Investigation · IN-WRL-001 · OPM code 221
Cybercrime Investigation
From NICE Framework Components v2.2.0
Description
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0Responsible for investigating cyberspace intrusion incidents and crimes. Applies tactics, techniques, and procedures for a full range of investigative tools and processes and appropriately balances the benefits of prosecution versus intelligence gathering.
Tasks
From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it
Free · NICE Framework Components v2.2.0T0173 Perform timeline analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0193 Process crime scenes
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1090 Determine best methods for identifying the perpetrator(s) of a network intrusion
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1094 Conduct victim and witness interviews
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1095 Conduct suspect interrogations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1137 Investigate suspicious activity and alleged digital crimes
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1187 Establish internal and external cross-team relationships
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1192 Conduct analysis of computer network attacks
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1196 Determine if security incidents are indicative of a violation of law that requires specific legal action
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1198 Identify data or intelligence of evidentiary value
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1199 Identify digital evidence for analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1200 Identify elements of proof of cybersecurity crimes
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1207 Collect documentary or physical evidence of cyber intrusion incidents, investigations, and operations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1241 Document cybersecurity incidents
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1242 Escalate incidents that may cause ongoing and immediate impact to the environment
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1324 Process digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1325 Document digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1439 Assess the behavior of individual victims, witnesses, or suspects during cybersecurity investigations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1456 Determine the impact of threats on cybersecurity
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1477 Advise trial counsel as technical expert
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1505 Analyze cybersecurity threats for counter intelligence or criminal activity
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1510 Preserve digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1526 Identify responsible parties for intrusions and other crimes
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1600 Prepare investigative reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1639 Assess target vulnerabilities and operational capabilities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1712 Recommend potential courses of action
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2052 Disseminate investigative report findings
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2053 Deconflict investigative activity with other law enforcement agencies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2054 Determine appropriate jurisdiction for legal action
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT2055 Collect physical evidence of cyber intrusion incidents, investigations, and operations
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yet
Knowledge
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- K0675Knowledge of risk management processes
- K0676Knowledge of cybersecurity laws and regulations
- K0677Knowledge of cybersecurity policies and procedures
- K0678Knowledge of privacy laws and regulations
- K0679Knowledge of privacy policies and procedures
- K0680Knowledge of cybersecurity principles and practices
- K0681Knowledge of privacy principles and practices
- K0682Knowledge of cybersecurity threats
- K0683Knowledge of cybersecurity vulnerabilities
- K0684Knowledge of cybersecurity threat characteristics
- K0685Knowledge of access control principles and practices
- K0686Knowledge of authentication and authorization tools and techniques
- K0716Knowledge of host access control (HAC) systems and software
- K0717Knowledge of network access control (NAC) systems and software
- K0732Knowledge of intrusion detection tools and techniques
- K0744Knowledge of operating system (OS) systems and software
- K0751Knowledge of system threats
- K0752Knowledge of system vulnerabilities
- K0759Knowledge of client and server architecture
- K0770Knowledge of system administration principles and practices
- K0784Knowledge of insider threat laws and regulations
- K0785Knowledge of insider threat tools and techniques
- K0788Knowledge of adversarial tactics principles and practices
- K0789Knowledge of adversarial tactics tools and techniques
- K0790Knowledge of adversarial tactics policies and procedures
- K0795Knowledge of digital evidence seizure policies and procedures
- K0796Knowledge of digital evidence preservation policies and procedures
- K0800Knowledge of evidence admissibility laws and regulations
- K0802Knowledge of chain of custody policies and procedures
- K0804Knowledge of persistent data principles and practices
- K0821Knowledge of federal agency roles and responsibilities
- K0833Knowledge of cyberattack actor characteristics
- K0837Knowledge of hardening tools and techniques
- K0859Knowledge of encryption tools and techniques
- K0884Knowledge of covert communication tools and techniques
- K0892Knowledge of cyber defense laws and regulations
- K0899Knowledge of crisis management protocols
- K0900Knowledge of crisis management processes
- K0901Knowledge of crisis management tools and techniques
- K0909Knowledge of abnormal physical and physiological behaviors
- K0923Knowledge of operating system structures and internals
- K0962Knowledge of targeting laws and regulations
- K0963Knowledge of exploitation laws and regulations
- K0969Knowledge of cyber-attack tools and techniques
- K0983Knowledge of computer networking principles and practices
- K1014Knowledge of network security principles and practices
- K1079Knowledge of web application security risks
- K1138Knowledge of cybersecurity standards and best practices
- K1151Knowledge of digital evidence cataloging tools and techniques
- K1152Knowledge of digital evidence extraction tools and techniques
- K1153Knowledge of digital evidence handling principles and practices
- K1154Knowledge of digital evidence packaging tools and techniques
- K1155Knowledge of digital evidence preservation tools and techniques
- K1205Knowledge of required reporting formats
- K1312Knowledge of human source tasking
- K1313Knowledge of disruption, dismantlement, and deterrence strategies
- K1314Knowledge of obfuscation tools and techniques
Skills
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- S0469Skill in navigating the dark web
- S0470Skill in using the TOR network
- S0471Skill in examining digital media
- S0477Skill in identifying anomalous activity
- S0479Skill in evaluating supplier trustworthiness
- S0509Skill in evaluating security products
- S0589Skill in preserving digital evidence integrity
- S0607Skill in collecting digital evidence
- S0608Skill in processing digital evidence
- S0609Skill in transporting digital evidence
- S0651Skill in performing malware analysis
- S0695Skill in performing Open Source Intelligence (OSINT) research
- S0807Skill in solving problems
- S0854Skill in performing data analysis
- S0856Skill in performing digital evidence analysis
- S0863Skill in performing incident analysis
- S0866Skill in performing log file analysis
- S0890Skill in performing threat analysis
- S0896Skill in recognizing behavioral patterns
Workforce Automation analysis, not part of the source
O*NET jobs this role maps to
WFA · Part of the paid plan when accounts openJobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.
- Fraud Examiners, Investigators and Analysts 13-2099.04DWAs covered3 of 21
- Detectives and Criminal Investigators 33-3021.00DWAs covered0 of 26
- Intelligence Analysts 33-3021.06DWAs covered0 of 14
Equivalents
O*NET jobs
Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3- Fraud Examiners, Investigators and Analysts 13-2099.04
- Detectives and Criminal Investigators 33-3021.00
- Intelligence Analysts 33-3021.06
DCWF work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code
Free · DoD DCWF Tool v5.3 (2026-09-25)- Cyber Crime Investigator 221 · Cyber Enablers · linked by DCWF Tool NCWF ID