NIST Cybersecurity Framework 2.0: Cybersecurity, Enterprise Risk Management, and Workforce Management Quick-Start Guide

Key concepts

The guide explains how workforce management relates to cybersecurity and enterprise risk management, and how CSF outcomes and NICE work roles can be used together. It stresses adjusting the workforce as threats and technology change.

How it is organized

• Purpose and key terms
• How ERM, cybersecurity risk management and workforce management relate
• Using CSF 2.0 with the NICE Framework (work roles and competencies)
• Making risk-based workforce decisions

What a school district should take from it

• Staffing is a risk decision: name which CSF outcomes each role, contract or partner covers.
• Small districts often cover security work roles through shared services or partners; the guide's approach still applies.

How to use it in your district

1. List the CSF functions and name who covers each: staff, regional partner or vendor.
2. Use NICE work role names when writing job descriptions or service contracts.
3. Bring the gaps to budget planning with the related risk, not just the headcount.

Common misconceptions

Workforce planning means hiring a dedicated security person.

It means covering the needed work roles, which can be shared, contracted or trained.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

• GV.RRRoles, Responsibilities, and Authorities
• GV.RMRisk Management Strategy

Tools in the program portal

• Team and accessNamed accounts, roles and authenticator MFA
• P3 Partner NetworkFind vetted help matched to your gaps
• Funding finderGrants and programs for cybersecurity work

Related publications

• SP 800-181 Rev. 1NICE Workforce Framework
• CSF 2.0 (CSWP 29)Cybersecurity Framework 2.0