Cybersecurity Workforce Status Update and Objectives

Working Group 7: Cybersecurity Workforce Status Update December 21, 2016 Bill Boni, Co-Chair T-Mobile Drew Morin, Co-Chair FCC Liaison: Erika Olsen

WG7 Objectives Working Group Description: This working group will leverage existing work and best practices to enhance the volume and quality of the workforce. Deliverables: This working group will examine and develop recommendations for the CSRIC s consideration regarding any actions that the FCC should take to improve the security of the nation s critical communications infrastructure through actions to enhance the transparency, skill validation, and best practices relating to recruitment, training, retention, and job mobility of personnel within the cybersecurity field. 2

WG7 Deliverables Demonstrate the application of the National Cybersecurity Workforce Framework (NCWF) to the common and specialized work roles within the communications sector; Identify any gaps or improvements in the NCWF for evolving work roles or skill sets to be included in sector members workforce planning; and Identify, develop and recommend best practices and implementation thereof to mitigate insider threats, including through scalable means to enhance transparency, accountability and validation of skills, knowledge and abilities within the communications sector and particularly with respect to personnel having access to the most critical elements of the nation s communications network assets; The working group should consider means to promote a common lexicon and roadmap that will promote more effective interface with academic institutions and other training environments. NICE and DHS collaborated on the release of version 2.0 of the NCWF, changing the nomenclature back to the NICE Cybersecurity Workforce Framework 3

WG7 Members Bill Boni, Co-chair (T-Mobile) Drew Morin, Co-chair (T-Mobile) Barbara Endicott-Popovsky (UW) Bill Newhouse (NIST) Chris Boyer (AT&T Services) Daishi Sakakibara (NTT) Erik Wallace (Commtech Telecomm) Frank Cicio (CWA) Jay English (APCO International) John Hoag (Case Western Reserve) Kathrina Hardy (Verizon) Kathy Whitbeck (Nsight) Kazuhiro Gomi (NTT America) Kim Keever (Cox) Masato Kimura (NTT) Matthew Straeb (Alert FM) Mike Geller (Cisco Systems) Nobumitsu Takeuchi (NTT) Philip Linse (CenturyLink) Quentin Sa Lay (Comcast NBC Universal) Scott Haas (IID Security Central) Shawn Matthews (PacOpticNetworks, LLC) Shinichi Hirata (NTT Corporation) Shinichi Yokohama (NTT) Steve Mace (NCTA) Upendra Chivukula (State of New Jersey) FCC Liaison: Erika Olsen 4

WG7 Schedule March 2016: Submission of Cybersecurity Framework with Extensions for Communication Sector in Interim Report [COMPLETE] December 2016: Submission of Draft WG7 Report on Best Practices and Implementation Recommendations [COMPLETE] March 2017: Submission of Final WG7 Report on Best Practices and Implementation Recommendations We are on track to complete the Working Group report and recommendations on schedule 5

Final Report and Best Practices WG7 segmented the information gathering and analysis to capture section specific best findings and formulate practices/challenges/opportunities in cybersecurity workforce development Internal Segments External Segments Industry Public Safety Academia Federal Government State Government Financial Sector 6

4th Calendar Quarter Activities Continue bi-weekly conference calls Educational Presentations hosted: Role Profile KSAs Read Out from CWA activities NICE Cybersecurity Workforce Framework update from NIST Complete gathering of segment specific data for analysis Conduct analysis and document findings by segment Identify best practices by segment Provide Quarterly update to Steering Committee and Council 7

Next Steps - Schedule Complete Data Gathering by Segment Complete Data Analysis by Segment Complete Best Practices Documentation by Segment Identify Segment Specific Best Practices First Draft for each Segment Draft report complete to include identification of Recommendations and Best Practices Final Report Complete December 1, 2016 February 1, 2016 February 14, 2016 August 1, 2016 September 1, 2016 October 1, 2016 November 1, 2016 Current Status 8

Feedforward to CSRIC The focus of this report is on collaboratively identifying common best practices that the Communications Industry can adopt or support to address the widening gap between the number of cyber security skilled workers and the number of openings Tactical approaches to address immediate needs will not solve this problem and are likely to exacerbate the challenge Recruiting from Universities has depleted the number of qualified instructors making it more difficult to educate and develop the future workforce Recruiting from Department of Defense and other existing practitioners does not address the GAP, but merely moves it (like squeezing a balloon) As an industry, we need to work together to address the need to develop long term solutions that create a sustainable, growing workforce with the skills necessary to narrow the gap 9

Next Step Activities Continue the process of editing and completing the document Document Best Practices from each Segment (mostly complete) Consolidate Best Practices across Segments into top ten list Identify and document any additional specific recommendation(s) to CSRIC V to include forward looking activities in support of the communications industry application of the NCWF 10