For those working in the U.S. federal government, or as contractors, the mapping of the CISSP to the DoD 8140 Cyber Workforce Qualification Provider Marketplace is a significant recognition of the credential. Similarly, EU-based cyber professionals can also map their CISSP accomplishment to the European Cybersecurity Skills Framework (ECSF).
What is the ECSF?
The EU cybersecurity legislative landscape has undergone significant change in the last years. Responding to a variety of external factors and the need to develop cybersecurity expertise in-region, several initiatives and pieces of cybersecurity legislation have come into force. Established by the European Union Agency for Cybersecurity (ENISA) in 2022, the ECSF ensures a common terminology and shared understanding across the profession and helps the alignment with the legislative framework in the EU.
As established through the ISC2 Cybersecurity Workforce Study, the profession has faced a talent shortage, which has evolved into a clearly defined skills gap. ENISA identified the impact this issue was having across the region and established the ECSF to address current and future skills gaps and shortages. Their aim is not only to increase the number of cybersecurity professionals, but to ensure they are properly qualified and equipped for the roles that have been defined. The framework establishes 12 individual profiles across the profession, detailing the mission of the role for each, as well as the primary tasks, required skills and essential knowledge needed. Beyond the summary, each role is also mapped to the European e-Competence Framework (e-CF).
The 12 profiles are designed for use by several different audiences: hiring organizations, training providers, the individual professional, policy makers and professional associations.
CISSP Cyber Roles in the ECSF
As EU member states work together to tackle their cybersecurity issues, they recognize the knowledge and value that CISSPs bring to their organizations, as key players in developing and maintaining their common defense and security. For this article, we will focus on how YOU as a professional can map your CISSP credential to the six relevant profiles established by the ECSF:
Chief Information Security Officer
The ECSF provides alternative titles for this role (including Head of Information Security and Cybersecurity Programme Director) and this individual manages their organisation’s cybersecurity strategy and implementation to ensure that digital systems, services and assets are adequately secure and protected. The primary deliverables are cybersecurity strategy and policy. While the ISSMP is the recommended ISC2 qualification, the CISSP is an alternative. Until October 2023, CISSP was a pre-requisite for the ISSMP credential.
Cyber Legal Policy and Compliance Officer
This role can also be referred to as a Cybersecurity Legal Officer, a Data Protection Officer, an Information Governance Officer, or others. This individual manages compliance with cybersecurity-related standards, legal and regulatory frameworks based on their organisation’s strategy and legal requirements. A professional in this role must have knowledge of cybersecurity-related laws, regulations and legislations, as well as standards, methodologies and frameworks, and policies. A strong understanding of compliance requirements, as well as how to thoroughly conduct assessments is part of what makes the CISSP ideal for this role. CGRC and CCSP are relevant alternatives.
Cybersecurity Architect
Sometimes referred to as a Cybersecurity Designer or a Data Security Architect, this role plans and designs security-by-design solutions and cybersecurity controls. Strong knowledge of best practices, risks, threats and trends are vital for this role. While the ISSAP is the recommended ISC2 qualification, the CISSP is a relevant alternative, as are the CSSLP, CGRC and CCSP. Until October 2023, CISSP was a pre-requisite for the ISSAP credential.
Cybersecurity Auditor
While this role could be referred to as an Information Security Auditor, Data Protection Assessment Analyst, or several others, the primary focus is to perform cybersecurity audits on the organization's ecosystem ensuring compliance with statutory, regulatory, policy information, security requirements, industry standards and best practices. Key knowledge of cybersecurity controls and solutions, monitoring, testing and evaluating effectiveness, auditing standards and more are required for this role. ISC2 recommends the CGRC for this role, with the CISSP and ISSMP both relevant alternatives.
Cybersecurity Educator
Often referred to as a Cybersecurity Trainer or a faculty member, this role is unique from the others on the list. This is focused on improving cybersecurity knowledge, skills and competencies of others which can include students in a formal training program. Skills in designing, developing and delivering learning programs are vital, as well as the ability to provide training toward cybersecurity and data protection professional certifications. The CC is the recommended credential, with the CISSP as a relevant alternative.
Cybersecurity Risk Manager
Alternative titles for this role include Information Security Risk Analyst, Risk Assessor or Impact Analyst. The mission of the role is to continuously manage the cybersecurity-related risks of ICT infrastructures, systems and services through planning, applying, reporting and communicating risk analysis, assessment and treatment. Knowledge of risk management tools, cybersecurity threats, best practices and more are vital. ISC2 recommends the CGRC, with the CISSP and SSCP both relevant alternatives.
Impact for CISSPs
For CISSP holders – or those aspiring to earn the certification – the ECSF profile provides a valuable reference to guide career development through a shared language and common understanding across the EU. Mapping CISSP to the ECSF helps certified professionals clearly demonstrate the knowledge and skills aligned with specific roles, while aspiring CISSPs can better understand how the certification supports the development of competencies required for those roles.
You can use the ECSF to make professional choices and position yourself for advancement in your career. When you have a clear understanding of the cybersecurity work requirements – and the relevancy of the CISSP in particular to those roles – you can ensure you are following a path to the goals you have established for yourself.
The ECSF manual provides a five-step process to individuals who wants to pursue a career in cybersecurity:
- Analyse your skillset including transferable skillset
- Identify specific, interests or goals
- Choose the relevant ECSF profiles that align to your interest and goals
- Adapt your learning path to develop the skills required for your chosen role(s).
- Apply your knowledge and validate your skills through certifications or other recognized qualifications.