European Cybersecurity Skills Framework (ECSF) Role Profiles (September 2022)
European Cybersecurity Skills Framework (ECSF) Role Profiles, September 2022 (v1). 12 role profiles; each profile is a top competency whose children are Main task(s), Key skill(s), and Key knowledge from the official ENISA JSON. Profile competencyText is the official summary statement; mission, alternative titles, deliverables, and e-CF mappings are in comments. ENISA, ISBN 978-92-9204-584-5, DOI 10.2824/859537, CC-BY 4.0. Generated for TLA Toolbox import 2026-08-27. PDF: https://www.enisa.europa.eu/sites/default/files/publications/European%20Cybersecurity%20Skills%20Framework%20Role%20Profiles.pdf.
Demonstrate knowledge of cybersecurity-related certifications.
Demonstrate knowledge of cybersecurity recommendations and best practices.
Demonstrate knowledge of computer systems vulnerabilities.
Demonstrate knowledge of computer programming.
Demonstrate knowledge of penetration testing tools.
Demonstrate knowledge of penetration testing standards, methodologies and frameworks.
Demonstrate knowledge of penetration testing procedures.
Demonstrate knowledge of computer networks security.
Demonstrate knowledge of operating systems security.
Demonstrate knowledge of offensive and defensive security procedures.
Demonstrate knowledge of information technology (IT) and operational technology (OT) appliances.
Demonstrate knowledge of cybersecurity attack procedures.
Decompose and analyse systems to identify weaknesses and ineffective controls.
Conduct technical analysis and reporting.
Use penetration testing tools effectively.
Communicate, present and report to relevant stakeholders.
Identify and solve cybersecurity-related issues.
Deploy penetration testing tools and test programs.
Document and report penetration testing results to stakeholders.
Establish procedures for penetration testing result analysis and reporting.
Organise test plans and procedures for penetration testing.
Select and develop appropriate penetration testing techniques.
Test systems and operations compliance with regulatory standards.
Identify attack vectors, uncover and demonstrate exploitation of technical cybersecurity vulnerabilities.
Identify, analyse and assess technical and organisational cybersecurity vulnerabilities.
Digital Forensics Investigator — Knowledge
Demonstrate knowledge of malware analysis tools.
Demonstrate knowledge of cybersecurity related laws, regulations and legislations.
Demonstrate knowledge of criminal investigation procedures, standards, methodologies and frameworks.
Demonstrate knowledge of testing procedures.
Demonstrate knowledge of digital forensics analysis procedures.
Demonstrate knowledge of digital forensics standards, methodologies and frameworks.
Demonstrate knowledge of digital forensics recommendations and best practices.
Develop and communicate, detailed and reasoned investigation reports.
Explain and present digital evidence in a simple, straightforward and easy to understand way.
Identify, analyse and correlate cybersecurity events.
Collect information while preserving its integrity.
Work ethically and independently; not influenced and biased by internal or external actors.
Select and customise forensics testing, analysing and reporting techniques.
Systematically and deterministic document, report and present digital forensic analysis findings and results.
Inspect environments for evidence of unauthorised and unlawful actions.
Preserve and protect digital evidence and make it available to authorised stakeholders.
Identify, recover, extract, document and analyse digital evidence.
Develop digital forensics investigation policy, plans and procedures.
Demonstrate knowledge of cybersecurity-related technologies.
Demonstrate knowledge of monitoring, testing and evaluating cybersecurity controls' effectiveness.
Demonstrate knowledge of cybersecurity risks.
Demonstrate knowledge of cybersecurity controls and solutions.
Demonstrate knowledge of risk management recommendations and best practices.
Demonstrate knowledge of risk management tools.
Demonstrate knowledge of risk management standards, methodologies and frameworks.
Propose and manage risk-sharing options.
Build a cybersecurity risk-aware environment.
Enable business assets owners, executives and other stakeholders to make risk-informed decisions to manage and mitigate risks.
Analyse and consolidate organisation’s quality and risk management practices.
Implement cybersecurity risk management frameworks, methodologies and guidelines and ensure compliance with regulations and standards.
Develop, maintain, report and communicate complete risk management cycle.
Ensure that all cybersecurity risks remain at an acceptable level for the organisation’s assets.
Monitor effectiveness of cybersecurity controls and risk levels.
Assess cybersecurity risks and propose most appropriate risk treatment options, including security controls and risk mitigation and avoidance that best address the organisation’s strategy.
Identification of threat landscape including attackers’ profiles and estimation of attacks’ potential.
Identify and assess cybersecurity-related threats and vulnerabilities of ICT systems.
Manage an inventory of organisation’s assets.
Develop an organisation’s cybersecurity risk management strategy.
Demonstrate knowledge of responsible information disclosure procedures.
Demonstrate knowledge of multidiscipline aspect of cybersecurity.
Demonstrate knowledge of legal, regulatory and legislative requirements on releasing or using cybersecurity related technologies.
Demonstrate knowledge of cybersecurity standards, methodologies and frameworks.
Demonstrate knowledge of cybersecurity-related research, development and innovation (RDI).
Collaborate with other team members and colleagues.
Monitor new advancements in cybersecurity-related technologies.
Decompose and analyse systems to develop security and privacy requirements and identify effective solutions.
Generate new ideas and transfer theory into practice.
Publish and present scientific works and research and development results.
Lead or participate in the innovation processes and projects including project management and budgeting.
Identify cross-sectoral cybersecurity achievements and apply them in a different context or propose innovative approaches and solutions.
Assist in cybersecurity-related capacity building including awareness, theoretical training, practical training, testing, mentoring, supervising and sharing.
Contributes towards cutting-edge cybersecurity business ideas, services and solutions.
Select and apply frameworks, methods, standards, tools and protocols including a building and testing a proof of concept to support projects.
Conduct experiments and develop a proof of concept, pilots and prototypes for cybersecurity solutions.
Assist in the development of innovative cybersecurity-related solutions.
Advance the current state-of-the-art in cybersecurity-related topics.
Manifest and generate research and innovation ideas.
Conduct research, innovation and development work in cybersecurity-related topics.
Analyse and assess cybersecurity technologies, solutions, developments and processes.
Demonstrate knowledge of testing standards, methodologies and frameworks.
Demonstrate knowledge of secure coding recommendations and best practices.
Demonstrate knowledge of offensive and defensive security practices.
Demonstrate knowledge of secure development lifecycle.
Assess the security and performance of solutions.
Configure solutions according to the organisation’s security policy.
Integrate cybersecurity solutions to the organisation’s infrastructure.
Implement, apply and manage patches to products to address technical vulnerabilities.
Work close with the IT/OT personnel on cybersecurity-related actions.
Document and report on the security of systems, services and products.
Monitor and assure the performance of the implemented cybersecurity controls.
Implement cybersecurity procedures and controls.
Maintain and upgrade the security of systems, services and products.
Securely configure systems, services and products.
Integrate cybersecurity solutions and ensure their sound operation.
Provide cybersecurity-related support to users and customers.
Develop, implement, maintain, upgrade, test cybersecurity products.
Demonstrate knowledge of cybersecurity education and training standards, methodologies and frameworks.
Demonstrate knowledge of cybersecurity awareness, education and training programme development.
Demonstrate knowledge of pedagogical standards, methodologies and frameworks.
Identify and select appropriate pedagogical approaches for the intended audience.
Develop evaluation programs for the awareness, training and education activities.
Utilise existing cybersecurity-related training resources.
Provide training towards cybersecurity and data protection professional certifications.
Develop cybersecurity exercises including simulations using cyber range environments.
Design, develop and deliver learning programmes to cover cybersecurity needs.
Identify needs in cybersecurity awareness, training and education.
Continuously maintain and enhance expertise; encourage and empower continuous enhancement of cybersecurity capacities and capabilities building.
Provide guidance on cybersecurity certification programs for individuals.
Design, develop and deliver cybersecurity simulations, virtual labs or cyber range environments.
Finding new approaches for education, training and awareness-raising.
Evaluate and report trainee’s performance.
Monitor, evaluate and report training effectiveness.
Organise, design and deliver cybersecurity and data protection awareness-raising activities, seminars, courses, practical training.
Develop, update and deliver cybersecurity and data protection curricula and educational material for training and awareness based on content, method, tools, trainees need.
Demonstrate knowledge of auditing-related certification.
Demonstrate knowledge of auditing standards, methodologies and frameworks.
Demonstrate knowledge of conformity assessment standards, methodologies and frameworks.
Demonstrate knowledge of legal, regulatory and legislative compliance requirements, recommendations and best practices.
Audit with integrity, being impartial and independent.
Collect, evaluate, maintain and protect auditing information.
Communicate, explain and adapt legal and regulatory requirements and business needs.
Analyse business processes, assess and review software or hardware security, as well as technical and organisational controls.
Follow and practice auditing frameworks, standards and methodologies.
Organise and work in a systematic and deterministic way based on evidence.
Develop and communicate conformity assessment, assurance, audit, certification and maintenance reports.
Maintain and protect the integrity of audit records.
Execute the audit plan and collect evidence and measurements.
Audit conformity with cybersecurity-related applicable standards.
Audit compliance with cybersecurity-related applicable laws and regulations.
Review target of evaluation, security objectives and requirements based on the risk profile.
Develop an audit plan describing the frameworks, standards, methodology, procedures and auditing tests.
Define audit scope, objectives and criteria to audit against.
Establish the target environment and manage auditing activities.
Establish the methodologies and practices used for systems auditing.
Develop the organisation's auditing policy, procedures, standards and guidelines.
Demonstrate knowledge of privacy-by-design standards, methodologies and frameworks.
Demonstrate knowledge of privacy-Enhancing Technologies (PET).
Demonstrate knowledge of legacy cybersecurity procedures.
Demonstrate knowledge of cybersecurity trends.
Demonstrate knowledge of security architecture reference models.
Demonstrate knowledge of cybersecurity-related requirements analysis.
Coordinate the integration of security solutions.
Build resilience against points of failure across the architecture.
Select appropriate specifications, procedures and controls.
Propose cybersecurity architectures based on stakeholder’s needs and budget.
Guide and communicate with implementers and IT/OT personnel.
Design systems and architectures based on security and privacy by design and by defaults cybersecurity principles.
Draw cybersecurity architectural and functional specifications.
Conduct user and business security requirements analysis.
Assess the implemented architecture to maintain an appropriate level of security.
Adapt the organisation’s architecture to emerging threats.
Evaluate the impact of cybersecurity solutions on the design and performance of the organisation’s architecture.
Collaborate with other teams and colleagues.
Assure the security of the solution architectures through security reviews and certification.
Analyse and evaluate the cybersecurity of the organisation’s architecture.
Coordinate the development, integration and maintenance of cybersecurity components ensuring the cybersecurity specifications.
Establish a secure environment during the development lifecycle of systems, services and products.
Present high-level security architecture design to stakeholders.
Produce architectural documentation and specifications.
Develop organisation’s cybersecurity architecture to address security and privacy requirements.
Design and propose a secure architecture to implement the organisation’s strategy.
Cyber Threat Intelligence Specialist — Knowledge
Demonstrate knowledge of threat actors Tactics, Techniques and Procedures (TTPs).
Demonstrate knowledge of advanced and persistent cyber threats (APT).
Demonstrate knowledge of cyber threat actors.
Demonstrate knowledge of cross-domain and border-domain knowledge related to cybersecurity.
Demonstrate knowledge of cyber Threat Intelligence (CTI) sharing standards, methodologies and frameworks.
Cyber Threat Intelligence Specialist — Skill
Communicate, coordinate and cooperate with internal and external stakeholders.
Identify non-cyber events with implications on cyber-related activities.
Automate threat intelligence management procedures.
Identify threat actors TTPs and campaigns.
Collect, analyse and correlate cyber threat information originating from multiple sources.
Convey the proper security severity by explaining the risk exposure and its consequences to non-technical stakeholders.
Cyber Threat Intelligence Specialist — Task
Articulate and communicate intelligence openly and publicly at all levels.
Leverage intelligence data to support and assist with threat modelling, recommendations for Risk Mitigation and cyber threat hunting.
Coordinate with stakeholders to share and consume intelligence on relevant cyber threats.
Elaborate and advise on mitigation plans at the tactical, operational and strategic level.
Produce actionable reports based on threat intelligence data.
Identify, monitor and assess the Tactics, Techniques and Procedures (TTPs) used by cyber threat actors by analysing open-source and proprietary data, information and intelligence.
Identify and assess cyber threat actors targeting the organisation.
Implement threat intelligence collection, analysis and production of actionable intelligence and dissemination to security stakeholders.
Translate business requirements into Intelligence Requirements.
Develop plans and procedures to manage threat intelligence.
Develop, implement and manage the organisation's cyber threat intelligence strategy.
Demonstrate knowledge of privacy impact assessment standards, methodologies and frameworks.
Cyber Legal, Policy & Compliance Officer — Knowledge
Demonstrate knowledge of cybersecurity policies.
Cyber Legal, Policy & Compliance Officer — Skill
Understand legal framework modifications implications to the organisation’s cybersecurity and data protection strategy and policies.
Understand, practice and adhere to ethical requirements and standards.
Explain and communicate data protection and privacy topics to stakeholders and users.
Conduct, monitor and review privacy impact assessments using standards, frameworks, acknowledged methodologies and tools.
Lead the development of appropriate cybersecurity and privacy policies and procedures that complement the business needs and legal requirements; further ensure its acceptance, comprehension and implementation and communicate it between the involved parties.
Carry out working-life practices of the data protection and privacy issues involved in the implementation of the organisational processes, finance and business strategy.
Comprehensive understanding of the business strategy, models and products and ability to factor into legal, regulatory and standards’ requirements.
Manage legal aspects of information security responsibilities and third-party relations.
Cyber Legal, Policy & Compliance Officer — Task
Develop and propose staff awareness training to achieve compliance and foster a culture of data protection within the organization.
Contribute to the development of the organisation’s cybersecurity strategy, policy and procedures.
Cooperate and share information with authorities and professional groups.
Monitor audits and data protection related training activities.
Assist in designing, implementing, auditing and compliance testing activities in order to ensure cybersecurity and privacy compliance.
Act as a key contact point to handle queries and complaints regarding data processing.
Ensure that data owners, holders, controllers, processors, subjects, internal or external partners and entities are informed about their data protection rights, obligations and responsibilities.
Enforce and advocate organisation’s data privacy and protection program.
Conduct privacy impact assessments and develop, maintain, communicate and train upon the privacy policies, procedures.
Ensure compliance with and provide legal advice and guidance on data privacy and data protection standards, laws and regulations.
Demonstrate knowledge of computer Security Incident Response Teams (CSIRTs) operation.
Demonstrate knowledge of secure Operation Centres (SOCs) operation.
Demonstrate knowledge of incident handling communication procedures.
Demonstrate knowledge of incident handling tools.
Demonstrate knowledge of incident handling recommendations and best practices.
Demonstrate knowledge of incident handling standards, methodologies and frameworks.
Work on operating systems, servers, clouds and relevant infrastructures.
Practice all technical, functional and operational aspects of cybersecurity incident handling and response.
Cooperate with key personnel for reporting of security incidents according to applicable legal framework.
Cooperate with Secure Operation Centres (SOCs) and Computer Security Incident Response Teams (CSIRTs).
Document incident results analysis and incident handling actions.
Establish procedures for incident results analysis and incident handling reporting.
Adopt and develop incident handling testing techniques.
Evaluate the resilience of the cybersecurity controls and mitigation actions taken after a cybersecurity or data breach incident.
Measure cybersecurity incidents detection and response effectiveness.
Assess and manage technical vulnerabilities.
Identify, analyse, mitigate and communicate cybersecurity incidents.
Develop, implement and assess procedures related to incident handling.
Contribute to the development, maintenance and assessment of the Incident Response Plan.
Chief Information Security Officer (CISO) — Knowledge
Demonstrate knowledge of management practices.
Demonstrate knowledge of resource management.
Demonstrate knowledge of cybersecurity procedures.
Demonstrate knowledge of cybersecurity maturity models.
Demonstrate knowledge of ethical cybersecurity organisation requirements.
Chief Information Security Officer (CISO) — Skill
Anticipate cybersecurity threats, needs and upcoming challenges.
Define and apply maturity models for cybersecurity management.
Anticipate required changes to the organisation’s information security strategy and formulate new plans.
Review and enhance security documents, reports, SLAs and ensure the security objectives.
Design, apply, monitor and review Information Security Management System (ISMS) either directly or by leading its outsourcing.
Influence an organisation’s cybersecurity culture.
Develop, champion and lead the execution of a cybersecurity strategy.
Implement cybersecurity recommendations and best practices.
Analyse and comply with cybersecurity-related laws, regulations and legislations.
Analyse and implement cybersecurity policies, certifications, standards, methodologies and frameworks.
Assess and enhance an organisation’s cybersecurity posture.
Review, plan and allocate appropriate cybersecurity resources.
Chief Information Security Officer (CISO) — Task
Manage continuous capacity building within the organisation.
Ensure the organisation’s resiliency to cyber incidents.
Negotiate the cybersecurity budget with the senior management.
Secure resources to implement the cybersecurity strategy.
Report cybersecurity incidents, risks, findings to the senior management.
Develop relationships with cybersecurity-related authorities and communities.
Ensure the senior management approves the cybersecurity risks of the organisation.
Educate senior management about cybersecurity risks, threats and their impact to the organisation.
Supervise the application and improvement of the Information Security Management System (ISMS).
Prepare and present cybersecurity vision, strategies and policies for approval by the senior management of the organisation and ensure their execution.
Define, implement, communicate and maintain cybersecurity goals, requirements, strategies, policies, aligned with the business strategy to support the organisational objectives.
Assess the effectiveness of security controls, reveals and utilise cybersecurity vulnerabilities, assessing their criticality if exploited by threat actors.
Ensure the cybercriminal investigation reveals all digital evidence to prove the malicious activity.
Manage the organisation's cybersecurity-related risks aligned to the organisation’s strategy. Develop, maintain and communicate the risk management processes and reports.
Research the cybersecurity domain and incorporate results in cybersecurity solutions.
Develop, deploy and operate cybersecurity solutions (systems, assets, software, controls and services) on infrastructures and products.
Improves cybersecurity knowledge, skills and competencies of humans.
Perform cybersecurity audits on the organisation’s ecosystem. Ensuring compliance with statutory, regulatory, policy information, security requirements, industry standards and best practices.
Plans and designs security-by-design solutions (infrastructures, systems, assets, software, hardware and services) and cybersecurity controls.
Collect, process, analyse data and information to produce actionable intelligence reports and disseminate them to target stakeholders.
Manages compliance with cybersecurity-related standards, legal and regulatory frameworks based on the organisation’s strategy and legal requirements.
Monitor the organisation’s cybersecurity state, handle incidents during cyber-attacks and assure the continued operations of ICT systems.
Manages an organisation’s cybersecurity strategy and its implementation to ensure that digital systems, services and assets are adequately secure and protected.
European Cybersecurity Skills Framework (ECSF) Role Profiles (September 2022) Proficiency Rubric
Holistic proficiency rubric for evaluating competencies in European Cybersecurity Skills Framework (ECSF) Role Profiles (September 2022)
Proficiency evaluation criterion for European Cybersecurity Skills Framework (ECSF) Role Profiles (September 2022)
Can perform the competency independently