CyberDefenders certifications mapped to SFIA 9
CCDL1 supports SFIA 9 security skills at levels 2 to 3. CCDL2 supports level 3, with parts of level 4 in security operations and digital forensics.
Last reviewed: October 2026
What is SFIA?
SFIA, the Skills Framework for the Information Age, is a global framework for digital and IT skills. It describes each skill at up to seven levels of responsibility.
Employers and governments use it to define roles, plan careers, and build teams, especially in the UK, Australia, and New Zealand. The current version is SFIA 9, published in October 2024.
Source: SFIA Foundation, SFIA 9
What do SFIA levels 2, 3, and 4 mean?
SFIA levels describe how much responsibility someone takes on, from level 1 (following instructions) to level 7 (setting strategy).
- Level 2: carries out routine work with some guidance.
- Level 3: applies skills to varied work and solves problems on their own.
- Level 4: handles complex work and supports others.
CCDL1 and CCDL2 teach the activities at these levels. The full level also depends on workplace autonomy and experience, which a course cannot assess.
Source: SFIA Foundation, how SFIA works
Which SFIA skills does CCDL1 support?
CCDL1 fully supports Security operations (SCAD) at level 3. It supports Digital forensics, Incident management, Information security, and Threat intelligence at level 2, with parts of level 3.
Learners investigate alerts across network, endpoint, email, and cloud evidence, write and test IDS rules, acquire and analyze forensic evidence, and triage and escalate incidents.
Which SFIA skills does CCDL2 support?
CCDL2 supports Security operations and Digital forensics at level 3, with parts of level 4. It fully supports Vulnerability assessment (VUAS) at level 3.
Learners hunt threats, write and test Suricata detections, reconstruct complex disk, memory, and APT investigations, run authenticated Nessus scans, and write executive and technical incident reports.
How did we map CCDL1 and CCDL2 to SFIA?
We matched the activities taught in the live, published lessons and labs of each course to SFIA 9 skill and level descriptions.
A level is supported only when the course teaches or practices the activities that level describes. We never assign a level from a course title or tool alone. "Partial" means only part of that level is taught. We reviewed 13 skills and screened others that overlap but do not match. The mapping was captured in October 2026 and is reviewed yearly.
How can teams use this mapping?
- Link SOC and DFIR training to the SFIA skills in your role profiles.
- Plan development from level 2 to level 3 and toward level 4.
- Show HR which SFIA skills and levels a training program supports.
Planning skills for a security team? See our cybersecurity training for teams and enterprises.
What SFIA activities do the courses teach?
A sample of SFIA 9 activities each course supports, with where they are taught.
| SFIA skill | Level | What learners do | Where it is taught |
|---|---|---|---|
| Security operations (SCAD) | CCDL1: 3 | Investigate alerts and isolate a compromised endpoint | Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| Security operations (SCAD) | CCDL1: 3 | Write, test, and tune IDS rules | Lab 2.1.4: Write and Test Basic IDS Rules |
| Digital forensics (DGFS) | CCDL1: 2 | Acquire and verify memory and disk evidence | Lab 4.1.2: Evidence Acquisition and Triage Collection |
| Incident management (USUP) | CCDL1: 2 | Triage, classify, and escalate incidents by business impact | Lab 6.1.1: The SOC Decision Process |
| Vulnerability assessment (VUAS) | CCDL2: 3 | Run authenticated vulnerability scans and prioritize fixes | Nessus: Perform an Authenticated Advanced Scan |
| Threat intelligence (THIN) | CCDL2: 2 | Run intelligence-led threat hunts with ATT&CK | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Digital forensics (DGFS) | CCDL2: 3 | Reconstruct complex disk, memory, and APT investigations | Full-Scope APT Investigation scenario |
View all 13 SFIA skills mapped
All 13 SFIA 9 skills reviewed, with the level each course supports and where it is taught. "Partial" means only part of that level is taught.
| SFIA 9 skill | CCDL1 | CCDL2 |
|---|---|---|
| Security operations (SCAD) | Level 3 Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint; Lab 2.1.4: Write and Test Basic IDS Rules | Level 3 + partial 4 Writing Custom Suricata Signatures; Scenario; Lab 1.2.1: Detecting Kerberos-Based Attacks in Event Logs |
| Digital forensics (DGFS) | Level 2 + partial 3 Lab 4.1.1: Introduction to Digital Forensics; Lab 4.1.2: Evidence Acquisition and Triage Collection; Lab 4.2.2: File System Artifacts and Execution Analysis | Level 3 + partial 4 Acquisition; Scenario; Incident Report |
| Incident management (USUP) | Level 2 + partial 3 Lab 6.1.1: The SOC Decision Process; Lab 5.2.1: Triaging Sign-In Alerts; Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint | Partial level 3 NIST Incident Response Lifecycle; Effective Incident Communication Planning in IR; Lessons Learned Meeting |
| Information security (SCTY) | Level 2 + partial 3 Lab 2.1.4: Write and Test Basic IDS Rules; Lab 5.1.1: Cloud and Azure Fundamentals; Lab 5.2.2: Investigating Application Abuse | Partial level 3 DMARC Record Creation; Lab 1.2.1: Detecting Kerberos-Based Attacks in Event Logs; Efficient SOC Procedures: The How-To |
| Threat intelligence (THIN) | Level 2 Lab 1.3.1: Email Threat Detection and Analysis; Lab 6.1.2: From Alerts to Handover | Level 2 + partial 3 Threat Intelligence: Mitigating and Defending; Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Identity and access management (IAMT) | Partial level 3 Lab 5.1.1: Cloud and Azure Fundamentals; Lab 5.2.2: Investigating Application Abuse; Lab 5.2.1: Triaging Sign-In Alerts | Partial level 3 Lab 1.1.7: Analyzing Azure AD External Identity and Trust Security - Cross-Tenant Trust, Conditional Access, and Token-Based Attacks; Lab 1.2.1: Detecting Kerberos-Based Attacks in Event Logs |
| Vulnerability assessment (VUAS) | Not established | Level 3 Nessus: Perform an Authenticated Advanced Scan; Understanding Vulnerability Management Process. |
| Data analytics (DAAN) | Level 2 Lab 5.1.2: Azure Log Analysis and KQL Fundamentals | Partial level 3 How to Approach an Investigation: The Threat Hunter's Mindset; KQL: Kibana Query Language |
| Data visualisation (VISL) | Partial level 2 Lab 5.1.2: Azure Log Analysis and KQL Fundamentals; Lab 3.2.3: Splunk Alerts and Dashboards | Level 2 + partial 3 Visualize: Visualizing Data in Kibana |
| Content design and authoring (INCA) | Partial level 2 Lab 6.1.1: The SOC Decision Process; Lab 1.4.1: Phishing Simulation | Level 2 + partial 3 Incident Report; Full-Scope APT Investigation |
| Cybercrime investigation (CRIM) | Partial level 2 Lab 4.1.1: Introduction to Digital Forensics; Lab 6.1.1: The SOC Decision Process | Partial level 2 Containment |
| Programming/software development (PROG) | Not established | Partial level 2 Exploring VBA Programming fundamentals; Debugging VBA Macros Step-by-Step |
| Infrastructure operations (ITOP) | Not established | Partial level 2 Activity - GoPhish Deployment |