CyBOK Body of Knowledge Guide: Knowledge Areas, Mapping and Career Use

Cyber security has no single agreed definition of what a practitioner should know, which makes degrees, training courses, certifications and job descriptions hard to compare. The Cyber Security Body of Knowledge (CyBOK) is a free, expert-written reference that maps the foundational knowledge of the field into 21 Knowledge Areas, and in the UK it underpins how NCSC-certified degrees and NCSC Certified Training are assessed. This guide explains how CyBOK is structured, what changed in version 1.2, how the mapping process works, and how learners, educators, hiring managers and training leads can use it. It is for practitioners planning their own development and for the people who design or buy security education. For routes into the profession, start with the Cybersecurity Careers Guide.

Key takeaways

• CyBOK is a map of knowledge, not a syllabus or a certification. It describes what is known in 21 Knowledge Areas (KAs); it does not set exams, job levels or pass marks.
• Version 1.2 is current. CyBOK 1.2 was released in September 2026 with major revisions to Secure Software Lifecycle and Software Security; version 1.1 (July 2021) had added Applied Cryptography and Formal Methods for Security.
• UK certification schemes use it. NCSC Certified Training assessment criteria v4.0 use CyBOK KAs as the basis for assessing course content, and CyBOK publishes a mapping framework for degree programmes seeking NCSC certification.
• Mapping is a structured method. Keywords from a course or role are matched through the Mapping Reference and Knowledge Trees to topics, then summarised as coverage charts by KA and broad category.
• It complements role frameworks. CyBOK says what knowledge exists; frameworks such as NICE and the ENISA ECSF describe work roles and tasks. Use them together.

What CyBOK is and who maintains it

CyBOK describes itself as an expert-led resource to support education and professional training in cyber security. Each KA is written by recognised experts, reviewed by the community and published with a knowledge tree (a hierarchical breakdown of topics) and a bibliography file. The project is overseen by a Project Management Board, with a Professional Advisory Board reviewing progress against the needs of the profession and an Academic Advisory Board advising on academic aspects. CyBOK is free to use, and its mapping booklet carries Crown Copyright, reflecting its origins in UK government-funded work.

The version history matters when you read a mapping, because older mappings refer to older KA sets:

Individual KAs carry their own version numbers. In the 1.2 knowledge base, for example, Network Security is at v2.0.1 and Risk Management and Governance at v1.1.2. Quote the KA version, not just the CyBOK release, when you map content. Earlier releases stay available in the knowledge base archive, so a mapping made against version 1.0 or 1.1 can still be checked against the text it was built on, which matters when an assessor or employer asks how a coverage chart was produced.

The 21 Knowledge Areas

CyBOK groups its KAs into five broad categories, plus an Introduction to CyBOK document that sets out the concepts used across the whole body.

Two practical notes. First, identity is spread across KAs rather than concentrated in one: Authentication, Authorisation and Accountability covers the core models, while machine credentials, key management and protocol authentication also appear in Cryptography, Applied Cryptography, Distributed Systems Security and Network Security. Anyone mapping a non-human identity or IAM course should expect hits across several KAs. Second, the knowledge base publishes a "Relationships between KAs" document and an "External dependencies" document that points to the IEEE SWEBOK v3.0 and the ACM Computer Science Curriculum 2013 for underlying computing knowledge CyBOK assumes.

Reading a Knowledge Area efficiently

Each KA is a long, referenced document, and few practitioners read them end to end. A practical order is:

• Knowledge tree first: the tree shows the topic hierarchy on one page, so you can see what the KA considers in scope before reading any prose.
• Introduction and summary sections: these state the KA's boundaries and its links to other KAs, which saves duplicate reading.
• Topic sections that match a gap: read only the sections for tree nodes you marked unknown, then follow the cited references.
• Bibliography file: the .bib file for each KA can be loaded into a reference manager, which makes it easy to build a reading list for a team.
• Webinars and podcasts: the knowledge base lists them per KA where they exist; they are a quicker way to get the author's framing before reading the text.

Worked example: mapping an identity curriculum

Consider an internal course for engineers who run workload identity, secrets and service account governance. Keywords such as "OAuth client credentials", "mutual TLS", "key rotation", "access control models", "audit logging" and "secrets vault" are looked up in the Mapping Reference and placed on the trees. Typical results are Authentication, Authorisation and Accountability (access control models, authentication protocols, accountability and logging), Applied Cryptography (key management and protocol use), Distributed Systems Security (trust between services) and Security Operations and Incident Management (detection and response). Topics with no clear node, such as a specific vendor's vault product, stay unmapped: CyBOK is vendor-neutral and so is the mapping. The resulting chart usually shows depth in one or two KAs and thin coverage elsewhere, which is the honest picture for a specialist course and a useful prompt for what to pair it with.

How CyBOK is used in UK certification

NCSC-certified degrees

The NCSC certifies degree apprenticeships (including Scottish Graduate Apprenticeships), bachelor's degrees, integrated master's degrees and master's degrees, with full or provisional certification, and some master's degrees are certified only for a named pathway. CyBOK publishes guidance for UK higher education programme directors applying for NCSC certification, including a mapping framework (Nautiyal and Rashid, University of Bristol, v1.1, July 2021). That framework is explicit that a good mapping is not a guarantee of certification: the panel applies broader criteria, so applicants must also read the current NCSC call.

NCSC Certified Training

The NCSC Certified Training assessment criteria (v4.0) are more prescriptive:

• Basis of assessment: CyBOK KAs define and assess a course's cyber security content, and APMG, as the Certification Body, uses the provider's self-assessment as the basis for its review.
• Claiming a KA: course topics should cover roughly half the topics in a KA before the provider claims it.
• Course types: "Introductory" courses give awareness and need no prerequisites; "Above introductory" courses give detailed understanding, typically need prerequisites, usually run for two or more days and include self-study, hands-on practice and formal assessment. Mapping to third or fourth-level knowledge tree nodes can indicate above-introductory depth.
• Content rules: at least 80% of the course must be cyber security, content must be consistent with NCSC guidance, and the syllabus must justify the course type and include the KA bar chart and broad category radar chart.
• Beyond content: APMG also assesses the provider's quality management, trainers (including observation and interview) and marketing claims.

Professional certifications

CyBOK's mapping booklet (v2.2, 2024) maps six professional certifications: ISC2 CISSP and SSCP, ISACA CISM and CRISC, the BCS Practitioner Certificate in Information Risk Management and CREST CPSA. The first four are mapped to CyBOK v1.0 plus Formal Methods for Security, the last two to v1.1. These charts are a quick way to see, for example, how heavily a governance certification leans on the Human, Organisational and Regulatory category compared with a testing certification. See the CISSP Certification Guide and the CISM Certification Guide.

How the mapping method works

The same method is used for degrees, training and certifications, and it works for internal programmes and job roles too:

1. Form a keyword list. For each module, course unit or role responsibility, list the most specific keywords and phrases. Redundancy is fine; the aim is a long list.
2. Match against indicative material. For NCSC applications, check the NCSC A to Z indicative topics first.
3. Look up the Mapping Reference. The CyBOK Mapping Reference indexes thousands of terms (the 2021 framework cites more than 8,000 in version 1.3) and points to the KA and topic where each is discussed.
4. Place on the Knowledge Trees. Find the node for each matched term; unmatched terms are searched directly in the trees or the full KA text. The goal is the right topic, not an exact string match.
5. Use the tabular categories as a last resort to assign anything still unmatched to the most relevant KA.
6. Summarise coverage. Produce a bar chart of emphasis per KA and a radar chart per broad category, and note the tree depth reached for each topic.
7. Review and version. Record the CyBOK and KA versions used and remap when a KA changes, as Secure Software Lifecycle did in 1.2.

Choosing CyBOK, NICE or ECSF

In practice, a UK training lead uses CyBOK to describe and compare course content, then a role framework to say which roles need which knowledge. A small organisation rarely needs a formal mapping: picking two or three KAs per role and checking that training covers them is enough. A large organisation or training provider benefits from a full mapping because it makes gaps and duplication visible across dozens of courses. See the NICE Workforce Framework Guide and the ENISA ECSF Skills Framework Guide.

Using CyBOK as a practitioner or team lead

• Self-assessment: read the knowledge tree for your main KA and mark each second-level node as known, partly known or unknown. The gaps become a learning plan, and the KA bibliography gives primary reading.
• Choosing courses: ask providers for their CyBOK coverage charts and the depth they claim. An NCSC Certified Training course will have them already.
• Hiring: CyBOK says mappings help employers judge how relevant a programme is to a role's knowledge needs. Use the KA list to write knowledge requirements in neutral terms rather than tool names. See the Cybersecurity Skills Gap and Hiring Guide.
• Internal academies: map role-based training to KAs so that coverage, overlap and depth can be reported. See the Role-Based Security Training Programme Guide.
• Specialist identity roles: an IAM or NHI engineer needs depth in Authentication, Authorisation and Accountability plus applied cryptography and distributed systems. See the NHI and Machine Identity Engineer Career Guide.

Measuring whether it is working

• Percentage of internal training modules mapped to a CyBOK KA and version.
• Number of roles with defined target KAs and depth.
• Coverage gaps closed per quarter (KAs required by a role but absent from its training).
• Share of mapped courses reaching above-introductory depth where roles require it.
• Time since each mapping was last reviewed against the current KA version.

Framework mapping

Common failure patterns

• Treating CyBOK as a syllabus. It describes knowledge, not learning outcomes or assessments. Courses still need objectives, practice and testing.
• Keyword-matching without judgement. The mapping framework says the aim is the right topic, not exact strings. A module that mentions "encryption" once does not cover the Cryptography KA.
• Claiming breadth without depth. NCSC Certified Training expects about half a KA's topics before a claim, and depth judged by time, teaching method and assessment rigour.
• Mixing versions. Comparing a v1.0 certification mapping with a v1.2 course mapping overstates gaps in KAs that did not exist in 1.0.
• Ignoring skills. CyBOK is about knowledge; the NCSC criteria allow skills content that CyBOK does not cover. Hands-on ability needs separate evidence. See the Cyber Ranges, CTFs and Hands-On Training Guide.
• Never remapping. KA revisions such as Secure Software Lifecycle v2.0.0 change the topics a mapping points to.

Practitioner checklist

• Download the current CyBOK 1.2 knowledge base, knowledge trees and Mapping Reference.
• Pick the two or three KAs most relevant to your role and self-assess against their trees.
• Record CyBOK and KA versions on every mapping you produce or receive.
• Ask training providers for CyBOK coverage charts and claimed depth.
• For NCSC Certified Training, check the 80% content rule and the half-of-KA claim threshold.
• Pair CyBOK with a role framework (NICE or ECSF) for job design.
• Map internal training once, then review when a KA version changes.
• Track coverage gaps per role as a training metric.

Standards and references

• CyBOK: The Cyber Security Body of Knowledge v1.2 Knowledge Base
• CyBOK: Knowledge Base v1.1
• CyBOK: How to Use CyBOK
• CyBOK: Mapping Framework for UK Higher Education v1.1
• CyBOK: Mappings of University and Professional Training Programmes v2.2
• NCSC: Certified Training Assessment Criteria v4.0
• NCSC: NCSC-Certified Degrees

Related NHI Mgmt Group resources: Cybersecurity Careers Guide · NICE Workforce Framework Guide · ENISA ECSF Skills Framework Guide · Role-Based Security Training Programme Guide