Security Monitoring
Security Monitoring is a critical capability in Cybersecurity, built upon vigilance, knowledge, and prompt response. It involves the continuous observation and assessment of systems to detect, analyze and address potential threats. This capability is instrumental in protecting data integrity, thus safeguarding an organization's reputation and operations.
Foundational
At a foundational level you are able to follow basic security monitoring procedures and report unusual activity or alerts to the appropriate team members. You understand the importance of vigilance and know how to use standard monitoring tools under supervision. Your actions help maintain day-to-day system safety and support a rapid response to potential cybersecurity threats.
Developing
At a developing level you are beginning to recognize common security events and follow established procedures to report them. You rely on guidance when monitoring systems and interpreting potential threats, but you are building confidence in using security tools. Your actions help ensure that early risks are noticed and escalated to protect organizational information.
Proficient
At a proficient level you are able to independently monitor security systems, interpret alerts, and recognize unusual activity that could signal a threat. You confidently apply established procedures to investigate incidents and escalate them when needed. Your vigilance helps protect sensitive data and supports the organization’s ongoing security and reputation.
Advanced
At an advanced level you are leading proactive security monitoring across complex systems, swiftly identifying patterns and unusual activity others may miss. You guide teams in refining detection tools and processes, turning insight into rapid, effective action. Your expertise helps prevent incidents before they escalate, strengthening the organization’s overall security posture.
Expert
At an expert level you are leading the design, implementation, and continuous improvement of advanced security monitoring strategies across the organization. You anticipate emerging threats, guide your team through complex analysis, and ensure monitoring aligns with business needs. Your actions directly strengthen the organization’s ability to prevent, detect, and respond to sophisticated cyber risks.
Security Policy Compliance
Security Policy Compliance is the ability to adhere to and implement security protocols established by an organization. This capability requires understanding the scope of various cybersecurity policies, ensuring that all business operations align with set guidelines. It further impacts the organization's security posture by minimizing risk exposure and protecting sensitive data.
Foundational
At a foundational level you are aware of your organization’s cybersecurity policies and follow them in your daily work. You recognize the importance of these rules for protecting sensitive information and reducing risks. By consistently applying basic security protocols, you help maintain a safer digital environment for everyone.
Developing
At a developing level you are beginning to follow the organization’s security policies in your daily work, asking questions where you are unsure. You can identify when your actions align or do not align with key security procedures. Your growing awareness helps reduce basic errors and supports safer practices across your team.
Proficient
At a proficient level you are consistently applying organizational security policies to your daily work and ensuring your team adheres to these protocols. You understand the importance of following detailed procedures when handling sensitive data and responding to security incidents. Through your reliable compliance, you help reduce risks and strengthen the overall security of your organization.
Advanced
At an advanced level you are able to interpret, implement, and monitor complex security policies across different teams and technologies. You confidently advise others on policy requirements, proactively identify gaps, and resolve non-compliance before risks escalate. Your actions ensure that security standards are met consistently, strengthening your organization’s ability to protect sensitive data and respond to threats.
Expert
At an expert level you are trusted to interpret, evolve, and champion security policy compliance across the organization. You guide teams in resolving complex policy challenges, ensuring all processes, systems, and innovations strictly align with ever-changing security standards. Through your leadership, the organization consistently minimizes risk and sets benchmarks for best-practice security.
Security Risk Assessment
Security Risk Assessment is the systematic identification and evaluation of potential cybersecurity threats or vulnerabilities. It involves analyzing an organization's digital infrastructure and data handling practices, aiming to highlight potential areas where breaches could occur. Executing effective Security Risk Assessments contributes to robust cybersecurity strategies, minimizing potential damage from cyber-attacks, and ensuring data protection compliance.
Foundational
At a foundational level you are able to recognize basic cybersecurity risks and understand why identifying these threats is important. You follow clear instructions to help gather information for security risk assessments. Your involvement helps your team spot obvious vulnerabilities, contributing to a safer digital environment for the organization.
Developing
At a developing level you are able to assist with identifying basic security risks and support more experienced staff during risk assessments. You follow established procedures and contribute to gathering and documenting relevant information. Your involvement helps your team build a more complete understanding of the organization’s cybersecurity threats.
Proficient
At a proficient level you are able to independently conduct thorough security risk assessments across a range of digital systems and processes. You can identify and evaluate threats and vulnerabilities, clearly outlining the potential business impact. Your work directly strengthens your organization’s ability to prioritize risks and improve its overall cyber resilience.
Advanced
At an advanced level you are able to lead comprehensive security risk assessments across complex digital environments, proactively identifying hidden vulnerabilities and emerging threats. You adapt established frameworks to suit your organization’s needs, ensuring thorough analysis and clear recommendations. Your insights shape decision-making, directly strengthening defences and supporting compliance.
Expert
At an expert level you are trusted to lead security risk assessments across complex digital environments, setting standards and guiding others in best practice. You proactively identify emerging threats and adapt risk strategies to meet evolving organizational needs. Your actions significantly reduce exposure to cyber risks and ensure ongoing compliance with regulatory requirements.
Threat Intelligence Analysis
Threat Intelligence Analysis is essential knowledge in countering cyberattacks. It encompasses the ability to interpret and mitigate potential cyber threats by analyzing patterns and predictive data. Consequently, it safeguards data integrity and builds a resilient digital environment, improving overall cybersecurity.
Foundational
At a foundational level you are able to recognize basic cyber threats and understand how they might impact your organization. You use established sources to stay aware of common risks and report unusual activity to the right teams. This means you help protect data and support a safer digital environment from the ground up.
Developing
At a developing level you are able to recognize basic threat patterns and gather simple intelligence from clear sources. You use guidance to help analyze data, beginning to spot potential cyber risks within your area of work. This helps your team respond more quickly to emerging threats and protect key information.
Proficient
At a proficient level you are capabilityed at gathering and interpreting threat intelligence to spot emerging cyber risks. You can recognize patterns in incidents and use these insights to recommend practical defences for your organization. Your work helps safeguard systems and builds a more secure digital environment.
Advanced
At an advanced level you are able to identify and interpret emerging cyber threat patterns, turning complex information into clear, actionable insights. You use industry sources and data analytics to anticipate and respond to sophisticated threats. Your expertise enables your organization to act early, reducing risk and strengthening overall digital security.
Expert
At an expert level you are leading the design and execution of advanced threat intelligence analysis, drawing on deep understanding to identify, assess, and respond to emerging cyber threats. You guide teams, set strategy, and integrate threat intelligence across the organization. Your expertise directly strengthens cyber defences and enables a proactive security posture.
Penetration Testing
Penetration Testing is a critical method of assessing the security of digital systems. This process involves simulating cyber-attacks to identify areas of weakness in the system, therefore preventing exploitation by malicious hackers. Proficiency in this area requires adept analytical skills, strong knowledge of network systems, and consistent attention to emerging cyber threats. This ability not only reinforces system security but also significantly mitigates the risk of severe data breaches.
Foundational
At a foundational level you are familiar with the basic purpose of penetration testing and can recognize common types of system vulnerabilities. You understand why controlled testing is important for protecting information and can follow instructions to support more experienced team members. Your involvement helps strengthen the organization’s defences from the outset.
Developing
At a developing level you are able to assist in basic penetration testing activities under supervision, following established procedures to help identify common vulnerabilities. You contribute to documenting findings and support more experienced team members in the analysis of results. Your efforts help the cybersecurity team strengthen system defences and build your confidence for more advanced testing work.
Proficient
At a proficient level you are able to independently plan and carry out penetration tests on a range of systems, accurately identifying and reporting security gaps. You use up-to-date techniques and tools to simulate real-world cyber threats, ensuring findings are practical and understandable. Your work directly helps prevent breaches and improves the organization’s overall security.
Advanced
At an advanced level you are able to design and carry out comprehensive penetration tests on complex digital systems, uncovering vulnerabilities that others may miss. You adapt your methods to new technologies and evolving threats, ensuring defences stay ahead of attackers. Your work directly strengthens the organization’s security and reduces the chance of major breaches.
Expert
At an expert level you are able to design, plan, and lead complex penetration tests, uncovering sophisticated vulnerabilities that others may miss. You use your deep understanding of systems and threats to develop advanced strategies that strengthen organizational security. Your work sets the highest standard for risk mitigation, protecting critical assets from evolving cyber-attacks.
Vulnerability Management
Vulnerability Management is the process of identifying, assessing, and mitigating cybersecurity risks. capabilityed in utilising preventative tools, these individuals continuously monitor, evaluate and deploy protective strategies against potential threats. Their actions limit exposure, contribute to a robust cybersecurity framework and safeguard organizational infrastructures, thereby ensuring data integrity and reliability.
Foundational
At a foundational level you are aware of common cybersecurity vulnerabilities and the importance of keeping systems up to date. You follow basic procedures to report suspected issues and assist with routine checks under guidance. Your actions help reduce risks and support the organization’s broader efforts to protect information and systems.
Developing
At a developing level you are able to identify common cybersecurity vulnerabilities using basic tools and follow established procedures to help manage them. You support more experienced colleagues by gathering information and reporting potential risks. Your actions help reduce simple security gaps and add to the organization’s overall cyber safety.
Proficient
At a proficient level you are capabilityed at identifying and assessing cybersecurity vulnerabilities using established tools and processes. You routinely prioritize risks, recommend suitable responses, and oversee the implementation of solutions within your area. Your actions strengthen the organization’s defences and reduce the likelihood of incidents impacting critical systems or data.
Advanced
At an advanced level you are capabilityed at leading vulnerability assessments, using automated tools and manual techniques to identify risks across complex systems. You design and implement proactive strategies that address emerging threats and strengthen the organization’s security. Your expertise prevents incidents, protects sensitive data, and helps build a resilient cybersecurity environment.
Expert
At an expert level you are trusted to lead complex vulnerability management across the entire organization, setting standards and shaping strategy. You anticipate emerging security threats, drive continuous improvements, and mentor others in advanced practices. Your work protects systems from advanced attacks and builds lasting resilience in the organization’s cybersecurity posture.
Regulatory Compliance (Cyber)
Regulatory Compliance (Cyber) is adherence to legal, ethical, and professional standards set for cybersecurity practices. It calls for a deep understanding of cybersecurity laws and industry norms, and the ability to implement such knowledge to maintain secure systems. This capability shapes a safe digital environment, protecting organizational and client data from cyber threats while maintaining legal equilibrium.
Foundational
At a foundational level you are aware of basic cybersecurity regulations and your organization’s key policies for handling data and digital systems. You follow established procedures to keep information secure and seek guidance if you are unsure about compliance requirements. Your attention to these basics helps the organization meet its legal obligations and build client trust.
Developing
At a developing level you are beginning to recognize key cybersecurity laws and standards relevant to your role, and you follow set compliance processes with guidance. You can identify when something does not meet regulatory requirements and seek help to address it. This helps your team maintain secure practices and avoid potential legal risks.
Proficient
At a proficient level you are able to interpret and apply current cybersecurity laws and regulations to your daily work, ensuring systems and data remain compliant. You confidently manage compliance processes and resolve routine issues with minimal supervision. Your reliable actions help protect the organization from regulatory risks and foster trust with clients and partners.
Advanced
At an advanced level you are confident in interpreting complex cybersecurity regulations and applying them across multiple systems or projects. You anticipate regulatory changes and lead others in adjusting practices to stay compliant. Your expertise ensures your organization manages cyber risks proactively and maintains trust with clients, partners, and regulators.
Expert
At an expert level you are trusted to interpret complex cybersecurity laws and standards, guiding your organization through changing regulatory landscapes. You develop compliance strategies that not only meet legal requirements but set industry benchmarks. Your decisions protect sensitive data and build lasting trust with clients and regulators.
Secure Configuration
Secure Configuration is the proficiency in establishing and maintaining safety parameters on networked systems. It involves knowledge of cybersecurity principles, meticulous attention to detail and regular updates to counter emerging threats. Effectively executed, it shields critical operations from unauthorized access, ensuring operational continuity and data integrity.
Foundational
At a foundational level you are able to follow clear instructions to set up basic security settings on systems and devices. You understand the importance of keeping software up to date and spotting simple misconfigurations. By doing this, you help reduce obvious risks and support the safety of your organization’s information.
Developing
At a developing level you are able to follow clear instructions to apply basic security settings on systems and devices. You recognize why secure configuration matters and seek guidance when adjusting standard settings or updating software. Your careful approach helps prevent simple threats and lays the groundwork for stronger cybersecurity in your team.
Proficient
At a proficient level you are able to apply secure configuration practices to a range of systems and devices, following organizational standards and current cybersecurity guidelines. You can identify and correct common vulnerabilities independently, ensuring systems remain resilient against threats. Your actions help maintain secure operations and protect sensitive information from unauthorised access.
Advanced
At an advanced level you are confidently designing, implementing, and refining secure configurations across complex systems and networks. You anticipate emerging risks, proactively update protections, and guide others in applying robust security measures. Your vigilance safeguards the organization’s most critical data, ensuring resilience against sophisticated threats.
Expert
At an expert level you are trusted to design, lead, and review secure configuration across complex systems, setting the highest standards and adapting quickly to emerging risks. You proactively spot weaknesses others may miss and guide teams through critical updates. Your expertise directly protects vital operations, keeping sensitive data safe and business running smoothly.
Security Awareness Training
Security Awareness Training is the process of educating employees about the potential risks and impacts associated with cyber incidents. This capability involves understanding and identifying cyber threats, knowing how to prevent them, and how to respond if they occur. The outcome is a safer workplace environment, better protected from cyber threats.
Foundational
At a foundational level you are aware of common cyber threats, such as phishing and weak passwords, and understand the basic steps to protect sensitive information. You follow guidance on safe online practices and report anything suspicious to the appropriate contact. By doing this, you help reduce risk and contribute to a safer workplace.
Developing
At a developing level you are starting to recognize common cyber threats and understand basic security practices. You participate in security awareness training and follow standard procedures, asking for guidance when unsure. This helps you avoid simple mistakes and begin contributing to the organization’s safer digital environment.
Proficient
At a proficient level you are able to recognize and respond to common cyber threats, such as phishing, social engineering, and suspicious links, without supervision. You understand the importance of ongoing security awareness and encourage safe practices among your team. This helps prevent incidents and builds a stronger culture of cybersecurity in your workplace.
Advanced
At an advanced level you are able to lead security awareness training sessions, tailoring content to different roles and current threats. You spot gaps in team knowledge and proactively address them, making sure everyone knows how to recognize and respond to even sophisticated attacks. Your work raises the security standard across your workplace.
Expert
At an expert level you are a recognized authority on security awareness training, shaping programs that address emerging cyber threats and human factors. You guide others in best practice, coach leaders, and influence organizational culture to build lasting cyber resilience. Your leadership ensures security awareness is embedded in everyday decisions and behaviors across the workplace.
Security Controls Implementation
Security Controls Implementation is the adept application of measures to protect information systems and data. This involves utilising advanced knowledge of security systems and procedures in a practical setting. Through implementing robust cybersecurity protocols, professionals aid in the reduction of risk, safeguarding vital systems, and defending against malicious cyber activities.
Foundational
At a foundational level you are able to follow basic instructions to apply simple security controls, such as setting strong passwords and updating software on your devices. You recognize the importance of these actions in protecting information and systems. By reliably carrying out these tasks, you support your team’s overall cybersecurity efforts.
Developing
At a developing level you are able to apply basic security controls under guidance, following established procedures to help protect systems and data. You understand why these controls matter and can support their implementation within your area of work. Your contributions help your team maintain a safer computing environment and reduce common cyber risks.
Proficient
At a proficient level you are able to independently select, configure, and apply a range of security controls to protect systems and data across your area of responsibility. You consider business needs and adapt established solutions to changing threats and environments. Your actions reduce vulnerabilities and help ensure the ongoing safety of critical information assets.
Advanced
At an advanced level you are able to design and implement complex security controls that suit the unique needs of your organization. You adapt and optimize measures based on evolving threats, ensuring information systems remain resilient. Your expertise directly reduces risk and strengthens the organization’s overall cybersecurity posture.
Expert
At an expert level you are able to design and lead the implementation of complex security controls across diverse systems and environments. You anticipate emerging threats and adapt solutions to meet evolving organizational needs. Your leadership ensures resilient protection for critical data and assets, setting benchmarks for best practice within your organization.
Security Incident Detection
Security Incident Detection is the ability to identify and discern potential cybersecurity threats and breaches. This capability necessitates an acute understanding of system vulnerabilities, robust analytic skills and a comprehensive knowledge of threat landscape. This subsequently aids in mitigating damage, preventing future breaches and fortifying security infrastructure.
Foundational
At a foundational level you are able to recognize common signs of a cybersecurity incident, such as suspicious emails or unusual system activity. You know when and how to report concerns using your organization’s processes. Your vigilance helps the security team act quickly to minimize potential harm.
Developing
At a developing level you are beginning to recognize common signs of security incidents and know when to escalate concerns to more experienced team members. You follow established procedures to report and document suspicious activity, helping protect systems from basic threats. Your awareness supports your team’s efforts to maintain a secure environment.
Proficient
At a proficient level you are able to reliably detect and assess security incidents, using your strong understanding of threats, vulnerabilities and typical attack behaviors. You routinely review alerts, analyze suspicious activity and escalate genuine risks for response. Your work reduces the impact of incidents and increases the organization’s readiness to prevent future breaches.
Advanced
At an advanced level you are able to independently identify complex and subtle security threats across multiple systems, drawing on a deep understanding of attack methods and emerging risks. You confidently analyze data from diverse sources to quickly spot anomalies and patterns that others may miss. Your early and accurate detection helps limit damage and better prepares your organization for future threats.
Expert
At an expert level you are able to rapidly detect and accurately assess even the most subtle or complex security incidents across diverse systems. You consistently anticipate emerging threats, using advanced analytical skills to inform detection strategies. Your actions significantly reduce risk, limit damage, and guide the organization in continually strengthening its defensive posture.
Security Logging and Reporting
Security Logging and Reporting is the systematic recording and analysis of cybersecurity events. It involves the proficient use of tools to collect, store, and interpret data relating to security incidents, thereby assessing potential threats. The effectiveness of this capability can strengthen an organization's security stance, and predict future breaches, aiding strategic decision-making.
Foundational
At a foundational level you are able to recognize and follow basic procedures for recording security events using standard logging tools. You understand why accurate logging and simple reporting are important for detecting potential threats and supporting investigations. Your careful attention helps your team respond quickly to suspicious activity.
Developing
At a developing level you are able to use basic security logging tools to record and review cybersecurity events under guidance. You can recognize routine patterns in logs and raise concerns about unusual activity to senior team members. Your work helps to maintain foundational awareness of security incidents in the organization.
Proficient
At a proficient level you are able to consistently collect, review and interpret security log data using established tools and methods to identify threats or unusual activity. You monitor and investigate security events, escalating issues where required, and support team reporting on findings. Your actions help strengthen the organization’s response to incidents and improve overall security awareness.
Advanced
At an advanced level you are capabilityed at designing and refining security logging and reporting systems to uncover complex threats and patterns. You use a range of tools to analyze data, spot trends, and produce clear reports that drive critical security decisions. Your work helps the organization pre-empt attacks and improve its overall security posture.
Expert
At an expert level you are leading the design and continuous improvement of advanced security logging and reporting across the organization. You anticipate risks, extract meaningful insights from complex data, and advise senior leaders to strengthen defences and shape strategy. Your work sets benchmarks for proactive threat detection and robust incident response.
Incident Response Coordination
Incident Response Coordination is the capability to manage and construct a swift, effective response to cybersecurity breaches or threats. This involves recognizing potential incidents, determining their impact and coordinating a multidisciplinary response. This capability requires a high level of organizational know-how, strong technical understanding and superb communicative skills.
Foundational
At a foundational level you are able to recognize and report basic signs of a potential cybersecurity incident, following predefined procedures. You understand your role in alerting the right people and providing accurate information. Your quick actions help ensure incidents are escalated early, reducing potential harm to the organization.
Developing
At a developing level you are starting to recognize signs of potential cybersecurity incidents and know when to alert more experienced colleagues. You follow established procedures to support basic response tasks and learn from hands-on involvement. Your actions help ensure incidents are logged and communicated promptly, supporting the overall team response.
Proficient
At a proficient level you are able to recognize and assess cybersecurity incidents quickly and coordinate effective responses involving relevant teams. You understand the steps needed to contain and resolve threats, clearly communicating roles and actions. Your coordination helps minimize disruption and keeps the organization informed throughout the response process.
Advanced
At an advanced level you are leading and orchestrating complex incident responses, ensuring swift collaboration across technical, legal and business teams. You confidently assess incidents, balancing quick action with careful judgment to minimize harm and maintain operations. Your expertise means others look to you for guidance, resulting in strengthened organizational resilience.
Expert
At an expert level you are able to lead the entire organization’s response to major cyber incidents, making swift, clear decisions under pressure. You anticipate threats, guide cross-team collaboration, and ensure that every action reduces risk and builds resilience. Your actions protect the organization’s reputation, operations, and sensitive information at the highest stakes.
Malware Analysis
Malware Analysis is the practice of dissecting and examining malicious software to understand its purpose, functionality, and impact. This involves rigorous knowledge of technology platforms, programming, and operating systems. Proficiency in this capability enables the pro-active detection of security threats, prevention of potential breaches and the design and implementation of effective defense strategies, ensuring organizational cyber resilience.
Foundational
At a foundational level you are aware of what malware is and understand its basic forms and how it impacts systems and data. You can recognize simple signs of malware infection and follow set procedures to report or escalate suspected incidents. Your actions support early detection and help protect the organization from basic cyber threats.
Developing
At a developing level you are able to recognize common types of malware and use basic tools to examine suspicious files safely. You follow established procedures to support investigations and document your findings clearly. You contribute to the early detection of threats and help your team strengthen the organization’s cyber defences.
Proficient
At a proficient level you are able to independently analyze and interpret malware, identifying how it operates and the risks it poses to your organization’s systems. You confidently apply established tools and techniques to uncover threats and support incident response. Your work helps prevent security breaches and strengthens the organization’s overall cyber resilience.
Advanced
At an advanced level you are able to independently analyze complex malware threats, uncovering hidden behaviors and techniques used by attackers. You can produce clear reports and guidance that inform timely security decisions and improve the organization’s defences. Your expertise ensures rapid threat identification, limiting potential impacts and strengthening overall cyber resilience.
Expert
At an expert level you are relied on to lead complex malware investigations, applying deep knowledge of systems, coding, and threat patterns to uncover and neutralize advanced attacks. You mentor others, set analysis standards, and shape proactive defense strategies. Your work directly strengthens the organization’s ability to prevent, detect, and respond to sophisticated cybersecurity threats.
Network Security Management
Network Security Management is the aptitude to maintain, update and monitor security hardware and software to counter potential cybersecurity threats. Involving the development and execution of security protocols and policies, it's essential in safeguarding organizational assets. This capability positively impacts by enhancing a business's resilience against cyber attacks, safeguarding integral data and systems.
Foundational
At a foundational level you are able to follow basic network security procedures set by your organization, such as using approved passwords and correctly handling equipment. You recognize common cyber risks and know when to report anything unusual. Your actions help your team keep systems and data safer from basic threats.
Developing
At a developing level you are able to support basic network security tasks, such as helping to apply standard updates and following set protocols. You work with guidance to monitor security tools and report issues or suspicious activity to more experienced colleagues. Your actions contribute to maintaining secure networks and reducing risks to the organization’s data and systems.
Proficient
At a proficient level you are able to independently manage and update network security systems, following established protocols and addressing common threats as they arise. You apply policies effectively, monitor key security tools, and ensure their continued reliability. Your work strengthens your organization’s ability to prevent disruptions and protect critical data from cyber attacks.
Advanced
At an advanced level you are responsible for designing, implementing, and refining network security protocols to address complex and evolving cyber threats. You proactively monitor and analyze network activity to identify vulnerabilities and respond swiftly to incidents. Your expertise ensures the organization’s networks are consistently resilient, protecting critical data and maintaining business continuity.
Expert
At an expert level you are leading the design, implementation, and continuous improvement of advanced network security measures across complex environments. You anticipate emerging threats and shape security protocols that set a benchmark for the organization. Your expertise ensures the business remains resilient, even against sophisticated attacks, protecting critical data and operations.
Business Continuity (Cyber)
Business Continuity (Cyber) is the ability to maintain essential functions during, and following, a cyber threat. It covers the knowledge needed to create, implement, and manage cyber resilience strategies. This capability ensures organizational resistance to cyber threats and effective recovery post-incident.
Foundational
At a foundational level you are aware of basic business continuity principles in the context of cyber threats. You recognize the importance of following established procedures during a cyber incident and understand your role in supporting organizational resilience. Your actions help ensure essential services continue with minimal disruption.
Developing
At a developing level you are able to support basic business continuity activities in response to cyber threats. You help follow established plans, report incidents, and assist with simple recovery steps so essential services can continue. Your work helps ensure others can carry out their roles during and after minor cyber incidents.
Proficient
At a proficient level you are able to develop and maintain practical business continuity plans focused on cyber threats. You can lead the response to a cyber incident, coordinate recovery efforts, and ensure essential services are restored quickly. Your actions help the organization minimize disruption and build lasting cyber resilience.
Advanced
At an advanced level you are leading the development and execution of robust cyber business continuity plans, ensuring they are tested and updated regularly. You proactively identify vulnerabilities, coordinate complex recovery efforts, and guide others during cyber incidents. Your expertise helps safeguard critical operations and reduces business disruption during and after cyber threats.
Expert
At an expert level you are leading the design and continuous improvement of cyber business continuity strategies across the organization. You anticipate emerging threats, run advanced simulations, and ensure all teams can respond and recover with minimal disruption. Your guidance sets the benchmark for resilience and recovery after any cyber incident.
Cloud Security Management
Cloud Security Management is the proficiency in safeguarding data, applications, and infrastructures involved in cloud computing. This encompasses understanding the unique risks and threats imposed by cloud environments, implementing preventive, mitigative and corrective controls. Mastery of this capability aids in protecting privacy, maintaining data integrity, and achieving compliance, significantly reducing the risk of cyber incidents.
Foundational
At a foundational level you are aware of the basic concepts and risks of cloud security and understand why protecting information in the cloud is important. You can follow standard security procedures when working with cloud platforms and ask for help when needed. Your careful actions help prevent simple security incidents in cloud environments.
Developing
At a developing level you are beginning to recognize common cloud security risks and apply basic safeguards under guidance. You follow established policies to help protect data and systems in cloud environments. Your actions support the team in reducing vulnerabilities and improving compliance, though you still rely on colleagues for more complex security challenges.
Proficient
At a proficient level you are able to assess cloud security risks and apply standard security controls across cloud platforms. You proactively monitor for threats, respond to incidents, and ensure data protection aligns with compliance requirements. Your work keeps sensitive information safer and helps your organization maintain trust and meet legal obligations.
Advanced
At an advanced level you are proactively shaping and overseeing cloud security across complex environments, anticipating risks before they become threats. You design and enforce robust security controls, ensuring data protection and compliance even during rapid change. Your expertise gives the organization strong confidence in the security of its cloud operations.
Expert
At an expert level you are leading the design and continuous improvement of secure cloud architectures, setting strategic direction for cloud security across the organization. You anticipate and neutralize emerging threats by integrating advanced controls and influencing cloud adoption practices. Your expertise ensures robust protection of critical assets and positions the organization as a leader in cloud security.
Data Loss Prevention
Data Loss Prevention is a cybersecurity capability focused on safeguarding sensitive data from outside threats and internal vulnerabilities. It entails the provision of robust security measures, regular network monitoring and the establishment of effective protocols to prevent data leakage. This capability is crucial in maintaining data integrity, protecting user privacy and ensuring organizational compliance with data protection regulations.
Foundational
At a foundational level you are aware of the importance of protecting sensitive data and follow basic procedures to help prevent data leaks. You understand your responsibility to handle information securely and know when to seek guidance if you notice suspicious activity. Your actions support a safe and compliant work environment.
Developing
At a developing level you are able to follow set procedures to identify and report potential data loss incidents. You apply basic data loss prevention tools under guidance, and contribute to maintaining security by handling sensitive information with care. Your actions support the wider cybersecurity team in protecting organizational data and reducing the risk of breaches.
Proficient
At a proficient level you are able to implement and manage data loss prevention tools and processes to reliably protect sensitive data within your organization. You proactively monitor for risks, follow set protocols, and quickly address incidents to minimize impact. Your actions help ensure compliance and maintain trust in your organization’s information security.
Advanced
At an advanced level you are trusted to design, implement and refine data loss prevention strategies across complex systems. You identify emerging risks, lead incident responses, and ensure ongoing compliance with relevant regulations. Your actions strengthen organizational resilience, minimize data breaches, and protect sensitive information against sophisticated threats.
Expert
At an expert level you are trusted to design, lead and continually improve data loss prevention strategies across the entire organization. You identify emerging risks, guide others in implementing advanced controls, and ensure consistent compliance with evolving data protection regulations. Your leadership helps safeguard critical information and reduces the likelihood of data breaches.
Endpoint Protection Management
Endpoint Protection Management is the capabilityful administration of systems designed to secure network endpoints. This includes knowledge of intrusion detection, malware protection, and data leak prevention techniques. It's paramount for protecting an organization's digital operations by preventing, detecting and responding to cyber threats on endpoint devices.
Foundational
At a foundational level you are aware of the basic principles of securing endpoint devices, such as recognizing common threats like malware and understanding the purpose of antivirus and security updates. You follow security policies and report suspicious activity as required. By doing so, you help maintain a safer environment for digital work in your organization.
Developing
At a developing level you are able to follow established processes to support endpoint protection, such as using approved tools to identify threats and applying basic remediation steps. You recognize common cybersecurity risks affecting endpoints and know when to seek guidance for complex issues. Your actions help maintain the organization’s digital safety and reduce risk.
Proficient
At a proficient level you are able to independently manage and maintain endpoint protection across a range of systems, applying best practices to detect and respond to threats. You reliably configure and monitor tools for malware protection, intrusion detection, and data loss prevention. Your skills help prevent security incidents and ensure your organization’s endpoints stay secure.
Advanced
At an advanced level you are able to lead the implementation and optimization of endpoint protection measures across diverse systems and platforms. You proactively identify, assess, and act on complex cyber threats to endpoints, ensuring timely containment and remediation. Your expertise safeguards the organization’s data and operations, setting high standards for security and risk management.
Expert
At an expert level you are leading the design, implementation, and optimization of endpoint protection strategies across complex environments. You anticipate emerging threats, set benchmarks, and guide others in advanced techniques for preventing, detecting, and responding to cyber risks on endpoints. Your comprehensive approach directly strengthens the organization’s resilience and confidence in digital operations.
Identity and Access Management
Identity and Access Management is the safeguarding practice in cybersecurity ensuring that the right individuals get access to the right resources, at the right times and for the right reasons. Effective controls include password protection, access rights verification and limiting system privileges. Mastery of this capability reduces unauthorised access, enhancing system security and integrity.
Foundational
At a foundational level you are aware of the importance of protecting logins and following your organization’s access guidelines. You use strong passwords, report any suspicious activity, and only access information needed for your role. By doing this, you help prevent unauthorised access and support your organization’s overall security.
Developing
At a developing level you are starting to apply basic identity and access management principles in your daily work, such as following guidelines for strong passwords and carefully handling login details. You understand why access controls matter and you check before sharing system access with others. By doing this, you help reduce risks of unauthorised access in your team.
Proficient
At a proficient level you are able to manage user identities and access rights across multiple systems, following established cybersecurity protocols. You assess and adjust permissions to ensure only authorized users can access sensitive information. Your actions help prevent security breaches and maintain the trustworthiness of organizational data.
Advanced
At an advanced level you are proactively designing and implementing robust identity and access management controls across complex systems. You evaluate risks, advise on best practices, and respond swiftly to access-related incidents, often driving improvements. Your actions significantly reduce the chance of unauthorised access and reinforce the security posture of your organization.
Expert
At an expert level you are trusted to design, implement and regularly review complex identity and access management solutions across the organization. You apply industry-leading controls, anticipate and address emerging threats, and guide others in best practices. Your work ensures critical assets remain protected, maintaining organizational trust and preventing costly security incidents.
