Protection and Defense · PD-WRL-003 · OPM code 531
Incident Response
From NICE Framework Components v2.2.0
Description
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0Responsible for investigating, analyzing, and responding to network cybersecurity incidents.
Tasks
From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it
Free · NICE Framework Components v2.2.0T0164 Perform cyber defense trend analysis and reporting
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0262 Employ approved defense-in-depth principles and practices (e.g., defense-in-multiple places, layered defenses, security robustness)
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0510 Coordinate incident response functions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1020 Determine the operational and safety impacts of cybersecurity lapses
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1084 Identify anomalous network activity
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1085 Identify potential threats to network resources
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1109 Resolve cyber defense incidents
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1110 Coordinate technical support to enterprise-wide cybersecurity defense technicians
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1118 Identify vulnerabilities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1119 Recommend vulnerability remediation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1250 Perform cyber defense incident triage
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1251 Recommend incident remediation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1252 Determine the scope, urgency, and impact of cyber defense incidents
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1256 Perform forensically sound image collection
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1257 Recommend mitigation and remediation strategies for enterprise systems
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1260 Perform real-time cyber defense incident handling
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1299 Determine causes of network alerts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1315 Track cyber defense incidents from initial detection through final resolution
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1316 Document cyber defense incidents from initial detection through final resolution
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1332 Produce incident findings reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1333 Communicate incident findings to appropriate constituencies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1370 Collect intrusion artifacts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1371 Mitigate potential cyber defense incidents
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1372 Advise law enforcement personnel as technical expert
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1407 Correlate threat assessment data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1485 Prepare after action reviews (AARs)
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1489 Correlate incident data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1582 Maintain currency of cyber defense threat conditions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1617 Prepare cyber defense reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yet
Knowledge
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- K0675Knowledge of risk management processes
- K0676Knowledge of cybersecurity laws and regulations
- K0677Knowledge of cybersecurity policies and procedures
- K0678Knowledge of privacy laws and regulations
- K0679Knowledge of privacy policies and procedures
- K0680Knowledge of cybersecurity principles and practices
- K0681Knowledge of privacy principles and practices
- K0682Knowledge of cybersecurity threats
- K0683Knowledge of cybersecurity vulnerabilities
- K0684Knowledge of cybersecurity threat characteristics
- K0685Knowledge of access control principles and practices
- K0686Knowledge of authentication and authorization tools and techniques
- K0689Knowledge of network infrastructure principles and practices
- K0701Knowledge of data backup and recovery policies and procedures
- K0709Knowledge of business continuity and disaster recovery (BCDR) policies and procedures
- K0710Knowledge of enterprise cybersecurity architecture principles and practices
- K0716Knowledge of host access control (HAC) systems and software
- K0717Knowledge of network access control (NAC) systems and software
- K0718Knowledge of network communications principles and practices
- K0724Knowledge of incident response principles and practices
- K0725Knowledge of incident response tools and techniques
- K0726Knowledge of incident handling tools and techniques
- K0732Knowledge of intrusion detection tools and techniques
- K0746Knowledge of policy-based access controls
- K0747Knowledge of Risk Adaptive (Adaptable) Access Controls (RAdAC)
- K0751Knowledge of system threats
- K0752Knowledge of system vulnerabilities
- K0770Knowledge of system administration principles and practices
- K0778Knowledge of enterprise information technology (IT) architecture principles and practices
- K0783Knowledge of network attack characteristics
- K0791Knowledge of defense-in-depth principles and practices
- K0829Knowledge of account creation policies and procedures
- K0830Knowledge of password policies and procedures
- K0832Knowledge of cyberattack characteristics
- K0833Knowledge of cyberattack actor characteristics
- K0837Knowledge of hardening tools and techniques
- K0844Knowledge of cyber attack stages
- K0845Knowledge of cyber intrusion activity phases
- K0857Knowledge of malware analysis tools and techniques
- K0865Knowledge of data classification standards and best practices
- K0866Knowledge of data classification tools and techniques
- K0870Knowledge of enterprise architecture (EA) reference models and frameworks
- K0871Knowledge of enterprise architecture (EA) principles and practices
- K0891Knowledge of the Open Systems Interconnect (OSI) reference model
- K0898Knowledge of cloud service models and frameworks
- K0915Knowledge of network architecture principles and practices
- K0916Knowledge of malware analysis principles and practices
- K0924Knowledge of network analysis tools and techniques
- K0934Knowledge of data classification policies and procedures
- K0969Knowledge of cyber-attack tools and techniques
- K0983Knowledge of computer networking principles and practices
- K1014Knowledge of network security principles and practices
- K1049Knowledge of routing protocols
- K1079Knowledge of web application security risks
Skills
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- S0077Skill in securing network communications
- S0080Skill in performing damage assessments
- S0483Skill in identifying software communications vulnerabilities
- S0509Skill in evaluating security products
- S0544Skill in recognizing vulnerabilities
- S0547Skill in identifying malware
- S0548Skill in capturing malware
- S0549Skill in containing malware
- S0550Skill in reporting malware
- S0572Skill in detecting host- and network-based intrusions
- S0589Skill in preserving digital evidence integrity
- S0607Skill in collecting digital evidence
- S0608Skill in processing digital evidence
- S0609Skill in transporting digital evidence
- S0614Skill in categorizing types of vulnerabilities
- S0615Skill in protecting a network against malware
- S0651Skill in performing malware analysis
- S0688Skill in performing network data analysis
- S0805Skill in designing incident responses
- S0806Skill in performing incident responses
- S0821Skill in collaborating with internal and external stakeholders
- S0854Skill in performing data analysis
- S0866Skill in performing log file analysis
Workforce Automation analysis, not part of the source
O*NET jobs this role maps to
WFA · Part of the paid plan when accounts openJobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.
- Information Security Analysts 15-1212.00DWAs covered10 of 10
- Web Administrators 15-1299.01DWAs covered12 of 33
- Information Security Engineers 15-1299.05DWAs covered5 of 21
- Fraud Examiners, Investigators and Analysts 13-2099.04DWAs covered3 of 21
Equivalents
O*NET jobs
Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3- Information Security Analysts 15-1212.00
- Web Administrators 15-1299.01
- Information Security Engineers 15-1299.05
- Fraud Examiners, Investigators and Analysts 13-2099.04
DCWF work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code
Free · DoD DCWF Tool v5.3 (2026-09-25)- Cyber Defense Incident Responder 531 · Cybersecurity · linked by DCWF Tool NCWF ID