Cyber Skills Frameworks Compared: Choosing NICE, ECSF or SFIA for Hiring

Organisations that adopt a cyber skills framework often pick the one their HR team has heard of, then find it does not fit how they grade jobs, hire or report to regulators. This guide compares the three frameworks used for job architecture and hiring, the NICE Workforce Framework for Cybersecurity, the ENISA European Cybersecurity Skills Framework (ECSF) and SFIA 9, and shows where the Cyber Security Body of Knowledge (CyBOK) fits as the knowledge layer underneath them. Frameworks are listed alphabetically in tables, and order is never a ranking. It is written for CISOs designing a team structure, HR and reward partners building job families, and learning leads aligning training with roles. Each framework has its own deep guide on nhimg.org; this page compares them and explains when to use which, rather than repeating them. Facts are from each owner's own pages, checked 14 November 2026.

Key takeaways

• They answer different questions. NICE describes cyber work as tasks, knowledge and skills grouped into work roles; ECSF describes 12 typical role profiles; SFIA describes skills at seven levels of responsibility across all digital work; CyBOK describes what is known, not who does it.
• SFIA is the only one built for grading. Its seven levels, from Follow to Set strategy, inspire, mobilise, give a ready-made scale for job levels and pay bands. NICE and ECSF need a proficiency scale added.
• Geography and regulation steer the choice. NICE is the US reference and is used for federal position coding; ECSF is the EU reference and ENISA maps NIS2 obligations to ECSF roles.
• All three are moving. NICE components reached v2.2.0 on 28 April 2026, ENISA is revising the ECSF with a consultation planned for the end of 2026, SFIA 9 was published in October 2024 and CyBOK 1.2 in September 2026.
• Combining is normal. A common pattern is SFIA for levels, NICE or ECSF for cyber role content, and CyBOK to check that training covers the knowledge each role needs.

The short answer

• You need job levels and career ladders across IT and security: use SFIA as the backbone. See the Cybersecurity Careers Guide for how roles progress.
• You are a US organisation, federal contractor or need US workforce reporting: use NICE work roles and their task, knowledge and skill (TKS) statements. See the NICE Workforce Framework Guide.
• You operate in the EU, especially as a NIS2 essential or important entity: use the ECSF profiles as role definitions. See the ENISA ECSF Skills Framework Guide.
• You design or buy training, degrees or certifications: map content to CyBOK Knowledge Areas, then to roles in one of the other three. See the CyBOK Body of Knowledge Guide.

Side-by-side comparison

Each framework in depth

For each framework this section covers the problem it solves, how it is structured, where it goes wrong, the controls that keep it useful, and when to choose it.

CyBOK (knowledge layer)

• Problem it solves: no shared definition of what a practitioner should know. CyBOK 1.2 sets out 21 Knowledge Areas across five broad categories: Human, Organisational and Regulatory Aspects; Attacks and Defences; Systems Security; Software and Platform Security; and Infrastructure Security.
• Structure in words: each Knowledge Area is an expert-written document. Courses and roles are mapped to it by matching keywords to topics, which produces coverage charts.
• Failure mode: using it as a job framework. It has no roles, tasks or levels, so a job description written from Knowledge Area titles reads like a syllabus.
• Controls: keep it in the training and education workstream; map each role's knowledge statements to Knowledge Areas to find gaps.
• Choose it when: you buy training, sponsor degrees or build an internal academy and need to prove coverage.

ENISA ECSF

• Problem it solves: employers, training providers and job seekers across Europe describing the same jobs in different words. It defines 12 typical role profiles, from Chief Information Security Officer to Penetration Tester.
• Structure in words: each profile has a title, alternative titles, mission, deliverables, main tasks, key skills, key knowledge and competences. ENISA publishes spreadsheet and JSON versions and an interactive tool, and maps NIS2 obligations to ECSF roles.
• Failure mode: treating 12 profiles as 12 jobs. Real jobs often combine two or three profiles, and smaller organisations rarely employ one person per profile.
• Controls: build job families by combining profiles; add your own level scale until ENISA's revision introduces proficiency levels; track the revision, with a public consultation planned for the end of 2026.
• Choose it when: you operate in the EU, need to show NIS2 role coverage, or want profiles recognisable to EU training providers.

NICE Workforce Framework for Cybersecurity

• Problem it solves: describing cyber work precisely enough to hire, train and assess it. The model is set by NIST SP 800-181 Rev. 1; the work roles, competency areas and TKS statements are versioned components.
• Structure in words: work roles sit in five categories, visible in their identifiers: Oversight and Governance (OG), Design and Development (DD), Implementation and Operation (IO), Protection and Defense (PD) and Investigation (IN). Version 2.0.0 (5 March 2025) removed the Cyberspace Effects and Cyberspace Intelligence categories and added Operational Technology Cybersecurity Engineering (DD-WRL-009); v2.1.0 (3 December 2025) revised Cybercrime Investigation (IN-WRL-001); v2.2.0 (28 April 2026) added Cybersecurity Supply Chain Risk Management (OG-WRL-017).
• Failure mode: quoting stale counts. Many websites still describe seven categories and 52 work roles, which reflects an older release. Another failure is pasting dozens of TKS statements into one job advert.
• Controls: pin a components version in your job architecture, record it, and review on each NICE release; choose a short list of TKS statements per role for assessment.
• Choose it when: you need task-level precision, US government alignment, or assessments built from defined statements.

SFIA 9

• Problem it solves: a common language for skills and responsibility across all digital work, so security jobs can be graded alongside IT, data and engineering jobs.
• Structure in words: skills each defined at some of seven levels of responsibility: 1 Follow, 2 Assist, 3 Apply, 4 Enable, 5 Ensure, advise, 6 Initiate, influence, and 7 Set strategy, inspire, mobilise. For example, Penetration testing (PENT) is defined at levels 2 to 6, and Information security (SCTY) at levels 2 to 7, with level 2 new in SFIA 9. SFIA 9 also adds essence statements for every level.
• Failure mode: using SFIA alone for specialist cyber roles. It describes skills at a general level, so it does not give the task detail a threat hunter or forensic analyst role needs.
• Controls: use SFIA levels for grading, then attach NICE or ECSF content for the specialist detail; check licensing terms on the SFIA site before building it into commercial products.
• Choose it when: you already use SFIA for IT job families, or need one grading model across technology functions.

Role mapping across the frameworks

The table shows how a few common roles appear in each framework. Use it as a starting point, then confirm against the current data files, since the frameworks are revised separately.

When to use each: decision guidance

Small versus large organisations

• Small: pick one role framework, use it to check that every responsibility has an owner, and skip formal grading. A list of ECSF profiles or NICE work roles with a named person against each is often enough.
• Large: standardise levels with SFIA, keep a role catalogue drawn from NICE or ECSF, and assign an owner to review framework releases each year.

How to implement

1. Inventory current jobs: list every security job, its tasks and its grade. Note where one job covers several areas.
2. Choose the backbone: apply the decision table. Record the framework versions you adopt (for example NICE components v2.2.0, SFIA 9).
3. Pilot one job family: map a single family, such as security operations, to the chosen role framework and levels. Ask job holders and managers to review it.
4. Write job descriptions: pick five to ten tasks or skills per role and the level expected; avoid pasting the full framework text.
5. Link hiring and training: build interview questions and training plans from the same statements, and use CyBOK to check training coverage. Certifications can evidence parts of a role; see the Cybersecurity Certifications Guide.
6. Roll out and review: extend to other families, then review yearly and on each framework release. Keep the previous mapping so you can roll back if a release changes role boundaries.

Worked scenario

A European payments company with 40 security staff in three countries must show NIS2 role coverage and fix inconsistent job titles. It already grades IT jobs with SFIA. It keeps SFIA levels for pay, uses ECSF profiles as the role catalogue (for example Cyber Incident Responder and Cybersecurity Risk Manager), and maps its US subsidiary's roles to NICE work roles so both regions share a crosswalk. Its learning team maps the training catalogue to CyBOK Knowledge Areas and finds weak coverage of Secure Software Lifecycle for its application security engineers. Hiring for penetration testers now asks for Penetration testing (PENT) at SFIA level 4, with a practical credential as one form of evidence; see Penetration Testing Certifications Compared.

Where identity fits

None of the frameworks has a dedicated role for machine identity, secrets or AI agent governance. That work spreads across architecture, operations and governance roles, and CyBOK places much of the knowledge in Authentication, Authorisation and Accountability. When you build job descriptions, add explicit tasks for service account ownership, credential rotation and agent access review rather than assuming a generic security role covers them. See the Cybersecurity Skills Gap and Hiring Guide.

Measuring adoption

• Role coverage: percentage of security jobs mapped to a framework role and level.
• Responsibility gaps: number of required roles (for example from NIS2 mapping) with no named owner.
• Time to hire: days to fill roles before and after framework-based job descriptions.
• Training alignment: share of training spend mapped to a role gap or a CyBOK Knowledge Area gap.
• Version currency: months since the mapping was last reviewed against the latest framework release.

Common failure patterns

• Stale counts and versions. Quoting "52 work roles" or an old SFIA release in policy documents means job descriptions drift from the current framework.
• Frameworks as job adverts. Copying every task statement makes adverts unreadable and deters good candidates.
• No level scale. Adopting ECSF or NICE without a proficiency scale leaves grading and pay decisions inconsistent.
• Knowledge mistaken for roles. Writing roles from CyBOK Knowledge Area titles produces syllabi rather than jobs.
• One-off projects. Mapping once and never reviewing; NICE alone has released three component versions since March 2025.

Framework mapping

Practitioner checklist

• Decide whether you need levels, role content, regulatory evidence, or training coverage, and pick frameworks accordingly.
• Record the framework versions adopted and the date.
• Pilot one job family before mapping the whole function.
• Add a level scale (SFIA or internal) to any ECSF or NICE adoption.
• Keep job adverts to five to ten tasks or skills per role.
• Add explicit machine identity and secrets tasks to relevant roles.
• Map training to CyBOK Knowledge Areas and to role gaps.
• Review mappings yearly and on each framework release, keeping the previous version.

Standards and references

• NIST: NICE Framework Current Versions
• NIST: NICE Framework Components Change Logs
• ENISA: European Cybersecurity Skills Framework (ECSF)
• ENISA: ECSF Role Profiles
• SFIA Foundation: SFIA 9
• SFIA Foundation: Levels of Responsibility
• SFIA Foundation: Penetration Testing (PENT)
• CyBOK: Knowledge Base Version 1.2

Related NHI Mgmt Group resources: Cybersecurity Careers Guide, Cyber Security Apprenticeships and Graduate Schemes, Career Change into Cyber Security Guide, Cybersecurity Training Provider.