Skip to content

Oversight and Governance · OG-WRL-012 · OPM code 612

Security Control Assessment

From NICE Framework Components v2.2.0

Description

From NICE Framework Components v2.2.0

Free · NICE Framework Components v2.2.0

Responsible for conducting independent comprehensive assessments of management, operational, and technical security controls and control enhancements employed within or inherited by a system to determine their overall effectiveness.

Tasks

From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it

Free · NICE Framework Components v2.2.0
  • T0309 Assess the effectiveness of security controls
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T0495 Manage Accreditation Packages (e.g., ISO/IEC 15026-2)
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1012 Expand network access
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1013 Conduct technical exploitation of a target
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1019 Determine special needs of cyber-physical systems
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1020 Determine the operational and safety impacts of cybersecurity lapses
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1021 Review cyber defense service provider reporting structure
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1022 Review enterprise information technology (IT) goals and objectives
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1023 Identify critical technology procurement requirements
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1026 Determine procurement requirements
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1030 Estimate the impact of collateral damage
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1036 Integrate leadership priorities
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1038 Integrate organization objectives in intelligence collection
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1041 Determine impact of software configurations
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1046 Assess operation performance
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1047 Assess operation impact
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1054 Scope analysis reports to various audiences that accounts for data sharing classification restrictions
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1055 Determine if priority information requirements are satisfied
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1079 Develop cybersecurity risk profiles
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1084 Identify anomalous network activity
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1118 Identify vulnerabilities
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1119 Recommend vulnerability remediation strategies
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1232 Approve accreditation packages
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1263 Perform security reviews
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1264 Identify gaps in security architecture
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1265 Develop a cybersecurity risk management plan
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1266 Recommend risk mitigation strategies
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1269 Conduct risk analysis of applications and systems undergoing major changes
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1270 Plan security authorization reviews for system and network installations
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1271 Conduct security authorization reviews for system and network installations
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1272 Develop security assurance cases for system and network installations
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1294 Advise on Risk Management Framework process activities and documentation
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1305 Determine if authorization and assurance documents identify an acceptable level of risk for software applications, systems, and networks
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1327 Update security documentation to reflect current application and system security design features
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1328 Verify implementation of software, network, and system cybersecurity postures
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1329 Document software, network, and system deviations from implemented security postures
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1330 Recommend required actions to correct software, network, and system deviations from implemented security postures
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1339 Develop cybersecurity compliance processes for external services
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1340 Develop cybersecurity audit processes for external services
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1343 Provide cybersecurity guidance to organizational risk governance processes
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1355 Determine if vulnerability remediation plans are in place
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1356 Develop vulnerability remediation plans
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1357 Determine if cybersecurity requirements have been successfully implemented
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1358 Determine the effectiveness of organizational cybersecurity policies and procedures
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1361 Determine the impact of new system and interface implementations on organization's cybersecurity posture
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1362 Document impact of new system and interface implementations on organization's cybersecurity posture
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1365 Document cybersecurity design and development activities
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1368 Support cybersecurity compliance activities
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1369 Determine if acquisitions, procurement, and outsourcing efforts address cybersecurity requirements
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1437 Determine effectiveness of configuration management processes
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1489 Correlate incident data
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet
  • T1829 Evaluate locally developed tools
    WFA · Part of the paid plan when accounts open

    WFA (Workforce Automation) analysis: AI skills mapped to this task

    Not mapped yet

Knowledge

From NICE Framework Components v2.2.0

Free · NICE Framework Components v2.2.0
  • K0476Knowledge of language processing tools and techniques
  • K0653Knowledge of cybersecurity practices in the acquisition process
  • K0655Knowledge of intelligence fusion
  • K0658Knowledge of cognitive biases
  • K0659Knowledge of information privacy technologies
  • K0674Knowledge of computer networking protocols
  • K0675Knowledge of risk management processes
  • K0676Knowledge of cybersecurity laws and regulations
  • K0677Knowledge of cybersecurity policies and procedures
  • K0678Knowledge of privacy laws and regulations
  • K0679Knowledge of privacy policies and procedures
  • K0680Knowledge of cybersecurity principles and practices
  • K0681Knowledge of privacy principles and practices
  • K0682Knowledge of cybersecurity threats
  • K0683Knowledge of cybersecurity vulnerabilities
  • K0684Knowledge of cybersecurity threat characteristics
  • K0685Knowledge of access control principles and practices
  • K0686Knowledge of authentication and authorization tools and techniques
  • K0687Knowledge of business operations standards and best practices
  • K0688Knowledge of common application vulnerabilities
  • K0689Knowledge of network infrastructure principles and practices
  • K0691Knowledge of cyber defense tools and techniques
  • K0692Knowledge of vulnerability assessment tools and techniques
  • K0698Knowledge of cryptographic key management principles and practices
  • K0701Knowledge of data backup and recovery policies and procedures
  • K0702Knowledge of data warehousing principles and practices
  • K0703Knowledge of data mining principles and practices
  • K0707Knowledge of database systems and software
  • K0709Knowledge of business continuity and disaster recovery (BCDR) policies and procedures
  • K0710Knowledge of enterprise cybersecurity architecture principles and practices
  • K0711Knowledge of evaluation and validation principles and practices
  • K0712Knowledge of Local Area Networks (LAN)
  • K0713Knowledge of Wide Area Networks (WAN)
  • K0718Knowledge of network communications principles and practices
  • K0720Knowledge of Security Assessment and Authorization (SA&A) processes
  • K0721Knowledge of risk management principles and practices
  • K0723Knowledge of vulnerability data sources
  • K0728Knowledge of Confidentiality, Integrity and Availability (CIA) principles and practices
  • K0729Knowledge of non-repudiation principles and practices
  • K0730Knowledge of cyber safety principles and practices
  • K0731Knowledge of systems security engineering (SSE) principles and practices
  • K0734Knowledge of Risk Management Framework (RMF) requirements
  • K0735Knowledge of risk management models and frameworks
  • K0736Knowledge of information technology (IT) security principles and practices
  • K0742Knowledge of identity and access management (IAM) principles and practices
  • K0743Knowledge of new and emerging technologies
  • K0746Knowledge of policy-based access controls
  • K0747Knowledge of Risk Adaptive (Adaptable) Access Controls (RAdAC)
  • K0749Knowledge of process engineering principles and practices
  • K0751Knowledge of system threats
  • K0752Knowledge of system vulnerabilities
  • K0758Knowledge of server administration principles and practices
  • K0760Knowledge of server diagnostic tools and techniques
  • K0761Knowledge of Fault Detection and Diagnostics (FDD) tools and techniques
  • K0765Knowledge of software engineering principles and practices
  • K0767Knowledge of structured analysis principles and practices
  • K0776Knowledge of collaboration tools and techniques
  • K0778Knowledge of enterprise information technology (IT) architecture principles and practices
  • K0779Knowledge of systems engineering processes
  • K0784Knowledge of insider threat laws and regulations
  • K0785Knowledge of insider threat tools and techniques
  • K0791Knowledge of defense-in-depth principles and practices
  • K0800Knowledge of evidence admissibility laws and regulations
  • K0803Knowledge of supply chain risk management principles and practices
  • K0806Knowledge of machine virtualization tools and techniques
  • K0814Knowledge of secure coding tools and techniques
  • K0819Knowledge of import and export control laws and regulations
  • K0820Knowledge of supply chain risks
  • K0821Knowledge of federal agency roles and responsibilities
  • K0834Knowledge of technology procurement principles and practices
  • K0838Knowledge of supply chain risk management policies and procedures
  • K0839Knowledge of critical infrastructure systems and software
  • K0840Knowledge of hardware reverse engineering tools and techniques
  • K0842Knowledge of software reverse engineering tools and techniques
  • K0851Knowledge of reverse engineering principles and practices
  • K0858Knowledge of virtual machine detection tools and techniques
  • K0859Knowledge of encryption tools and techniques
  • K0865Knowledge of data classification standards and best practices
  • K0866Knowledge of data classification tools and techniques
  • K0870Knowledge of enterprise architecture (EA) reference models and frameworks
  • K0871Knowledge of enterprise architecture (EA) principles and practices
  • K0877Knowledge of application firewall principles and practices
  • K0878Knowledge of network firewall principles and practices
  • K0879Knowledge of industry cybersecurity models and frameworks
  • K0880Knowledge of access control models and frameworks
  • K0881Knowledge of learning assessment tools and techniques
  • K0885Knowledge of instructional design principles and practices
  • K0886Knowledge of instructional design models and frameworks
  • K0892Knowledge of cyber defense laws and regulations
  • K0915Knowledge of network architecture principles and practices
  • K0917Knowledge of Personally Identifiable Information (PII) data security standards and best practices
  • K0918Knowledge of Payment Card Industry (PCI) data security standards and best practices
  • K0919Knowledge of Personal Health Information (PHI) data security standards and best practices
  • K0922Knowledge of the acquisition life cycle models and frameworks
  • K0924Knowledge of network analysis tools and techniques
  • K0928Knowledge of systems engineering principles and practices
  • K0934Knowledge of data classification policies and procedures
  • K0942Knowledge of cryptology principles and practices
  • K0947Knowledge of computer engineering principles and practices
  • K0948Knowledge of embedded systems and software
  • K0953Knowledge of data mining tools and techniques
  • K0955Knowledge of penetration testing principles and practices
  • K0956Knowledge of penetration testing tools and techniques
  • K0962Knowledge of targeting laws and regulations
  • K0963Knowledge of exploitation laws and regulations
  • K0965Knowledge of language analysis tools and techniques
  • K0966Knowledge of voice analysis tools and techniques
  • K0967Knowledge of graphic materials analysis tools and techniques
  • K0983Knowledge of computer networking principles and practices
  • K0986Knowledge of target selection criticality factors
  • K0987Knowledge of target selection vulnerability factors
  • K0990Knowledge of cyber operations principles and practices
  • K1014Knowledge of network security principles and practices
  • K1034Knowledge of target language
  • K1050Knowledge of critical information requirements
  • K1063Knowledge of operation assessment processes
  • K1069Knowledge of virtual machine tools and technologies
  • K1076Knowledge of risk scoring principles and practices
  • K1077Knowledge of data security controls
  • K1079Knowledge of web application security risks
  • K1084Knowledge of data privacy controls
  • K1088Knowledge of knowledge management tools and techniques
  • K1096Knowledge of data analysis tools and techniques
  • K1098Knowledge of personnel systems and software
  • K1099Knowledge of code analysis tools and techniques
  • K1100Knowledge of analytical tools and techniques
  • K1101Knowledge of analytics
  • K1108Knowledge of traceroute tools and techniques
  • K1109Knowledge of virtual collaborative workspace tools and techniques
  • K1180Knowledge of organizational cybersecurity goals and objectives

Skills

From NICE Framework Components v2.2.0

Free · NICE Framework Components v2.2.0
  • S0015Skill in conducting test events
  • S0097Skill in applying security controls
  • S0111Skill in interfacing with customers
  • S0136Skill in network systems management principles, models, methods (e.g., end-to-end systems performance monitoring), and tools
  • S0141Skill in assessing security systems designs
  • S0172Skill in applying secure coding techniques
  • S0175Skill in performing root cause analysis
  • S0177Skill in performing network analysis on targets
  • S0248Skill in performing target system analysis
  • S0252Skill in processing collected data for follow-on analysis
  • S0385Skill in communicating complex concepts
  • S0386Skill in communicating verbally
  • S0387Skill in communicating in writing
  • S0388Skill in facilitating small group discussions
  • S0389Skill in facilitating group discussions
  • S0391Skill in creating technical documentation
  • S0393Skill in developing assessments
  • S0394Skill in developing security assessments
  • S0401Skill in collecting data
  • S0402Skill in verifying data
  • S0403Skill in validating data
  • S0409Skill in deriving evaluative conclusions from data
  • S0414Skill in evaluating laws
  • S0415Skill in evaluating regulations
  • S0416Skill in evaluating policies
  • S0423Skill in analyzing processes to ensure conformance with procedural requirements
  • S0430Skill in collaborating with others
  • S0431Skill in applying critical thinking
  • S0435Skill in analyzing large data sets
  • S0436Skill in creating target intelligence products
  • S0437Skill in identifying targets of interest
  • S0438Skill in functioning effectively in a dynamic, fast-paced environment
  • S0439Skill in identifying external partners
  • S0440Skill in identifying target vulnerabilities
  • S0441Skill in describing target vulnerabilities
  • S0443Skill in mitigating cognitive biases
  • S0447Skill in aligning privacy and cybersecurity objectives
  • S0462Skill in integrating information security requirements in the acquisitions process
  • S0463Skill in implementing software quality control processes
  • S0465Skill in identifying critical infrastructure systems
  • S0466Skill in identifying systems designed without security considerations
  • S0472Skill in developing virtual machines
  • S0473Skill in maintaining virtual machines
  • S0483Skill in identifying software communications vulnerabilities
  • S0503Skill in selecting targets
  • S0504Skill in identifying vulnerabilities
  • S0506Skill in identifying customer information needs
  • S0511Skill in establishing priorities
  • S0515Skill in identifying partner capabilities
  • S0532Skill in analyzing software configurations
  • S0543Skill in scanning for vulnerabilities
  • S0544Skill in recognizing vulnerabilities
  • S0558Skill in developing algorithms
  • S0559Skill in performing data structure analysis
  • S0574Skill in developing security system controls
  • S0578Skill in evaluating security designs
  • S0579Skill in preparing reports
  • S0580Skill in monitoring system performance
  • S0581Skill in configuring systems for performance enhancement
  • S0601Skill in developing curricula
  • S0602Skill in teaching training programs
  • S0614Skill in categorizing types of vulnerabilities
  • S0628Skill in developing learning activities
  • S0632Skill in designing Test and Evaluation Strategies (TES)
  • S0634Skill in identifying Test and Evaluation Strategies (TES) infrastructure requirements
  • S0635Skill in managing test assets
  • S0641Skill in reviewing logs
  • S0642Skill in identifying evidence of past intrusions
  • S0645Skill in troubleshooting cyber defense infrastructure anomalies
  • S0647Skill in managing a workforce
  • S0654Skill in conducting system reviews
  • S0655Skill in designing secure test plans
  • S0656Skill in assessing application vulnerabilities
  • S0657Skill in implementing Public Key Infrastructure (PKI) encryption
  • S0658Skill in implementing digital signatures
  • S0664Skill in applying policies that meet system security objectives
  • S0667Skill in assessing security controls
  • S0673Skill in translating operational requirements into security controls
  • S0675Skill in optimizing system performance
  • S0686Skill in performing risk assessments
  • S0687Skill in performing administrative planning activities
  • S0688Skill in performing network data analysis
  • S0700Skill in mining data
  • S0701Skill in performing data mining analysis
  • S0704Skill in performing target analysis
  • S0709Skill in developing analytics
  • S0711Skill in interpreting metadata
  • S0712Skill in evaluating data source quality
  • S0713Skill in evaluating information quality
  • S0715Skill in generating operation plans
  • S0719Skill in identifying intelligence gaps
  • S0720Skill in identifying regional languages and dialects
  • S0721Skill in prioritizing information
  • S0722Skill in interpreting traceroute results
  • S0723Skill in interpreting vulnerability scanner results
  • S0724Skill in managing client relationships
  • S0728Skill in preparing briefings
  • S0729Skill in preparing plans
  • S0731Skill in producing after-action reports
  • S0739Skill in analyzing intelligence products
  • S0743Skill in identifying network anomalies
  • S0744Skill in performing technical writing
  • S0755Skill in reconstructing a network
  • S0756Skill in incorporating feedback
  • S0758Skill in performing wireless network analysis
  • S0760Skill in navigating databases
  • S0761Skill in performing strategic guidance analysis
  • S0775Skill in developing intelligence collection plans
  • S0777Skill in developing collection strategies
  • S0780Skill in fulfilling information requests
  • S0788Skill in orchestrating planning teams
  • S0789Skill in coordinating collection support
  • S0790Skill in monitoring status
  • S0791Skill in presenting to an audience
  • S0800Skill in analyzing organizational patterns and relationships
  • S0801Skill in assessing partner operations capabilities
  • S0807Skill in solving problems
  • S0809Skill in utilizing cyber defense service provider information
  • S0813Skill in identifying cybersecurity issues in external connections
  • S0814Skill in identifying privacy issues in partner interconnections
  • S0874Skill in performing network traffic analysis
  • S0878Skill in performing risk analysis

Workforce Automation analysis, not part of the source

O*NET jobs this role maps to

WFA · Part of the paid plan when accounts open

Jobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.

Equivalents

O*NET jobs

Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3

Free · O*NET 30.3

DCWF work roles

From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code

Free · DoD DCWF Tool v5.3 (2026-09-25)