CyberDefenders certifications mapped to the UK Government Security Profession framework
CCDL1 and CCDL2 have strong relevant alignment to three Associate-level cyber security roles in the UK Government Security Profession (GSP) Career Framework: Monitoring, Incident Response, and Digital Forensics.
Last reviewed: October 2026
What is the GSP Career Framework?
The Government Security Profession (GSP) Career Framework describes security roles across the UK government. For each role, it lists the skills needed and the skill level each one requires.
This mapping uses the Cyber Security role pages published on security.gov.uk in October 2026.
What do the GSP skill levels mean?
Each GSP skill has four levels: Awareness, Working, Practitioner, and Expert. Each role states the level it needs for every skill.
- Awareness: understands the basics of the skill.
- Working: applies the skill in everyday work.
- Practitioner: applies the skill to complex work, often guiding others.
- Expert: sets direction and leads in the skill.
The courses teach skills at the levels the Associate roles require, mostly Awareness and Working. A course cannot award a skill level, which also depends on workplace experience.
Which GSP roles does CCDL1 align to?
CCDL1 has strong relevant alignment to Monitoring, Incident Response, and Digital Forensics at Associate level.
Learners collect and correlate logs, build alerts and dashboards in Splunk, write and test IDS rules, follow a structured triage and handover process, and acquire and analyze forensic evidence.
Which GSP roles does CCDL2 align to?
CCDL2 has strong relevant alignment to the same three roles, with deeper coverage.
Learners hunt threats with Elastic SIEM and Suricata, build detections, follow the NIST incident response lifecycle from policy and plan to incident report, and analyze disk, memory, and network evidence.
How did we map CCDL1 and CCDL2 to the GSP framework?
We scored every skill descriptor, at the level each role requires, against the live, published lessons and labs of each course.
Each descriptor is marked Covered, Partially covered, or Not established, with the lesson or lab that supports it. We reviewed the cyber security roles at their entry level, which is Associate for most roles. Leadership roles, such as Head of Cyber Security and CISO, were screened out. The mapping was captured in October 2026 and is reviewed yearly.
How can UK teams use this mapping?
- Match SOC, incident response, and forensics hires to GSP roles.
- Plan training against the skill levels each GSP role requires.
- Show managers which GSP roles your training covers.
Building a SOC team? See our cybersecurity training for teams and enterprises.
Which GSP skills do the courses cover?
A sample of GSP skills the courses support at the level each role requires, with where they are taught.
| Role | GSP skill | Required level | Where it is taught |
|---|---|---|---|
| Monitoring | Information risk assessment and risk management | Awareness | CCDL1: Lab 6.1.1: The SOC Decision Process |
| Monitoring | Forensics | Awareness | CCDL2: Topic 1: What is Digital Forensics? |
| Incident Response | Incident management, incident investigation and response | Practitioner | CCDL1: Lab 6.1.1: The SOC Decision Process |
| Incident Response | Intrusion detection and analysis | Working | CCDL2: Network-Based Intrusion and Prevention Systems (NIDS/NIPS) |
| Digital Forensics | Threat intelligence and threat assessment | Working | CCDL1: Lab 6.1.2: From Alerts to Handover |
| Digital Forensics | Threat Understanding | Working | CCDL2: Intelligence-Driven Hunting: APT29 (Cozy Bear) |
View the full CCDL1 and CCDL2 GSP mapping
Every skill descriptor at the required level for the three main roles. Descriptors with no evidence in the live course are not listed. Descriptor text: Government Security Profession, Crown copyright, used under the Open Government Licence v3.0.
CCDL1: 79 skill descriptors covered or partially covered
| Role | Skill and level | Skill descriptor | Coverage | Where it is taught |
|---|---|---|---|---|
| Monitoring | Information risk assessment and risk management Awareness | Demonstrates knowledge of risk assessment and risk management theory and approaches | Partial | Lab 6.1.1: The SOC Decision Process |
| Monitoring | Information risk assessment and risk management Awareness | Understands how risk management supports business or organisational objectives | Covered | Lab 6.1.1: The SOC Decision Process |
| Monitoring | Information risk assessment and risk management Awareness | Understands and can follow routine organisational governance processes for security and risk management | Partial | Lab 6.1.1: The SOC Decision Process |
| Monitoring | Forensics Awareness | Describes basic forensic principles and is capable of using agreed tools and techniques in support of an investigation | Covered | Lab 4.1.1: Introduction to Digital Forensics |
| Monitoring | Forensics Awareness | Contributes to forensic activities with supervision | Covered | Lab 4.1.2: Evidence Acquisition and Triage Collection |
| Monitoring | Forensics Awareness | Follows documented forensic principles and guidelines such as those related to acquisition and handling of forensic artefacts and maintaining the chain of custody | Covered | Lab 4.1.1: Introduction to Digital Forensics |
| Monitoring | Forensics Awareness | Can identify suitable tools for use, and considers the impact on forensic integrity | Covered | Lab 4.1.1: Introduction to Digital Forensics |
| Monitoring | Forensics Awareness | Considers the difference in intelligence and evidential requirements | Partial | Lab 4.1.1: Introduction to Digital Forensics |
| Monitoring | Secure operations management Awareness | Describes the basic principles of secure operations management | Covered | Lab 1.4.1: Phishing Simulation |
| Monitoring | Secure operations management Awareness | Follows documented principles and guidelines for secure operations management activities | Covered | Lab 6.1.1: The SOC Decision Process |
| Monitoring | Secure operations management Awareness | Implements secure operations management processes and procedures | Partial | Lab 3.1.1: Log Collection |
| Monitoring | Cyber Security operations Awareness | Recognises the need for information systems and services to be operated and monitored securely and can list some of the main policies and practices involved in achieving this | Covered | Lab 1.4.1: Phishing Simulation |
| Monitoring | Cyber Security operations Awareness | Explains the main principles of secure configuration of role specific security components and devices, including firewalls and protective monitoring tools (e.g. SIEM) | Covered | Lab 3.1.1: Log Collection |
| Monitoring | Threat intelligence and threat assessment Working | Understands and can explain threat intelligence and threat assessment principles and concepts | Covered | Lab 6.1.2: From Alerts to Handover |
| Monitoring | Threat intelligence and threat assessment Working | Uses prescribed tools and techniques to acquire, validate and analyse threat information from multiple sources | Covered | Lab 6.1.2: From Alerts to Handover |
| Monitoring | Threat intelligence and threat assessment Working | Under direction enriches threat information by providing context, assessing possible implications and summarising the behaviour, capabilities and activities of threat actors | Covered | Lab 6.1.2: From Alerts to Handover |
| Monitoring | Threat intelligence and threat assessment Working | Uses approved techniques to model routine threats, under supervision, to identify common enterprise attack vector, identify critical organisational functions, and protect organisational assets and goals | Partial | Lab 6.1.2: From Alerts to Handover |
| Monitoring | Threat intelligence and threat assessment Working | Applies knowledge to prioritise remediation of identified vulnerabilities for a single asset or system | Partial | Lab 5.2.3: Investigating Cloud Storage Exposure |
| Monitoring | Intrusion detection and analysis Working | Understands and explains the basic principles of monitoring network and system activity to identify potential intrusion or other anomalous behaviour | Covered | Lab 2.1.4: Write and Test Basic IDS Rules |
| Monitoring | Intrusion detection and analysis Working | Uses information provided from various sources to identify, analyse, and report events that occur or might occur within the network. Uses a range of methods and procedures to identify, acquire, and preserve artefacts by means of controlled and documented analytical and investigative techniques | Covered | Lab 3.1.1: Log Collection |
| Monitoring | Intrusion detection and analysis Working | Understands the business context of the activities | Covered | Lab 6.1.1: The SOC Decision Process |
| Monitoring | Protective security Awareness | Maintains an up-to-date understanding of fundamentals of all areas of security (especially in the context of government), and appreciates the importance of making use of a combination and multi-layering of appropriate and proportionate Physical, Personnel and Cyber Security measures to protect assets | Partial | Lab 1.4.1: Phishing Simulation |
| Monitoring | Protective security Awareness | Identifies aspects from across the breadth of the security field | Partial | Lab 1.4.1: Phishing Simulation |
| Monitoring | Protective security Awareness | Promotes protective security, providing advice to others | Partial | Lab 1.4.1: Phishing Simulation |
| Monitoring | Threat Understanding Working | Interprets sources of threat information for the local environment and applies knowledge of the external environment | Covered | Lab 6.1.2: From Alerts to Handover |
| Monitoring | Threat Understanding Working | Maintains understanding of local and strategic threat environments, and trends affecting the landscape, and can apply to inform and provide context | Partial | Lab 1.4.1: Phishing Simulation |
| Monitoring | Threat Understanding Working | Uses local and strategic threat information in decision-making and planning | Partial | Lab 6.1.2: From Alerts to Handover |
| Monitoring | Threat Understanding Working | Communicates tailored threat information to relevant local stakeholders within the organisation | Covered | Lab 6.1.1: The SOC Decision Process |
| Incident Response | Incident management, incident investigation and response Practitioner | Defines incident management, incident investigation and response policy and/or incident management and investigation processes, procedures and systems | Partial | Lab 1.4.1: Phishing Simulation |
| Incident Response | Incident management, incident investigation and response Practitioner | Follows documented principles and guidelines for incident management, incident investigation and response activities | Covered | Lab 6.1.1: The SOC Decision Process |
| Incident Response | Incident management, incident investigation and response Practitioner | Advises others on incident management, incident investigation and response processes | Partial | Lab 6.1.1: The SOC Decision Process |
| Incident Response | Information risk assessment and risk management Practitioner | Understands the organisation’s business drivers and approach to managing risk to support delivery of balanced and cost-effective risk management decisions on situations with a relatively well-defined scope. Relates risk to corporate governance, organisational strategic direction and planning | Partial | Lab 6.1.1: The SOC Decision Process |
| Incident Response | Information risk assessment and risk management Practitioner | Delivers or reviews risk assessments using appropriate risk assessment methods for common scenarios such as enterprise IT systems | Partial | Lab 6.1.1: The SOC Decision Process |
| Incident Response | Information risk assessment and risk management Practitioner | Inspects and reports on the security characteristics of systems with straightforward scope | Covered | Lab 5.2.3: Investigating Cloud Storage Exposure |
| Incident Response | Information risk assessment and risk management Practitioner | Has a good understanding of how assessed risks are addressed as part of an approach to risk treatment | Partial | Lab 6.1.1: The SOC Decision Process |
| Incident Response | Intrusion detection and analysis Working | Understands and explains the basic principles of monitoring network and system activity to identify potential intrusion or other anomalous behaviour | Covered | Lab 2.1.4: Write and Test Basic IDS Rules |
| Incident Response | Intrusion detection and analysis Working | Uses information provided from various sources to identify, analyse, and report events that occur or might occur within the network. Uses a range of methods and procedures to identify, acquire, and preserve artefacts by means of controlled and documented analytical and investigative techniques | Covered | Lab 3.1.1: Log Collection |
| Incident Response | Intrusion detection and analysis Working | Understands the business context of the activities | Covered | Lab 6.1.1: The SOC Decision Process |
| Incident Response | Threat intelligence and threat assessment Working | Understands and can explain threat intelligence and threat assessment principles and concepts | Covered | Lab 6.1.2: From Alerts to Handover |
| Incident Response | Threat intelligence and threat assessment Working | Uses prescribed tools and techniques to acquire, validate and analyse threat information from multiple sources | Covered | Lab 6.1.2: From Alerts to Handover |
| Incident Response | Threat intelligence and threat assessment Working | Under direction enriches threat information by providing context, assessing possible implications and summarising the behaviour, capabilities and activities of threat actors | Covered | Lab 6.1.2: From Alerts to Handover |
| Incident Response | Threat intelligence and threat assessment Working | Uses approved techniques to model routine threats, under supervision, to identify common enterprise attack vector, identify critical organisational functions, and protect organisational assets and goals | Partial | Lab 6.1.2: From Alerts to Handover |
| Incident Response | Threat intelligence and threat assessment Working | Applies knowledge to prioritise remediation of identified vulnerabilities for a single asset or system | Partial | Lab 5.2.3: Investigating Cloud Storage Exposure |
| Incident Response | Applied security capability Awareness | Understands why security must support business needs and the importance of being able to demonstrate that relationship | Covered | Lab 6.1.1: The SOC Decision Process |
| Incident Response | Applied security capability Awareness | Aware of some key, well-understood, security principles and can demonstrate an awareness of some Cyber Security relevant technologies | Covered | Lab 1.4.1: Phishing Simulation |
| Incident Response | Applied security capability Awareness | Understands why it is important to gain confidence in security measures and can describe some straightforward mechanisms such as pen-tests | Partial | Lab 1.4.1: Phishing Simulation |
| Incident Response | Applied security capability Awareness | Understands and can describe basic security concepts | Covered | Lab 1.4.1: Phishing Simulation |
| Incident Response | Protective security Awareness | Maintains an up-to-date understanding of fundamentals of all areas of security (especially in the context of government), and appreciates the importance of making use of a combination and multi-layering of appropriate and proportionate Physical, Personnel and Cyber Security measures to protect assets | Partial | Lab 1.4.1: Phishing Simulation |
| Incident Response | Protective security Awareness | Identifies aspects from across the breadth of the security field | Partial | Lab 1.4.1: Phishing Simulation |
| Incident Response | Protective security Awareness | Promotes protective security, providing advice to others | Partial | Lab 1.4.1: Phishing Simulation |
| Incident Response | Threat Understanding Awareness | Describes specific threats and how they may manifest themselves in a local environment | Covered | Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| Incident Response | Threat Understanding Awareness | Maintains understanding of local threat environment and can apply to inform and provide context for wider activities | Covered | Lab 6.1.2: From Alerts to Handover |
| Incident Response | Threat Understanding Awareness | Uses local threat information in decision-making and planning | Covered | Lab 6.1.2: From Alerts to Handover |
| Incident Response | Threat Understanding Awareness | Demonstrates knowledge of current threats and trends affecting the landscape | Partial | Lab 1.4.1: Phishing Simulation |
| Digital Forensics | Forensics Working | Analyses digital evidence and investigates computer security incidents to derive information required to help resolve security incidents, and/or identify breaches of policy, regulation or law | Covered | Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| Digital Forensics | Forensics Working | Understands legislative requirements and implications of actions within the organisation context | Partial | Lab 6.1.1: The SOC Decision Process |
| Digital Forensics | Forensics Working | Undertakes real-time analysis of ongoing incidents on live systems to identify relevant artefacts, understand the incident and facilitate resolution | Partial | Lab 4.1.2: Evidence Acquisition and Triage Collection |
| Digital Forensics | Forensics Working | Able to identify suspicious software, including potential malware sources | Covered | Lab 2.2.3: Investigate Alerts and Respond Using Microsoft Defender for Endpoint |
| Digital Forensics | Forensics Working | Secures the scene of an incident, with little requirement for supervision, acquiring and handling evidence in accordance with legal guidelines and in the most effective manner to minimise disruption to the business, ensuring that the chain of custody is maintained | Partial | Lab 4.1.1: Introduction to Digital Forensics |
| Digital Forensics | Forensics Working | Presents conclusions in a manner suited to the context (written or oral), and is able to effectively defend conclusions, and provide evidence and testimony as required | Partial | Lab 4.2.5: Forensic Timeline Construction and Event Sequencing |
| Digital Forensics | Intrusion detection and analysis Working | Understands and explains the basic principles of monitoring network and system activity to identify potential intrusion or other anomalous behaviour | Covered | Lab 2.1.4: Write and Test Basic IDS Rules |
| Digital Forensics | Intrusion detection and analysis Working | Uses information provided from various sources to identify, analyse, and report events that occur or might occur within the network. Uses a range of methods and procedures to identify, acquire, and preserve artefacts by means of controlled and documented analytical and investigative techniques | Covered | Lab 3.1.1: Log Collection |
| Digital Forensics | Intrusion detection and analysis Working | Understands the business context of the activities | Covered | Lab 6.1.1: The SOC Decision Process |
| Digital Forensics | Information risk assessment and risk management Working | Supports security professionals in carrying out risk assessments and developing mitigation strategies for relatively common and well-understood scenarios | Partial | Lab 6.1.1: The SOC Decision Process |
| Digital Forensics | Information risk assessment and risk management Working | Has an understanding of, and can apply, the fundamental principles of risk assessment, risk management processes and decision-making | Partial | Lab 1.4.1: Phishing Simulation |
| Digital Forensics | Threat intelligence and threat assessment Working | Understands and can explain threat intelligence and threat assessment principles and concepts | Covered | Lab 6.1.2: From Alerts to Handover |
| Digital Forensics | Threat intelligence and threat assessment Working | Uses prescribed tools and techniques to acquire, validate and analyse threat information from multiple sources | Covered | Lab 6.1.2: From Alerts to Handover |
| Digital Forensics | Threat intelligence and threat assessment Working | Under direction enriches threat information by providing context, assessing possible implications and summarising the behaviour, capabilities and activities of threat actors | Covered | Lab 6.1.2: From Alerts to Handover |
| Digital Forensics | Threat intelligence and threat assessment Working | Uses approved techniques to model routine threats, under supervision, to identify common enterprise attack vector, identify critical organisational functions, and protect organisational assets and goals | Partial | Lab 6.1.2: From Alerts to Handover |
| Digital Forensics | Threat intelligence and threat assessment Working | Applies knowledge to prioritise remediation of identified vulnerabilities for a single asset or system | Partial | Lab 5.2.3: Investigating Cloud Storage Exposure |
| Digital Forensics | Threat Understanding Working | Interprets sources of threat information for the local environment and applies knowledge of the external environment | Covered | Lab 6.1.2: From Alerts to Handover |
| Digital Forensics | Threat Understanding Working | Maintains understanding of local and strategic threat environments, and trends affecting the landscape, and can apply to inform and provide context | Partial | Lab 1.4.1: Phishing Simulation |
| Digital Forensics | Threat Understanding Working | Uses local and strategic threat information in decision-making and planning | Partial | Lab 6.1.2: From Alerts to Handover |
| Digital Forensics | Threat Understanding Working | Communicates tailored threat information to relevant local stakeholders within the organisation | Covered | Lab 6.1.1: The SOC Decision Process |
| Digital Forensics | Legal and regulatory environment and compliance Awareness | Describes the major legislative regulatory instruments relevant to security legislation and regulation relevant to the role | Partial | Lab 6.1.1: The SOC Decision Process |
| Digital Forensics | Legal and regulatory environment and compliance Awareness | Follows documented procedures for compliance or regulations | Partial | Lab 6.1.1: The SOC Decision Process |
| Digital Forensics | Protective security Awareness | Maintains an up-to-date understanding of fundamentals of all areas of security (especially in the context of government), and appreciates the importance of making use of a combination and multi-layering of appropriate and proportionate Physical, Personnel and Cyber Security measures to protect assets | Partial | Lab 1.4.1: Phishing Simulation |
| Digital Forensics | Protective security Awareness | Identifies aspects from across the breadth of the security field | Partial | Lab 1.4.1: Phishing Simulation |
| Digital Forensics | Protective security Awareness | Promotes protective security, providing advice to others | Partial | Lab 1.4.1: Phishing Simulation |
CCDL2: 79 skill descriptors covered or partially covered
| Role | Skill and level | Skill descriptor | Coverage | Where it is taught |
|---|---|---|---|---|
| Monitoring | Information risk assessment and risk management Awareness | Demonstrates knowledge of risk assessment and risk management theory and approaches | Partial | Threats, Vulnerabilities, and Risks |
| Monitoring | Information risk assessment and risk management Awareness | Understands how risk management supports business or organisational objectives | Covered | Incident Prioritization |
| Monitoring | Information risk assessment and risk management Awareness | Understands and can follow routine organisational governance processes for security and risk management | Covered | Effective Policies: Business Protection Through Documentation |
| Monitoring | Forensics Awareness | Describes basic forensic principles and is capable of using agreed tools and techniques in support of an investigation | Covered | Topic 1: What is Digital Forensics? |
| Monitoring | Forensics Awareness | Contributes to forensic activities with supervision | Covered | Walkthrough - Evidence Collection: FTK Imager |
| Monitoring | Forensics Awareness | Follows documented forensic principles and guidelines such as those related to acquisition and handling of forensic artefacts and maintaining the chain of custody | Partial | Topic 3: Disk Acquisition: Write-Blocking |
| Monitoring | Forensics Awareness | Can identify suitable tools for use, and considers the impact on forensic integrity | Covered | Topic 3: Disk Acquisition: Write-Blocking |
| Monitoring | Forensics Awareness | Considers the difference in intelligence and evidential requirements | Partial | Topic 1: What is Digital Forensics? |
| Monitoring | Secure operations management Awareness | Describes the basic principles of secure operations management | Covered | SOC Components: Processes |
| Monitoring | Secure operations management Awareness | Follows documented principles and guidelines for secure operations management activities | Covered | Efficient SOC Procedures: The How-To |
| Monitoring | Secure operations management Awareness | Implements secure operations management processes and procedures | Covered | OSSEC: Architecture and Configs overview |
| Monitoring | Cyber Security operations Awareness | Recognises the need for information systems and services to be operated and monitored securely and can list some of the main policies and practices involved in achieving this | Covered | Effective Policies: Business Protection Through Documentation |
| Monitoring | Cyber Security operations Awareness | Explains the main principles of secure configuration of role specific security components and devices, including firewalls and protective monitoring tools (e.g. SIEM) | Covered | Network Firewall: Protecting Communication and Data |
| Monitoring | Threat intelligence and threat assessment Working | Understands and can explain threat intelligence and threat assessment principles and concepts | Covered | Threat Intelligence: Mitigating and Defending |
| Monitoring | Threat intelligence and threat assessment Working | Uses prescribed tools and techniques to acquire, validate and analyse threat information from multiple sources | Partial | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Monitoring | Threat intelligence and threat assessment Working | Under direction enriches threat information by providing context, assessing possible implications and summarising the behaviour, capabilities and activities of threat actors | Covered | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Monitoring | Threat intelligence and threat assessment Working | Uses approved techniques to model routine threats, under supervision, to identify common enterprise attack vector, identify critical organisational functions, and protect organisational assets and goals | Partial | MITRE ATT&CK: Mapping a Full Attack Scenario |
| Monitoring | Threat intelligence and threat assessment Working | Applies knowledge to prioritise remediation of identified vulnerabilities for a single asset or system | Covered | Understanding Vulnerability Management Process. |
| Monitoring | Intrusion detection and analysis Working | Understands and explains the basic principles of monitoring network and system activity to identify potential intrusion or other anomalous behaviour | Covered | Network-Based Intrusion and Prevention Systems (NIDS/NIPS) |
| Monitoring | Intrusion detection and analysis Working | Uses information provided from various sources to identify, analyse, and report events that occur or might occur within the network. Uses a range of methods and procedures to identify, acquire, and preserve artefacts by means of controlled and documented analytical and investigative techniques | Covered | The Threat Hunting Process |
| Monitoring | Intrusion detection and analysis Working | Understands the business context of the activities | Covered | Incident Prioritization |
| Monitoring | Protective security Awareness | Maintains an up-to-date understanding of fundamentals of all areas of security (especially in the context of government), and appreciates the importance of making use of a combination and multi-layering of appropriate and proportionate Physical, Personnel and Cyber Security measures to protect assets | Partial | Defense in Depth |
| Monitoring | Protective security Awareness | Identifies aspects from across the breadth of the security field | Partial | Effective Policies: Business Protection Through Documentation |
| Monitoring | Protective security Awareness | Promotes protective security, providing advice to others | Partial | Effective Policies: Business Protection Through Documentation |
| Monitoring | Threat Understanding Working | Interprets sources of threat information for the local environment and applies knowledge of the external environment | Covered | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Monitoring | Threat Understanding Working | Maintains understanding of local and strategic threat environments, and trends affecting the landscape, and can apply to inform and provide context | Partial | The Evolving Threat Landscape |
| Monitoring | Threat Understanding Working | Uses local and strategic threat information in decision-making and planning | Partial | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Monitoring | Threat Understanding Working | Communicates tailored threat information to relevant local stakeholders within the organisation | Covered | Incident Report |
| Incident Response | Incident management, incident investigation and response Practitioner | Defines incident management, incident investigation and response policy and/or incident management and investigation processes, procedures and systems | Partial | IR Policy |
| Incident Response | Incident management, incident investigation and response Practitioner | Follows documented principles and guidelines for incident management, incident investigation and response activities | Covered | NIST Incident Response Lifecycle |
| Incident Response | Incident management, incident investigation and response Practitioner | Advises others on incident management, incident investigation and response processes | Partial | Lessons Learned Meeting |
| Incident Response | Information risk assessment and risk management Practitioner | Understands the organisation’s business drivers and approach to managing risk to support delivery of balanced and cost-effective risk management decisions on situations with a relatively well-defined scope. Relates risk to corporate governance, organisational strategic direction and planning | Partial | Incident Prioritization |
| Incident Response | Information risk assessment and risk management Practitioner | Delivers or reviews risk assessments using appropriate risk assessment methods for common scenarios such as enterprise IT systems | Partial | Understanding Vulnerability Management Process. |
| Incident Response | Information risk assessment and risk management Practitioner | Inspects and reports on the security characteristics of systems with straightforward scope | Covered | Perform Windows Security Assessments with CIS-CAT Lite |
| Incident Response | Information risk assessment and risk management Practitioner | Has a good understanding of how assessed risks are addressed as part of an approach to risk treatment | Partial | Understanding Vulnerability Management Process. |
| Incident Response | Intrusion detection and analysis Working | Understands and explains the basic principles of monitoring network and system activity to identify potential intrusion or other anomalous behaviour | Covered | Network-Based Intrusion and Prevention Systems (NIDS/NIPS) |
| Incident Response | Intrusion detection and analysis Working | Uses information provided from various sources to identify, analyse, and report events that occur or might occur within the network. Uses a range of methods and procedures to identify, acquire, and preserve artefacts by means of controlled and documented analytical and investigative techniques | Covered | The Threat Hunting Process |
| Incident Response | Intrusion detection and analysis Working | Understands the business context of the activities | Covered | Incident Prioritization |
| Incident Response | Threat intelligence and threat assessment Working | Understands and can explain threat intelligence and threat assessment principles and concepts | Covered | Threat Intelligence: Mitigating and Defending |
| Incident Response | Threat intelligence and threat assessment Working | Uses prescribed tools and techniques to acquire, validate and analyse threat information from multiple sources | Partial | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Incident Response | Threat intelligence and threat assessment Working | Under direction enriches threat information by providing context, assessing possible implications and summarising the behaviour, capabilities and activities of threat actors | Covered | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Incident Response | Threat intelligence and threat assessment Working | Uses approved techniques to model routine threats, under supervision, to identify common enterprise attack vector, identify critical organisational functions, and protect organisational assets and goals | Partial | MITRE ATT&CK: Mapping a Full Attack Scenario |
| Incident Response | Threat intelligence and threat assessment Working | Applies knowledge to prioritise remediation of identified vulnerabilities for a single asset or system | Covered | Understanding Vulnerability Management Process. |
| Incident Response | Applied security capability Awareness | Understands why security must support business needs and the importance of being able to demonstrate that relationship | Covered | Incident Prioritization |
| Incident Response | Applied security capability Awareness | Aware of some key, well-understood, security principles and can demonstrate an awareness of some Cyber Security relevant technologies | Covered | Defense in Depth |
| Incident Response | Applied security capability Awareness | Understands why it is important to gain confidence in security measures and can describe some straightforward mechanisms such as pen-tests | Covered | Effective Incident Prevention Strategies and Controls |
| Incident Response | Applied security capability Awareness | Understands and can describe basic security concepts | Covered | Threats, Vulnerabilities, and Risks |
| Incident Response | Protective security Awareness | Maintains an up-to-date understanding of fundamentals of all areas of security (especially in the context of government), and appreciates the importance of making use of a combination and multi-layering of appropriate and proportionate Physical, Personnel and Cyber Security measures to protect assets | Partial | Defense in Depth |
| Incident Response | Protective security Awareness | Identifies aspects from across the breadth of the security field | Partial | Effective Policies: Business Protection Through Documentation |
| Incident Response | Protective security Awareness | Promotes protective security, providing advice to others | Partial | Effective Policies: Business Protection Through Documentation |
| Incident Response | Threat Understanding Awareness | Describes specific threats and how they may manifest themselves in a local environment | Covered | Attack Vectors: Pathways for Threats |
| Incident Response | Threat Understanding Awareness | Maintains understanding of local threat environment and can apply to inform and provide context for wider activities | Covered | How to Hunt Effectively? |
| Incident Response | Threat Understanding Awareness | Uses local threat information in decision-making and planning | Covered | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Incident Response | Threat Understanding Awareness | Demonstrates knowledge of current threats and trends affecting the landscape | Partial | The Evolving Threat Landscape |
| Digital Forensics | Forensics Working | Analyses digital evidence and investigates computer security incidents to derive information required to help resolve security incidents, and/or identify breaches of policy, regulation or law | Covered | Persistent Malware: Examining Autorun Applications |
| Digital Forensics | Forensics Working | Understands legislative requirements and implications of actions within the organisation context | Partial | IR Policy |
| Digital Forensics | Forensics Working | Undertakes real-time analysis of ongoing incidents on live systems to identify relevant artefacts, understand the incident and facilitate resolution | Covered | [Walkthrough] Artifact Collections:Â Windows.Analysis.EvidenceOfDownload |
| Digital Forensics | Forensics Working | Able to identify suspicious software, including potential malware sources | Covered | Case Study: Automated Analysis of Emotet Malware Sample |
| Digital Forensics | Forensics Working | Secures the scene of an incident, with little requirement for supervision, acquiring and handling evidence in accordance with legal guidelines and in the most effective manner to minimise disruption to the business, ensuring that the chain of custody is maintained | Partial | Topic 3: Disk Acquisition: Write-Blocking |
| Digital Forensics | Forensics Working | Presents conclusions in a manner suited to the context (written or oral), and is able to effectively defend conclusions, and provide evidence and testimony as required | Partial | Incident Report |
| Digital Forensics | Intrusion detection and analysis Working | Understands and explains the basic principles of monitoring network and system activity to identify potential intrusion or other anomalous behaviour | Covered | Network-Based Intrusion and Prevention Systems (NIDS/NIPS) |
| Digital Forensics | Intrusion detection and analysis Working | Uses information provided from various sources to identify, analyse, and report events that occur or might occur within the network. Uses a range of methods and procedures to identify, acquire, and preserve artefacts by means of controlled and documented analytical and investigative techniques | Covered | The Threat Hunting Process |
| Digital Forensics | Intrusion detection and analysis Working | Understands the business context of the activities | Covered | Incident Prioritization |
| Digital Forensics | Information risk assessment and risk management Working | Supports security professionals in carrying out risk assessments and developing mitigation strategies for relatively common and well-understood scenarios | Partial | Understanding Vulnerability Management Process. |
| Digital Forensics | Information risk assessment and risk management Working | Has an understanding of, and can apply, the fundamental principles of risk assessment, risk management processes and decision-making | Partial | Threats, Vulnerabilities, and Risks |
| Digital Forensics | Threat intelligence and threat assessment Working | Understands and can explain threat intelligence and threat assessment principles and concepts | Covered | Threat Intelligence: Mitigating and Defending |
| Digital Forensics | Threat intelligence and threat assessment Working | Uses prescribed tools and techniques to acquire, validate and analyse threat information from multiple sources | Partial | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Digital Forensics | Threat intelligence and threat assessment Working | Under direction enriches threat information by providing context, assessing possible implications and summarising the behaviour, capabilities and activities of threat actors | Covered | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Digital Forensics | Threat intelligence and threat assessment Working | Uses approved techniques to model routine threats, under supervision, to identify common enterprise attack vector, identify critical organisational functions, and protect organisational assets and goals | Partial | MITRE ATT&CK: Mapping a Full Attack Scenario |
| Digital Forensics | Threat intelligence and threat assessment Working | Applies knowledge to prioritise remediation of identified vulnerabilities for a single asset or system | Covered | Understanding Vulnerability Management Process. |
| Digital Forensics | Threat Understanding Working | Interprets sources of threat information for the local environment and applies knowledge of the external environment | Covered | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Digital Forensics | Threat Understanding Working | Maintains understanding of local and strategic threat environments, and trends affecting the landscape, and can apply to inform and provide context | Partial | The Evolving Threat Landscape |
| Digital Forensics | Threat Understanding Working | Uses local and strategic threat information in decision-making and planning | Partial | Intelligence-Driven Hunting: APT29 (Cozy Bear) |
| Digital Forensics | Threat Understanding Working | Communicates tailored threat information to relevant local stakeholders within the organisation | Covered | Incident Report |
| Digital Forensics | Legal and regulatory environment and compliance Awareness | Describes the major legislative regulatory instruments relevant to security legislation and regulation relevant to the role | Partial | Security Standards: Compliance is Mandatory |
| Digital Forensics | Legal and regulatory environment and compliance Awareness | Follows documented procedures for compliance or regulations | Partial | IR Policy |
| Digital Forensics | Protective security Awareness | Maintains an up-to-date understanding of fundamentals of all areas of security (especially in the context of government), and appreciates the importance of making use of a combination and multi-layering of appropriate and proportionate Physical, Personnel and Cyber Security measures to protect assets | Partial | Defense in Depth |
| Digital Forensics | Protective security Awareness | Identifies aspects from across the breadth of the security field | Partial | Effective Policies: Business Protection Through Documentation |
| Digital Forensics | Protective security Awareness | Promotes protective security, providing advice to others | Partial | Effective Policies: Business Protection Through Documentation |
Train for the roles these frameworks describe
Training a team? Talk to us →
Defend Smarter, Not Harder