European Cybersecurity Skills Framework (ECSF)

The European Cybersecurity Skills Framework (ECSF) is a practical tool to support the identification and articulation of tasks, competences, skills and knowledge associated with the roles of European cybersecurity professionals. It is the EU reference point for defining and assessing relevant skills, as defined in the Cybersecurity Skills Academy, which was recently announced by the European Commission.

The ECSF summarises the cybersecurity-related roles into 12 profiles, which are individually analysed into the details of their corresponding responsibilities, skills, synergies and interdependencies.  It provides a common understanding of the relevant roles, competencies, skills and knowledge mostly required in cybersecurity, facilitates recognition of cybersecurity skills, and supports the design of cybersecurity-related training programmes.

The framework and the corresponding user manual were presented during the 1^st ENISA cybersecurity skills conference, in September 2022.

Within this context, in April 2023, the Commission adopted the Communication on a Cybersecurity Skills Academy, a policy initiative which aims to bring together existing initiatives on cyber skills and improve their coordination, with a view to bridging the cybersecurity talent gap and boosting competitiveness, growth and resilience in the EU. The ECSF constitutes the basis on which the Academy will define and assess relevant skills, monitor the evolution of the skill gaps and provide indications on the new needs.

The impact and the future of the ECSF, as well as its role in the Academy, were elaborated in the 2^nd edition of the ENISA Cybersecurity Skills Conference, which took place in September 2023, in Segovia, Spain.

Remarks of the 2nd ENISA conference on skills were delivered by Despina Spanou, who was Head of Cabinet for European Commission Vice-President Margaritis Schinas, who stated: " Addressing the cybersecurity skills gap in the European Union is urgent. We are already missing hundreds of thousands of jobs in this field and it is important that we find the way to address the gap before even more EU legislation enters into force. The European Cybersecurity Skills Framework developed by ENISA can be key in unlocking the potential of initiatives that will help us reskill professionals, skill more experts, and bring more professionals into both the public and private sectors so that we can have the workforce that we need in the European Union market."

The 3rd Skills Conference, hosted with the Hungarian EU Council Presidency, confirmed the ECSF’s maturity and versatility. It demonstrated how the framework supports workforce planning aligned with NIS2, adapts seamlessly to the AI domain, and enables skills attestation to ensure high competence in cybersecurity professionals.

More information about the ECSF

The framework is presented in detail in the two documents : 

• The ECSF Role Profiles document – Listing the 12 typical cybersecurity professional role profiles along with their identified titles, missions, tasks, skills, knowledge, competences.
• The ECSF User Manual document – Providing guidance and practical examples on how to leverage the framework and benefit from it as an organisation, provider of learning programmes or individual.

Please also find the xlsx format  and the json file of the ECSF.

Also, in the following recorded webinars of #ECSFtalks::

• ECSF explanatory video (3 min)
• Principles, vision, structure and benefits of the ECSF
• Assessing Cyber Skills on the basis of the ECSF
• Take a walk on the CISO side

ECSF Goals in Brief

1. Use of the ECSF ensures a common terminology and shared understanding between the demand (workplace, recruitment) and supply (qualification, training) of cybersecurity professionals across the EU.  
2. The ECSF supports the identification of the critical skill sets required from a workforce perspective. It enables providers of learning programmes to support the development of this critical set of skills and helps policy-makers support targeted initiatives to mitigate the gaps identified in skills.  
3. The framework facilitates an understanding of leading cybersecurity professional roles and the essential skills they require, including soft skills, along with the legislative aspects (if any). In particular, it enables non-experts and HR departments to understand the requirements for resource planning, recruitment and career planning in supporting cybersecurity. 
4. The framework promotes harmonisation in cybersecurity education, training, and workforce development. At the same time, this common European language in the context of cybersecurity skills and roles connects well with the entire ICT professional domain.  
5. The ECSF contributes to achieving enhanced shielding against cyberattacks and to ensuring secure IT systems in society. It provides a standard structure and advice on how to implement capacity building within the European cybersecurity workforce. 

Image

How ENISA will support the governance, implementation and evolution of the ECSF

With the support of a dedicated Ad hoc Working Group, ENISA will continue to work on the implementation and evolution of the ECSF, towards its overall goal to work with EU communities and develop cybersecurity competencies aligned with the ECSF for cybersecurity professionals. 

The mapping of CyberHEAD’s programmes with the ECSF role profiles is helping students to make guided learning choices and understand potential career paths.

Numerous professional certifications bodies have aligned their credentials to the ECSF, effectively bridging the gap between professional workplaces and learning environments.

For any questions or further enquiries on the ECSF or CyberHEAD please contact us at euskills(a)enisa.europa.eu.