Cyber incident responder to chief ICT security officer

• already held ICT network security risks knowledge
• already held ICT process quality models knowledge
• already held ICT project management methodologies knowledge
• already held ICT safety skill
• already held ICT security legislation knowledge
• already held ICT security standards knowledge
• already held attack vectors knowledge
• already held communicate with stakeholders skill
• already held cyber attack counter-measures knowledge
• already held cyber security knowledge
• already held develop information security strategy skill
• already held engage with stakeholders skill
• already held ethical hacking principles knowledge
• already held implement ICT risk management skill
• already held implement ICT security policies skill
• already held information security strategy knowledge
• already held lead disaster recovery exercises skill
• already held manage IT security compliances skill
• already held risk management knowledge
• already held security engineering knowledge
• already held ICT encryption knowledge
• already held Internet of Things knowledge
• already held cloud monitoring and reporting knowledge
• already held cloud security and compliance knowledge
• already held cloud technologies knowledge
• already held implement a firewall skill
• already held implement a virtual private network skill
• already held implement anti-virus software skill
• already held internet governance knowledge
• already held manage digital identity skill
• already held manage keys for data protection skill
• already held optimise choice of ICT solution skill
• already held protect personal data and privacy skill
• already held web application security threats knowledge

• optional, not held apply operations for an ITIL-based environment optional
• optional, not held control objectives for information and related technology optional
• optional, not held ICT communications protocols optional
• optional, not held ICT infrastructure optional
• optional, not held ICT recovery techniques optional
• optional, not held ICT system user requirements optional
• optional, not held assess ICT knowledge optional
• optional, not held computer forensics optional
• optional, not held coordinate technological activities optional
• optional, not held execute ICT audits optional
• optional, not held implement cloud security and compliance optional
• optional, not held software anomalies optional
• optional, not held World Wide Web Consortium standards optional
• optional, not held computer programming optional
• optional, not held conduct impact evaluation of ICT processes on business optional
• optional, not held create solutions to problems optional
• optional, not held identify legal requirements optional
• optional, not held manage staff optional
• optional, not held train employees optional
• optional, not held use different communication channels optional

• not needed by the target role C++ knowledge
• not needed by the target role GDPR knowledge
• not needed by the target role Process-based management knowledge
• not needed by the target role Python (computer programming) knowledge
• not needed by the target role building systems monitoring technology knowledge
• not needed by the target role business intelligence knowledge
• not needed by the target role collect cyber defence data skill
• not needed by the target role consult with business clients skill
• not needed by the target role copyright legislation knowledge
• not needed by the target role create incident reports skill
• not needed by the target role create project specifications skill
• not needed by the target role defence standard procedures knowledge
• not needed by the target role define quality standards skill
• not needed by the target role embedded systems knowledge
• not needed by the target role ensure information security skill
• not needed by the target role ensure proper document management skill
• not needed by the target role give live presentation skill
• not needed by the target role handle cybersecurity incidents skill
• not needed by the target role implement spam protection skill
• not needed by the target role incidents and accidents recording knowledge
• not needed by the target role leadership principles knowledge
• not needed by the target role lean project management knowledge
• not needed by the target role manage ICT change request process skill
• not needed by the target role manage a team skill
• not needed by the target role manage changes in ICT system skill
• not needed by the target role monitor system performance skill
• not needed by the target role operating systems knowledge
• not needed by the target role operational tactics for emergency responses knowledge
• not needed by the target role perform project management skill
• not needed by the target role perform risk analysis skill
• not needed by the target role perform scientific research skill
• not needed by the target role project management knowledge
• not needed by the target role protect ICT devices skill
• not needed by the target role provide ICT consulting advice skill
• not needed by the target role provide information skill
• not needed by the target role provide user documentation skill
• not needed by the target role remove computer virus or malware from a computer skill
• not needed by the target role safety engineering knowledge
• not needed by the target role security threats knowledge
• not needed by the target role track key performance indicators skill

1 further entry not listed here

Knowledge gaps usually close through study. Practical skill gaps usually need something you can point at.

• still to learn ICT project management required
• still to learn data protection required
• still to learn decision support systems required
• still to learn information confidentiality required
• still to learn internal risk management policy required
• still to learn organisational resilience required
• still to learn assessment of risks and threats required
• still to learn audit techniques required
• still to learn ethics required
• optional, not held control objectives for information and related technology optional
• optional, not held ICT communications protocols optional
• optional, not held ICT infrastructure optional
• optional, not held ICT recovery techniques optional
• optional, not held ICT system user requirements optional
• optional, not held computer forensics optional
• optional, not held software anomalies optional
• optional, not held World Wide Web Consortium standards optional
• optional, not held computer programming optional

Yes, and it is a substantial move. A cyber incident responder already covers 42% of what a chief ICT security officer is expected to do: 34 skills carry over, 20 of which the chief ICT security officer role treats as required.

27 required skills are missing, plus 20 optional ones. They fall into 10 areas of the ESCO skill hierarchy, led by information skills. The single most important is establish an ICT security prevention plan.

Its learning distance is 71.5 out of 100, which is the substantial band. That accounts for both how much is missing and how specialised those skills are.