1: Phishing |
| K0956 | Knowledge of penetration testing tools and techniques | Knowledge | Partial | DC | Module 1: Phishing |
| K0969 | Knowledge of cyber-attack tools and techniques | Knowledge | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| K0979 | Knowledge of information searching tools and techniques | Knowledge | Covered | DEA, DF | Module 6: SOC Decision Method |
| K0980 | Knowledge of intelligence collection sources | Knowledge | Covered | DF | Module 6: SOC Decision Method |
| K0983 | Knowledge of computer networking principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K1004 | Knowledge of reporting policies and procedures | Knowledge | Covered | DEA, DF | Module 1: Phishing |
| K1014 | Knowledge of network security principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K1016 | Knowledge of code obfuscation tools and techniques | Knowledge | Covered | DEA, DF | Module 1: Phishing |
| K1055 | Knowledge of digital forensics principles and practices | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1069 | Knowledge of virtual machine tools and technologies | Knowledge | Partial | DEA, DF | Course Introduction |
| K1079 | Knowledge of web application security risks | Knowledge | Partial | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| K1089 | Knowledge of protocol analyzer tools and techniques | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K1091 | Knowledge of media forensics | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1092 | Knowledge of digital forensics tools and techniques | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1115 | Knowledge of Chain of Custody (CoC) processes and procedures | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1131 | Knowledge of cyber defense monitoring tools | Knowledge | Covered | DC | Module 3: SIEM |
| K1132 | Knowledge of cyber defense system analysis tools | Knowledge | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| K1144 | Knowledge of data correlation tools and techniques | Knowledge | Covered | DC | Module 3: SIEM |
| K1145 | Knowledge of data encryption practices and principles | Knowledge | Partial | DEA | Module 4: DFIR |
| K1147 | Knowledge of data integrity principles and practices | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1151 | Knowledge of digital evidence cataloging tools and techniques | Knowledge | Partial | DEA, DF | Module 4: DFIR |
| K1152 | Knowledge of digital evidence extraction tools and techniques | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1153 | Knowledge of digital evidence handling principles and practices | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1155 | Knowledge of digital evidence preservation tools and techniques | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1163 | Knowledge of forensic image processing tools and techniques | Knowledge | Covered | DEA, DF | Module 4: DFIR |
| K1168 | Knowledge of intrusion set tools and techniques | Knowledge | Partial | DC | Module 6: SOC Decision Method |
| K1175 | Knowledge of network monitoring tools and techniques | Knowledge | Covered | DEA, DF | Module 3: SIEM |
| K1176 | Knowledge of network topologies | Knowledge | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| K1181 | Knowledge of organizational cybersecurity incident response plans | Knowledge | Covered | DC | Module 1: Phishing |
| K1193 | Knowledge of packet analysis tools and techniques | Knowledge | Covered | DC, DF | Module 2: Network Fundamentals & Threat Detection |
| K1280 | Knowledge of approved data processing tools and techniques | Knowledge | Partial | DEA | Module 4: DFIR |
| K1281 | Knowledge of data types and characteristics | Knowledge | Covered | DEA | Module 4: DFIR |
| S0077 | Skill in securing network communications | Skill | Partial | IR | Module 2: Network Fundamentals & Threat Detection |
| S0080 | Skill in performing damage assessments | Skill | Covered | IR | Module 5: Cloud Security |
| S0156 | Skill in performing packet-level analysis | Skill | Covered | DC, DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| S0378 | Skill in decrypting information | Skill | Covered | DEA, DF | Module 1: Phishing |
| S0385 | Skill in communicating complex concepts | Skill | Covered | DEA | Module 6: SOC Decision Method |
| S0431 | Skill in applying critical thinking | Skill | Covered | DEA | Module 6: SOC Decision Method |
| S0474 | Skill in finding system files | Skill | Covered | DF | Module 4: DFIR |
| S0475 | Skill in recognizing digital forensics data | Skill | Covered | DF | Module 4: DFIR |
| S0476 | Skill in identifying filename extension abuse | Skill | Covered | DEA, DF | Module 1: Phishing |
| S0483 | Skill in identifying software communications vulnerabilities | Skill | Partial | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| S0490 | Skill in recreating network topologies | Skill | Partial | DC | Module 6: SOC Decision Method |
| S0491 | Skill in processing digital forensic data | Skill | Covered | DF | Module 4: DFIR |
| S0499 | Skill in performing intelligence collection analysis | Skill | Partial | DEA, DF | Module 6: SOC Decision Method |
| S0544 | Skill in recognizing vulnerabilities | Skill | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| S0547 | Skill in identifying malware | Skill | Covered | IR | Module 1: Phishing |
| S0548 | Skill in capturing malware | Skill | Covered | IR | Module 2: Network Fundamentals & Threat Detection |
| S0549 | Skill in containing malware | Skill | Covered | IR | Module 2: Network Fundamentals & Threat Detection |
| S0550 | Skill in reporting malware | Skill | Covered | IR | Module 4: DFIR |
| S0566 | Skill in developing signatures | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0567 | Skill in deploying signatures | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0572 | Skill in detecting host- and network-based intrusions | Skill | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| S0574 | Skill in developing security system controls | Skill | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| S0578 | Skill in evaluating security designs | Skill | Partial | DC | Module 2: Network Fundamentals & Threat Detection |
| S0579 | Skill in preparing reports | Skill | Covered | DEA, DF | Module 6: SOC Decision Method |
| S0589 | Skill in preserving digital evidence integrity | Skill | Covered | DEA, DF, IR | Module 4: DFIR |
| S0593 | Skill in handling incidents | Skill | Covered | DC | Module 6: SOC Decision Method |
| S0599 | Skill in performing memory dump analysis | Skill | Covered | DEA, DF | Module 4: DFIR |
| S0600 | Skill in collecting relevant data from a variety of sources | Skill | Covered | DC | Module 4: DFIR |
| S0603 | Skill in identifying forensics data in diverse media | Skill | Covered | DF | Module 4: DFIR |
| S0604 | Skill in extracting forensics data in diverse media | Skill | Covered | DF | Module 4: DFIR |
| S0605 | Skill in storing digital evidence | Skill | Covered | DEA, DF | Module 1: Phishing |
| S0606 | Skill in manipulating operating system components | Skill | Partial | DEA, DF | Module 2: Network Fundamentals & Threat Detection |
| S0607 | Skill in collecting digital evidence | Skill | Covered | DEA, DF, IR | Module 4: DFIR |
| S0608 | Skill in processing digital evidence | Skill | Covered | DEA, DF, IR | Module 4: DFIR |
| S0612 | Skill in performing digital forensics analysis | Skill | Covered | DEA, DF | Module 4: DFIR |
| S0614 | Skill in categorizing types of vulnerabilities | Skill | Partial | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| S0615 | Skill in protecting a network against malware | Skill | Partial | IR | Module 2: Network Fundamentals & Threat Detection |
| S0621 | Skill in performing binary analysis | Skill | Partial | DF | Module 1: Phishing |
| S0622 | Skill in implementing one-way hash functions | Skill | Covered | DEA, DF | Module 4: DFIR |
| S0623 | Skill in performing source code analysis | Skill | Partial | DEA, DF | Module 1: Phishing |
| S0624 | Skill in performing volatile data analysis | Skill | Covered | DEA, DF | Module 4: DFIR |
| S0625 | Skill in interpreting debugger results | Skill | Partial | DEA, DF | Module 1: Phishing |
| S0627 | Skill in reading signatures | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0651 | Skill in performing malware analysis | Skill | Covered | DC, DEA, DF, IR | Module 1: Phishing |
| S0653 | Skill in creating digital evidence copies | Skill | Covered | DF | Module 4: DFIR |
| S0667 | Skill in assessing security controls | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0678 | Skill in administering operating systems | Skill | Partial | DF | Module 2: Network Fundamentals & Threat Detection |
| S0688 | Skill in performing network data analysis | Skill | Covered | DC, IR | Module 2: Network Fundamentals & Threat Detection |
| S0712 | Skill in evaluating data source quality | Skill | Covered | DC | Module 6: SOC Decision Method |
| S0755 | Skill in reconstructing a network | Skill | Partial | DC | Module 6: SOC Decision Method |
| S0805 | Skill in designing incident responses | Skill | Partial | IR | Module 6: SOC Decision Method |
| S0806 | Skill in performing incident responses | Skill | Covered | IR | Module 6: SOC Decision Method |
| S0809 | Skill in utilizing cyber defense service provider information | Skill | Partial | DC | Module 6: SOC Decision Method |
| S0821 | Skill in collaborating with internal and external stakeholders | Skill | Partial | DF, IR | Module 6: SOC Decision Method |
| S0838 | Skill in identifying anomalous activities | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0839 | Skill in identifying exploited system weaknesses | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0840 | Skill in identifying misuse activities | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0846 | Skill in monitoring system activity | Skill | Covered | DC | Module 3: SIEM |
| S0854 | Skill in performing data analysis | Skill | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| S0856 | Skill in performing digital evidence analysis | Skill | Covered | DEA, DF | Module 4: DFIR |
| S0857 | Skill in performing dynamic analysis | Skill | Partial | DC, DEA, DF | Module 1: Phishing |
| S0859 | Skill in performing event correlation | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0860 | Skill in performing file system forensic analysis | Skill | Covered | DEA, DF | Module 4: DFIR |
| S0863 | Skill in performing incident analysis | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0866 | Skill in performing log file analysis | Skill | Covered | DC, DEA, DF, IR | Module 2: Network Fundamentals & Threat Detection |
| S0867 | Skill in performing malicious activity analysis | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0869 | Skill in performing metadata analysis | Skill | Covered | DC | Module 4: DFIR |
| S0872 | Skill in performing network data flow analysis | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0874 | Skill in performing network traffic analysis | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0875 | Skill in performing network traffic packet analysis | Skill | Covered | DC, DF | Module 2: Network Fundamentals & Threat Detection |
| S0882 | Skill in performing static analysis | Skill | Covered | DF | Module 4: DFIR |
| S0884 | Skill in performing static malware analysis | Skill | Covered | DEA, DF | Module 1: Phishing |
| S0885 | Skill in performing system activity analysis | Skill | Covered | DC | Module 2: Network Fundamentals & Threat Detection |
| S0892 | Skill in performing trend analysis | Skill | Partial | DC | Module 3: SIEM |
| S0935 | Skill in live acquisition | Skill | Covered | DEA | Module 4: DFIR |
| S0936 | Skill in deadbox acquisition | Skill | Covered | DEA | Module 4: DFIR |
| S0937 | Skill in inspecting data for ingestion | Skill | Partial | DEA | Module 3: SIEM |
| S0938 | Skill in interacting with live systems to identify active and historical networks | Skill | Covered | DEA | Module 4: DFIR |
CCDL2: 362 statements covered or partially covered
| ID | NICE statement | Type | Coverage | Roles | Where it is taught |
|---|---|---|---|---|---|
| T0020 | Develop content for cyber defense tools | Task | Covered | DC | Incident Response |
| T0164 | Perform cyber defense trend analysis and reporting | Task | Partial | DC, IR | Threat Hunting |
| T0167 | Perform file signature analysis | Task | Partial | DEA, DF | Malware Analysis |
| T0168 | Perform data comparison against established database | Task | Covered | DEA, DF | Malware Analysis |
| T0172 | Perform real-time forensic analysis (e.g., using Helix in conjunction with LiveView) | Task | Partial | DEA, DF | Incident Response |
| T0173 | Perform timeline analysis | Task | Covered | DEA, DF | Network Forensics |
| T0179 | Perform static media analysis | Task | Covered | DEA, DF | Disk Forensics |
| T0182 | Perform tier 1, 2, and 3 malware analysis | Task | Partial | DEA, DF | Malware Analysis |
| T0262 | Employ approved defense-in-depth principles and practices (e.g., defense-in-multiple places, layered defenses, security robustness) | Task | Covered | IR | Incident Response |
| T0292 | Recommend computing environment vulnerability corrections | Task | Covered | DC | Security Operations Fundamentals |
| T0299 | Identify network mapping and operating system (OS) fingerprinting activities | Task | Covered | DC | Network Forensics |
| T0397 | Perform Windows registry analysis | Task | Covered | DF | Disk Forensics |
| T0510 | Coordinate incident response functions | Task | Covered | IR | Incident Response |
| T1020 | Determine the operational and safety impacts of cybersecurity lapses | Task | Partial | DC, DF, IR | Incident Response |
| T1021 | Review cyber defense service provider reporting structure | Task | Partial | DC | Security Operations Fundamentals |
| T1051 | Set up a forensic workstation | Task | Partial | DF | Forensics Evidence Collection |
| T1064 | Determine data specifications | Task | Partial | DEA | Incident Response |
| T1065 | Determine data capacity requirements | Task | Covered | DEA | Forensics Evidence Collection |
| T1084 | Identify anomalous network activity | Task | Covered | DC, DF, IR | Network Forensics |
| T1085 | Identify potential threats to network resources | Task | Covered | DC, IR | Network Forensics |
| T1090 | Determine best methods for identifying the perpetrator(s) of a network intrusion | Task | Partial | DEA, DF | Threat Hunting |
| T1102 | Identify intrusions | Task | Covered | DEA, DF | Active Directory Attack and Defense |
| T1103 | Analyze intrusions | Task | Covered | DEA, DF | Active Directory Attack and Defense |
| T1104 | Document what is known about intrusions | Task | Covered | DEA, DF | Incident Response |
| T1109 | Resolve cyber defense incidents | Task | Covered | IR | Incident Response |
| T1110 | Coordinate technical support to enterprise-wide cybersecurity defense technicians | Task | Partial | IR | Security Operations Fundamentals |
| T1112 | Validate network alerts | Task | Covered | DC | Incident Response |
| T1118 | Identify vulnerabilities | Task | Covered | DF, IR | Security Operations Fundamentals |
| T1119 | Recommend vulnerability remediation strategies | Task | Covered | DC, DF, IR | Security Operations Fundamentals |
| T1120 | Create forensically sound duplicates of evidence | Task | Covered | DEA, DF | Forensics Evidence Collection |
| T1121 | Decrypt seized data | Task | Partial | DEA, DF | Network Forensics |
| T1159 | Create technical summary of findings reports | Task | Covered | DEA, DF | Incident Response |
| T1176 | Determine if cybersecurity-enabled products reduce identified risk to acceptable levels | Task | Partial | DC | Security Operations Fundamentals |
| T1177 | Determine if security control technologies reduce identified risk to acceptable levels | Task | Partial | DC | Security Operations Fundamentals |
| T1191 | Determine relevance of recovered data | Task | Covered | DEA, DF | Threat Hunting |
| T1199 | Identify digital evidence for analysis | Task | Covered | DEA, DF | Disk Forensics |
| T1207 | Collect documentary or physical evidence of cyber intrusion incidents, investigations, and operations | Task | Covered | DEA | Incident Response |
| T1241 | Document cybersecurity incidents | Task | Covered | DC | Incident Response |
| T1242 | Escalate incidents that may cause ongoing and immediate impact to the environment | Task | Covered | DC | Threat Hunting |
| T1250 | Perform cyber defense incident triage | Task | Covered | IR | Incident Response |
| T1251 | Recommend incident remediation strategies | Task | Covered | IR | Incident Response |
| T1252 | Determine the scope, urgency, and impact of cyber defense incidents | Task | Covered | IR | Incident Response |
| T1253 | Perform dynamic analysis on drives | Task | Partial | DEA, DF | Forensics Evidence Collection |
| T1254 | Determine the effectiveness of an observed attack | Task | Covered | DC | Active Directory Attack and Defense |
| T1256 | Perform forensically sound image collection | Task | Covered | DEA, IR | Forensics Evidence Collection |
| T1257 | Recommend mitigation and remediation strategies for enterprise systems | Task | Covered | IR | Security Operations Fundamentals |
| T1260 | Perform real-time cyber defense incident handling | Task | Partial | DF, IR | Incident Response |
| T1266 | Recommend risk mitigation strategies | Task | Covered | DC | Security Operations Fundamentals |
| T1278 | Recommend system modifications | Task | Covered | DC | Security Operations Fundamentals |
| T1282 | Prepare digital media for imaging | Task | Covered | DEA, DF | Forensics Evidence Collection |
| T1290 | Communicate daily network event and activity reports | Task | Partial | DC | Incident Response |
| T1299 | Determine causes of network alerts | Task | Covered | DC, IR | Incident Response |
| T1301 | Report forensic artifacts indicative of a particular operating system | Task | Partial | DEA, DF | Disk Forensics |
| T1315 | Track cyber defense incidents from initial detection through final resolution | Task | Covered | IR | Incident Response |
| T1316 | Document cyber defense incidents from initial detection through final resolution | Task | Covered | IR | Incident Response |
| T1322 | Capture network traffic associated with malicious activities | Task | Covered | DEA, DF | Network Forensics |
| T1323 | Analyze network traffic associated with malicious activities | Task | Covered | DEA, DF | Network Forensics |
| T1324 | Process digital evidence | Task | Covered | DEA, DF | Forensics Evidence Collection |
| T1325 | Document digital evidence | Task | Covered | DEA, DF | Incident Response |
| T1332 | Produce incident findings reports | Task | Covered | DEA, IR | Incident Response |
| T1333 | Communicate incident findings to appropriate constituencies | Task | Covered | IR | Incident Response |
| T1347 | Detect cybersecurity attacks and intrusions | Task | Covered | DC | Active Directory Attack and Defense |
| T1348 | Distinguish between benign and potentially malicious cybersecurity attacks and intrusions | Task | Covered | DC | Active Directory Attack and Defense |
| T1349 | Communicate cybersecurity attacks and intrusions alerts | Task | Covered | DC | Threat Hunting |
| T1350 | Perform continuous monitoring of system activity | Task | Covered | DC | Threat Hunting |
| T1351 | Determine impact of malicious activity on systems and information | Task | Covered | DC | Incident Response |
| T1370 | Collect intrusion artifacts | Task | Covered | DEA, DF, IR | Incident Response |
| T1371 | Mitigate potential cyber defense incidents | Task | Covered | DF, IR | Incident Response |
| T1381 | Scan digital media for viruses | Task | Covered | DEA, DF | Malware Analysis |
| T1382 | Mount a drive image | Task | Covered | DEA, DF | Forensics Evidence Collection |
| T1383 | Utilize deployable forensics toolkit | Task | Covered | DEA, DF | Forensics Evidence Collection |
| T1384 | Establish intrusion set procedures | Task | Partial | DC | Threat Hunting |
| T1386 | Analyze network traffic anomalies | Task | Covered | DC | Network Forensics |
| T1387 | Validate intrusion detection system alerts | Task | Covered | DC, DF | Incident Response |
| T1388 | Isolate malware | Task | Covered | DC | Incident Response |
| T1389 | Remove malware | Task | Covered | DC | Incident Response |
| T1390 | Identify network device applications and operating systems | Task | Covered | DC | Network Forensics |
| T1391 | Reconstruct malicious attacks | Task | Covered | DC | Network Forensics |
| T1406 | Construct cyber defense network tool signatures | Task | Covered | DC | Incident Response |
| T1407 | Correlate threat assessment data | Task | Covered | DF, IR | Security Operations Fundamentals |
| T1428 | Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cybersecurity incidents | Task | Covered | DC | Threat Hunting |
| T1485 | Prepare after action reviews (AARs) | Task | Covered | IR | Incident Response |
| T1486 | Process forensic images | Task | Covered | DEA, DF | Forensics Evidence Collection |
| T1487 | Perform file and registry monitoring on running systems | Task | Covered | DF | Malware Analysis |
| T1488 | Enter digital media information into tracking databases | Task | Partial | DF | Incident Response |
| T1489 | Correlate incident data | Task | Covered | DF, IR | Threat Hunting |
| T1490 | Prepare cyber defense toolkits | Task | Partial | DF | Incident Response |
| T1510 | Preserve digital evidence | Task | Covered | DF | Forensics Evidence Collection |
| T1516 | Detect concealed data | Task | Covered | DEA | Memory Forensics |
| T1539 | Analyze organizational cybersecurity posture trends | Task | Partial | DC | Threat Hunting |
| T1540 | Develop organizational cybersecurity posture trend reports | Task | Partial | DC | Threat Hunting |
| T1541 | Develop system security posture trend reports | Task | Partial | DC | Threat Hunting |
| T1542 | Document original condition of digital evidence | Task | Partial | DEA | Incident Response |
| T1548 | Determine adequacy of access controls | Task | Covered | DC | Security Operations Fundamentals |
| T1582 | Maintain currency of cyber defense threat conditions | Task | Covered | DC, IR | Security Operations Fundamentals |
| T1583 | Determine effectiveness of system implementation and testing processes | Task | Partial | DC | Incident Response |
| T1603 | Recommend threat and vulnerability risk mitigation strategies | Task | Covered | DC | Security Operations Fundamentals |
| T1607 | Recover information from forensic data sources | Task | Covered | DEA, DF | Disk Forensics |
| T1615 | Advise stakeholders on vulnerability compliance | Task | Partial | DC | Security Operations Fundamentals |
| T1616 | Resolve computer security incidents | Task | Covered | DC | Incident Response |
| T1617 | Prepare cyber defense reports | Task | Covered | DF, IR | Incident Response |
| T1618 | Advise stakeholders on disaster recovery, contingency, and continuity of operations plans | Task | Partial | DC | Incident Response |
| T2012 | Check network connections | Task | Covered | DEA | Disk Forensics |
| T2013 | Look for indicators of intrusions | Task | Covered | DEA | Active Directory Attack and Defense |
| T2014 | Identify devices and networks on scene | Task | Partial | DEA | Incident Response |
| T2015 | Collect devices containing digital evidence | Task | Partial | DEA | Forensics Evidence Collection |
| T2016 | Identify areas of compromise | Task | Covered | DEA | Incident Response |
| T2017 | Acquire digital evidence | Task | Covered | DEA | Forensics Evidence Collection |
| T2018 | Create a digital footprint of raw or physical data | Task | Covered | DEA | Forensics Evidence Collection |
| T2019 | Process data into readable format | Task | Covered | DEA | Forensics Evidence Collection |
| T2020 | Prepare data for ingestion into application systems | Task | Partial | DEA | Threat Hunting |
| T2021 | Recover deleted or overwritten data files | Task | Partial | DEA | Disk Forensics |
| T2022 | Create derivative evidence from findings report | Task | Partial | DEA | Incident Response |
| K0068 | Knowledge of programming language structures and logic | Knowledge | Covered | DC | Malware Analysis |
| K0635 | Knowledge of decryption | Knowledge | Covered | DF | Network Forensics |
| K0636 | Knowledge of decryption tools and techniques | Knowledge | Covered | DF | Network Forensics |
| K0637 | Knowledge of data repositories | Knowledge | Partial | DF | Disk Forensics |
| K0674 | Knowledge of computer networking protocols | Knowledge | Covered | DC, DEA, DF | Network Forensics |
| K0675 | Knowledge of risk management processes | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0676 | Knowledge of cybersecurity laws and regulations | Knowledge | Partial | DC, DEA, DF, IR | Security Operations Fundamentals |
| K0677 | Knowledge of cybersecurity policies and procedures | Knowledge | Covered | DC, DEA, DF, IR | Security Operations Fundamentals |
| K0678 | Knowledge of privacy laws and regulations | Knowledge | Partial | DC, DEA, DF, IR | Security Operations Fundamentals |
| K0679 | Knowledge of privacy policies and procedures | Knowledge | Partial | DC, DEA, DF, IR | Network Forensics |
| K0680 | Knowledge of cybersecurity principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Security Operations Fundamentals |
| K0681 | Knowledge of privacy principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Network Forensics |
| K0682 | Knowledge of cybersecurity threats | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0683 | Knowledge of cybersecurity vulnerabilities | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0684 | Knowledge of cybersecurity threat characteristics | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0685 | Knowledge of access control principles and practices | Knowledge | Covered | DC, IR | Active Directory Attack and Defense |
| K0686 | Knowledge of authentication and authorization tools and techniques | Knowledge | Covered | DC, IR | Active Directory Attack and Defense |
| K0689 | Knowledge of network infrastructure principles and practices | Knowledge | Partial | DC, IR | Network Forensics |
| K0691 | Knowledge of cyber defense tools and techniques | Knowledge | Covered | DC | Incident Response |
| K0692 | Knowledge of vulnerability assessment tools and techniques | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0696 | Knowledge of digital forensic data principles and practices | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K0697 | Knowledge of encryption algorithm capabilities and applications | Knowledge | Covered | DEA, DF | Active Directory Attack and Defense |
| K0698 | Knowledge of cryptographic key management principles and practices | Knowledge | Partial | DC | Active Directory Attack and Defense |
| K0701 | Knowledge of data backup and recovery policies and procedures | Knowledge | Partial | DEA, DF, IR | Incident Response |
| K0707 | Knowledge of database systems and software | Knowledge | Partial | DC | Disk Forensics |
| K0709 | Knowledge of business continuity and disaster recovery (BCDR) policies and procedures | Knowledge | Partial | IR | Incident Response |
| K0710 | Knowledge of enterprise cybersecurity architecture principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Incident Response |
| K0716 | Knowledge of host access control (HAC) systems and software | Knowledge | Covered | DC, IR | Security Operations Fundamentals |
| K0717 | Knowledge of network access control (NAC) systems and software | Knowledge | Partial | DC, IR | Incident Response |
| K0718 | Knowledge of network communications principles and practices | Knowledge | Covered | DC, IR | Network Forensics |
| K0723 | Knowledge of vulnerability data sources | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0724 | Knowledge of incident response principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0725 | Knowledge of incident response tools and techniques | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0726 | Knowledge of incident handling tools and techniques | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0728 | Knowledge of Confidentiality, Integrity and Availability (CIA) principles and practices | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0729 | Knowledge of non-repudiation principles and practices | Knowledge | Partial | DC | Perimeter Defense - Email Security |
| K0730 | Knowledge of cyber safety principles and practices | Knowledge | Partial | DC | Incident Response |
| K0732 | Knowledge of intrusion detection tools and techniques | Knowledge | Covered | DC, IR | Security Operations Fundamentals |
| K0736 | Knowledge of information technology (IT) security principles and practices | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0742 | Knowledge of identity and access management (IAM) principles and practices | Knowledge | Covered | DC | Active Directory Attack and Defense |
| K0743 | Knowledge of new and emerging technologies | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0744 | Knowledge of operating system (OS) systems and software | Knowledge | Covered | DC, DEA, DF | Memory Forensics |
| K0746 | Knowledge of policy-based access controls | Knowledge | Covered | DC, IR | Active Directory Attack and Defense |
| K0747 | Knowledge of Risk Adaptive (Adaptable) Access Controls (RAdAC) | Knowledge | Covered | DC, IR | Active Directory Attack and Defense |
| K0749 | Knowledge of process engineering principles and practices | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0751 | Knowledge of system threats | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0752 | Knowledge of system vulnerabilities | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0756 | Knowledge of security management principles and practices | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0758 | Knowledge of server administration principles and practices | Knowledge | Partial | DC | Active Directory Attack and Defense |
| K0759 | Knowledge of client and server architecture | Knowledge | Covered | DC, DEA, DF | Incident Response |
| K0766 | Knowledge of data asset management principles and practices | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0770 | Knowledge of system administration principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Active Directory Attack and Defense |
| K0772 | Knowledge of systems testing and evaluation tools and techniques | Knowledge | Partial | DC | Incident Response |
| K0781 | Knowledge of virtual private network (VPN) systems and software | Knowledge | Partial | DC | Incident Response |
| K0783 | Knowledge of network attack characteristics | Knowledge | Covered | DC, IR | Threat Hunting |
| K0785 | Knowledge of insider threat tools and techniques | Knowledge | Partial | DC | Disk Forensics |
| K0786 | Knowledge of physical computer components | Knowledge | Partial | DEA, DF | Forensics Evidence Collection |
| K0787 | Knowledge of computer peripherals | Knowledge | Partial | DEA, DF | Forensics Evidence Collection |
| K0788 | Knowledge of adversarial tactics principles and practices | Knowledge | Covered | DC | Threat Hunting |
| K0789 | Knowledge of adversarial tactics tools and techniques | Knowledge | Covered | DC | Threat Hunting |
| K0790 | Knowledge of adversarial tactics policies and procedures | Knowledge | Partial | DC | Threat Hunting |
| K0791 | Knowledge of defense-in-depth principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Incident Response |
| K0792 | Knowledge of network configurations | Knowledge | Partial | DC | Network Forensics |
| K0793 | Knowledge of file extensions | Knowledge | Covered | DC, DEA, DF | Disk Forensics |
| K0794 | Knowledge of file system implementation principles and practices | Knowledge | Covered | DEA, DF | Disk Forensics |
| K0795 | Knowledge of digital evidence seizure policies and procedures | Knowledge | Partial | DEA, DF | Forensics Evidence Collection |
| K0796 | Knowledge of digital evidence preservation policies and procedures | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K0797 | Knowledge of ethical hacking tools and techniques | Knowledge | Covered | DEA, DF | Active Directory Attack and Defense |
| K0800 | Knowledge of evidence admissibility laws and regulations | Knowledge | Partial | DEA, DF | Incident Response |
| K0802 | Knowledge of chain of custody policies and procedures | Knowledge | Partial | DEA, DF | Incident Response |
| K0804 | Knowledge of persistent data principles and practices | Knowledge | Covered | DEA, DF | Disk Forensics |
| K0805 | Knowledge of command-line tools and techniques | Knowledge | Covered | DC | Forensics Evidence Collection |
| K0806 | Knowledge of machine virtualization tools and techniques | Knowledge | Partial | DEA, DF | Forensics Evidence Collection |
| K0807 | Knowledge of web mail tools and techniques | Knowledge | Partial | DF | Perimeter Defense - Email Security |
| K0808 | Knowledge of system file characteristics | Knowledge | Covered | DEA, DF | Disk Forensics |
| K0809 | Knowledge of digital forensics data characteristics | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K0810 | Knowledge of deployable forensics principles and practices | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K0812 | Knowledge of digital communication systems and software | Knowledge | Partial | DC, DEA, DF | Perimeter Defense - Email Security |
| K0813 | Knowledge of interpreted and compiled programming language characteristics | Knowledge | Partial | DC | Malware Analysis |
| K0815 | Knowledge of intelligence collection management processes | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0816 | Knowledge of front-end intelligence collection systems and software | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0817 | Knowledge of event correlation tools and techniques | Knowledge | Covered | DF | Threat Hunting |
| K0829 | Knowledge of account creation policies and procedures | Knowledge | Partial | DC, IR | Active Directory Attack and Defense |
| K0830 | Knowledge of password policies and procedures | Knowledge | Covered | DC, IR | Active Directory Attack and Defense |
| K0831 | Knowledge of network attack vectors | Knowledge | Covered | DC | Incident Response |
| K0832 | Knowledge of cyberattack characteristics | Knowledge | Covered | DC, IR | Incident Response |
| K0833 | Knowledge of cyberattack actor characteristics | Knowledge | Covered | DC, IR | Security Operations Fundamentals |
| K0837 | Knowledge of hardening tools and techniques | Knowledge | Covered | DC, DEA, DF, IR | Active Directory Attack and Defense |
| K0842 | Knowledge of software reverse engineering tools and techniques | Knowledge | Covered | DC, DEA, DF | Malware Analysis |
| K0844 | Knowledge of cyber attack stages | Knowledge | Covered | DC, IR | Threat Hunting |
| K0845 | Knowledge of cyber intrusion activity phases | Knowledge | Covered | DC, IR | Threat Hunting |
| K0848 | Knowledge of network systems management principles and practices | Knowledge | Partial | DC | Network Forensics |
| K0849 | Knowledge of network systems management tools and techniques | Knowledge | Partial | DC | Network Forensics |
| K0850 | Knowledge of data carving tools and techniques | Knowledge | Partial | DEA, DF | Malware Analysis |
| K0851 | Knowledge of reverse engineering principles and practices | Knowledge | Covered | DC, DEA, DF | Malware Analysis |
| K0852 | Knowledge of anti-forensics tools and techniques | Knowledge | Covered | DEA, DF | Memory Forensics |
| K0853 | Knowledge of forensics lab design principles and practices | Knowledge | Partial | DEA, DF | Forensics Evidence Collection |
| K0854 | Knowledge of forensics lab design systems and software | Knowledge | Partial | DEA, DF | Forensics Evidence Collection |
| K0855 | Knowledge of debugging tools and techniques | Knowledge | Covered | DEA, DF | Malware Analysis |
| K0856 | Knowledge of filename extension abuse | Knowledge | Partial | DEA, DF | Malware Analysis |
| K0857 | Knowledge of malware analysis tools and techniques | Knowledge | Covered | DEA, DF, IR | Malware Analysis |
| K0859 | Knowledge of encryption tools and techniques | Knowledge | Covered | DC, DEA, DF | Active Directory Attack and Defense |
| K0860 | Knowledge of malware signature principles and practices | Knowledge | Covered | DC | Incident Response |
| K0861 | Knowledge of network port capabilities and applications | Knowledge | Covered | DC | Network Forensics |
| K0877 | Knowledge of application firewall principles and practices | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0878 | Knowledge of network firewall principles and practices | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0879 | Knowledge of industry cybersecurity models and frameworks | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0880 | Knowledge of access control models and frameworks | Knowledge | Covered | DC | Active Directory Attack and Defense |
| K0891 | Knowledge of the Open Systems Interconnect (OSI) reference model | Knowledge | Partial | DC, IR | Network Forensics |
| K0892 | Knowledge of cyber defense laws and regulations | Knowledge | Partial | DC, DEA, DF | Security Operations Fundamentals |
| K0898 | Knowledge of cloud service models and frameworks | Knowledge | Covered | IR | Security Operations Fundamentals |
| K0911 | Knowledge of remote access tools and techniques | Knowledge | Covered | DEA | Threat Hunting |
| K0914 | Knowledge of binary analysis tools and techniques | Knowledge | Covered | DEA, DF | Malware Analysis |
| K0915 | Knowledge of network architecture principles and practices | Knowledge | Partial | DC, DEA, DF, IR | Network Forensics |
| K0916 | Knowledge of malware analysis principles and practices | Knowledge | Covered | DEA, DF, IR | Malware Analysis |
| K0917 | Knowledge of Personally Identifiable Information (PII) data security standards and best practices | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0918 | Knowledge of Payment Card Industry (PCI) data security standards and best practices | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0919 | Knowledge of Personal Health Information (PHI) data security standards and best practices | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0923 | Knowledge of operating system structures and internals | Knowledge | Covered | DEA, DF | Memory Forensics |
| K0924 | Knowledge of network analysis tools and techniques | Knowledge | Covered | DC, IR | Network Forensics |
| K0937 | Knowledge of countermeasure design principles and practices | Knowledge | Covered | DC | Incident Response |
| K0938 | Knowledge of network mapping principles and practices | Knowledge | Partial | DC | Network Forensics |
| K0939 | Knowledge of packet-level analysis tools and techniques | Knowledge | Covered | DC, DF | Network Forensics |
| K0940 | Knowledge of subnet tools and techniques | Knowledge | Partial | DC | Network Forensics |
| K0941 | Knowledge of data concealment tools and techniques | Knowledge | Covered | DEA | Memory Forensics |
| K0942 | Knowledge of cryptology principles and practices | Knowledge | Partial | DC | Active Directory Attack and Defense |
| K0950 | Knowledge of Intrusion Detection System (IDS) tools and techniques | Knowledge | Covered | DC | Incident Response |
| K0951 | Knowledge of Intrusion Prevention System (IPS) tools and techniques | Knowledge | Covered | DC | Security Operations Fundamentals |
| K0955 | Knowledge of penetration testing principles and practices | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0956 | Knowledge of penetration testing tools and techniques | Knowledge | Partial | DC | Security Operations Fundamentals |
| K0969 | Knowledge of cyber-attack tools and techniques | Knowledge | Covered | DC, IR | Threat Hunting |
| K0977 | Knowledge of intelligence collection management tools and techniques | Knowledge | Partial | DF | Security Operations Fundamentals |
| K0979 | Knowledge of information searching tools and techniques | Knowledge | Covered | DEA, DF | Threat Hunting |
| K0980 | Knowledge of intelligence collection sources | Knowledge | Partial | DF | Security Operations Fundamentals |
| K0983 | Knowledge of computer networking principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Network Forensics |
| K1004 | Knowledge of reporting policies and procedures | Knowledge | Covered | DEA, DF | Security Operations Fundamentals |
| K1014 | Knowledge of network security principles and practices | Knowledge | Covered | DC, DEA, DF, IR | Security Operations Fundamentals |
| K1016 | Knowledge of code obfuscation tools and techniques | Knowledge | Covered | DEA, DF | Malware Analysis |
| K1055 | Knowledge of digital forensics principles and practices | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K1069 | Knowledge of virtual machine tools and technologies | Knowledge | Partial | DEA, DF | Forensics Evidence Collection |
| K1079 | Knowledge of web application security risks | Knowledge | Covered | DC, DEA, DF, IR | Security Operations Fundamentals |
| K1089 | Knowledge of protocol analyzer tools and techniques | Knowledge | Covered | DC | Network Forensics |
| K1091 | Knowledge of media forensics | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K1092 | Knowledge of digital forensics tools and techniques | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K1115 | Knowledge of Chain of Custody (CoC) processes and procedures | Knowledge | Partial | DEA, DF | Incident Response |
| K1131 | Knowledge of cyber defense monitoring tools | Knowledge | Covered | DC | Security Operations Fundamentals |
| K1132 | Knowledge of cyber defense system analysis tools | Knowledge | Covered | DC | Security Operations Fundamentals |
| K1144 | Knowledge of data correlation tools and techniques | Knowledge | Covered | DC | Threat Hunting |
| K1145 | Knowledge of data encryption practices and principles | Knowledge | Covered | DEA | Active Directory Attack and Defense |
| K1147 | Knowledge of data integrity principles and practices | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K1151 | Knowledge of digital evidence cataloging tools and techniques | Knowledge | Partial | DEA, DF | Incident Response |
| K1152 | Knowledge of digital evidence extraction tools and techniques | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K1153 | Knowledge of digital evidence handling principles and practices | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K1155 | Knowledge of digital evidence preservation tools and techniques | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K1163 | Knowledge of forensic image processing tools and techniques | Knowledge | Covered | DEA, DF | Forensics Evidence Collection |
| K1168 | Knowledge of intrusion set tools and techniques | Knowledge | Partial | DC | Threat Hunting |
| K1175 | Knowledge of network monitoring tools and techniques | Knowledge | Covered | DEA, DF | Security Operations Fundamentals |
| K1176 | Knowledge of network topologies | Knowledge | Partial | DC | Network Forensics |
| K1181 | Knowledge of organizational cybersecurity incident response plans | Knowledge | Covered | DC | Security Operations Fundamentals |
| K1193 | Knowledge of packet analysis tools and techniques | Knowledge | Covered | DC, DF | Network Forensics |
| K1220 | Knowledge of steganography practices and principles | Knowledge | Partial | DEA | Threat Hunting |
| K1280 | Knowledge of approved data processing tools and techniques | Knowledge | Partial | DEA | Forensics Evidence Collection |
| K1281 | Knowledge of data types and characteristics | Knowledge | Covered | DEA | Forensics Evidence Collection |
| S0077 | Skill in securing network communications | Skill | Partial | IR | Security Operations Fundamentals |
| S0080 | Skill in performing damage assessments | Skill | Covered | IR | Incident Response |
| S0156 | Skill in performing packet-level analysis | Skill | Covered | DC, DEA, DF | Network Forensics |
| S0378 | Skill in decrypting information | Skill | Covered | DEA, DF | Network Forensics |
| S0385 | Skill in communicating complex concepts | Skill | Covered | DEA | Incident Response |
| S0431 | Skill in applying critical thinking | Skill | Covered | DEA | Threat Hunting |
| S0472 | Skill in developing virtual machines | Skill | Partial | DEA, DF | Forensics Evidence Collection |
| S0473 | Skill in maintaining virtual machines | Skill | Partial | DF | Forensics Evidence Collection |
| S0474 | Skill in finding system files | Skill | Covered | DF | Disk Forensics |
| S0475 | Skill in recognizing digital forensics data | Skill | Covered | DF | Disk Forensics |
| S0476 | Skill in identifying filename extension abuse | Skill | Partial | DEA, DF | Malware Analysis |
| S0483 | Skill in identifying software communications vulnerabilities | Skill | Covered | DC, IR | Security Operations Fundamentals |
| S0490 | Skill in recreating network topologies | Skill | Partial | DC | Network Forensics |
| S0491 | Skill in processing digital forensic data | Skill | Covered | DF | Forensics Evidence Collection |
| S0499 | Skill in performing intelligence collection analysis | Skill | Partial | DEA, DF | Security Operations Fundamentals |
| S0509 | Skill in evaluating security products | Skill | Partial | DC, IR | Security Operations Fundamentals |
| S0543 | Skill in scanning for vulnerabilities | Skill | Covered | DC | Security Operations Fundamentals |
| S0544 | Skill in recognizing vulnerabilities | Skill | Covered | DC, IR | Security Operations Fundamentals |
| S0547 | Skill in identifying malware | Skill | Covered | IR | Malware Analysis |
| S0548 | Skill in capturing malware | Skill | Covered | IR | Incident Response |
| S0549 | Skill in containing malware | Skill | Covered | IR | Incident Response |
| S0550 | Skill in reporting malware | Skill | Partial | IR | Incident Response |
| S0566 | Skill in developing signatures | Skill | Covered | DC | Incident Response |
| S0567 | Skill in deploying signatures | Skill | Covered | DC | Incident Response |
| S0572 | Skill in detecting host- and network-based intrusions | Skill | Covered | DC, IR | Active Directory Attack and Defense |
| S0574 | Skill in developing security system controls | Skill | Covered | DC | Incident Response |
| S0575 | Skill in developing network infrastructure contingency and recovery plans | Skill | Partial | DF | Incident Response |
| S0576 | Skill in testing network infrastructure contingency and recovery plans | Skill | Partial | DF | Incident Response |
| S0578 | Skill in evaluating security designs | Skill | Partial | DC | Security Operations Fundamentals |
| S0579 | Skill in preparing reports | Skill | Covered | DEA, DF | Incident Response |
| S0589 | Skill in preserving digital evidence integrity | Skill | Covered | DEA, DF, IR | Forensics Evidence Collection |
| S0593 | Skill in handling incidents | Skill | Covered | DC | Incident Response |
| S0599 | Skill in performing memory dump analysis | Skill | Covered | DEA, DF | Memory Forensics |
| S0600 | Skill in collecting relevant data from a variety of sources | Skill | Covered | DC | Threat Hunting |
| S0603 | Skill in identifying forensics data in diverse media | Skill | Covered | DF | Disk Forensics |
| S0604 | Skill in extracting forensics data in diverse media | Skill | Covered | DF | Disk Forensics |
| S0605 | Skill in storing digital evidence | Skill | Partial | DEA, DF | Forensics Evidence Collection |
| S0606 | Skill in manipulating operating system components | Skill | Covered | DEA, DF | Active Directory Attack and Defense |
| S0607 | Skill in collecting digital evidence | Skill | Covered | DEA, DF, IR | Forensics Evidence Collection |
| S0608 | Skill in processing digital evidence | Skill | Covered | DEA, DF, IR | Forensics Evidence Collection |
| S0612 | Skill in performing digital forensics analysis | Skill | Covered | DEA, DF | Disk Forensics |
| S0614 | Skill in categorizing types of vulnerabilities | Skill | Covered | DC, IR | Security Operations Fundamentals |
| S0615 | Skill in protecting a network against malware | Skill | Covered | IR | Perimeter Defense - Email Security |
| S0621 | Skill in performing binary analysis | Skill | Partial | DF | Malware Analysis |
| S0622 | Skill in implementing one-way hash functions | Skill | Covered | DEA, DF | Forensics Evidence Collection |
| S0623 | Skill in performing source code analysis | Skill | Covered | DEA, DF | Malware Analysis |
| S0624 | Skill in performing volatile data analysis | Skill | Covered | DEA, DF | Memory Forensics |
| S0625 | Skill in interpreting debugger results | Skill | Covered | DEA, DF | Malware Analysis |
| S0627 | Skill in reading signatures | Skill | Covered | DC | Incident Response |
| S0651 | Skill in performing malware analysis | Skill | Covered | DC, DEA, DF, IR | Malware Analysis |
| S0652 | Skill in performing bit-level analysis | Skill | Partial | DF | Malware Analysis |
| S0653 | Skill in creating digital evidence copies | Skill | Covered | DF | Forensics Evidence Collection |
| S0667 | Skill in assessing security controls | Skill | Covered | DC | Security Operations Fundamentals |
| S0671 | Skill in implementing network infrastructure contingency and recovery plans | Skill | Partial | DF | Incident Response |
| S0678 | Skill in administering operating systems | Skill | Partial | DF | Active Directory Attack and Defense |
| S0688 | Skill in performing network data analysis | Skill | Covered | DC, IR | Network Forensics |
| S0712 | Skill in evaluating data source quality | Skill | Covered | DC | Disk Forensics |
| S0755 | Skill in reconstructing a network | Skill | Partial | DC | Network Forensics |
| S0805 | Skill in designing incident responses | Skill | Covered | IR | Incident Response |
| S0806 | Skill in performing incident responses | Skill | Covered | IR | Incident Response |
| S0809 | Skill in utilizing cyber defense service provider information | Skill | Partial | DC | Security Operations Fundamentals |
| S0821 | Skill in collaborating with internal and external stakeholders | Skill | Covered | DF, IR | Incident Response |
| S0838 | Skill in identifying anomalous activities | Skill | Covered | DC | Active Directory Attack and Defense |
| S0839 | Skill in identifying exploited system weaknesses | Skill | Covered | DC | Security Operations Fundamentals |
| S0840 | Skill in identifying misuse activities | Skill | Covered | DC | Active Directory Attack and Defense |
| S0846 | Skill in monitoring system activity | Skill | Covered | DC | Threat Hunting |
| S0854 | Skill in performing data analysis | Skill | Covered | DC, DEA, DF, IR | Threat Hunting |
| S0856 | Skill in performing digital evidence analysis | Skill | Covered | DEA, DF | Disk Forensics |
| S0857 | Skill in performing dynamic analysis | Skill | Covered | DC, DEA, DF | Malware Analysis |
| S0859 | Skill in performing event correlation | Skill | Covered | DC | Threat Hunting |
| S0860 | Skill in performing file system forensic analysis | Skill | Covered | DEA, DF | Disk Forensics |
| S0863 | Skill in performing incident analysis | Skill | Covered | DC | Threat Hunting |
| S0866 | Skill in performing log file analysis | Skill | Covered | DC, DEA, DF, IR | Threat Hunting |
| S0867 | Skill in performing malicious activity analysis | Skill | Covered | DC | Active Directory Attack and Defense |
| S0869 | Skill in performing metadata analysis | Skill | Covered | DC | Disk Forensics |
| S0872 | Skill in performing network data flow analysis | Skill | Covered | DC | Network Forensics |
| S0874 | Skill in performing network traffic analysis | Skill | Covered | DC | Network Forensics |
| S0875 | Skill in performing network traffic packet analysis | Skill | Covered | DC, DF | Network Forensics |
| S0882 | Skill in performing static analysis | Skill | Covered | DF | Malware Analysis |
| S0884 | Skill in performing static malware analysis | Skill | Covered | DEA, DF | Malware Analysis |
| S0885 | Skill in performing system activity analysis | Skill | Covered | DC | Threat Hunting |
| S0892 | Skill in performing trend analysis | Skill | Covered | DC | Threat Hunting |
| S0935 | Skill in live acquisition | Skill | Covered | DEA | Forensics Evidence Collection |
| S0936 | Skill in deadbox acquisition | Skill | Covered | DEA | Forensics Evidence Collection |
| S0937 | Skill in inspecting data for ingestion | Skill | Partial | DEA | Threat Hunting |
| S0938 | Skill in interacting with live systems to identify active and historical networks | Skill | Partial | DEA | Disk Forensics |