NICE Framework Change Requests Frequently Asked Questions

The NICE Framework is developed in coordination with community stakeholders. You can submit updates for consideration:

• During formal requests for comments. Stakeholders will be able to view and provide comments on candidates (draft updates available for public comment) during defined comment periods. These time periods are requests for feedback on specific NICE Framework content (e.g., a draft Work Role). They are announced via the NICE Program office and on the NICE Framework Resource Center site. Comments on candidates are reviewed by NIST as part of its adjudication process prior to final release of the draft content. Requests for comments are announced on the NICE Framework Resource Center homepage and the NICE email distribution list and other public venues.
• Outside of comment periods. Stakeholders can suggest change requests (a “proposal”) to NICE at any time via NICEFramework [at] nist.gov (NICEFramework[at]nist[dot]gov). The NICE Program office may respond to the request immediately for action or may defer the comment for later consideration, e.g., as part of a planned update or during internal quarterly comment review periods. Note that submission of a proposal does not guarantee that NIST will include the proposal in a future comment period (as a “candidate”) or release of the NICE Framework. 

Change requests begin as proposals and may advance to candidate status. 

• Proposal: A proposal is a submitted change request. Proposals may be for new components or for revisions to or withdrawal of existing components. 
• Candidate: A candidate is a proposal that is available for public comment. Stakeholders will have the ability to review and provide feedback on draft candidates during defined comment periods.

Note that submission of a proposal does not guarantee that NIST will include the proposal in a future comment period (as a “candidate”), and neither proposals nor candidates are guaranteed to be accepted as formal updates. 

Changes can be proposed for the following NICE Framework components: Work Role Categories and Work Roles, Competency Areas, and Task, Knowledge and Skill (TKS) statements. Proposed updates may take the form of:

• Administrative changes: These changes address minor administrative errors, including typographical and grammatical errors. 
• Additions: New statements, Work Roles, or Competency Areas.
• Adjustments: Proposals to change existing components (e.g., revisions or expansions).
• Withdrawals: Proposals to retire existing components. 

Further, NICE will continue to accept suggestions for changes related to the NICE Workforce Framework for Cybersecurity (NICE Framework) (NIST Special Publication 800-181, Revision 1) and NICE Framework Competency Areas: Preparing a Job-Ready Cybersecurity Workforce (NIST Internal Report 8355) as part of future Calls for Public Comments and informally via the NICEFramework [at] nist.gov (NICEFramework[at]nist[dot]gov) email address. 

Learn more about change types.

As a NIST publication, updates to the NICE Framework will be approved by the NICE program office after consultation with subject matter experts and stakeholders as needed. These stakeholders may represent government (including federal, state, local, tribal, and territory levels), private industry, academia, training and service providers, and learners (students, job seekers, and employees).

The following will be taken into consideration when reviewing proposed updates: 

• How updates align to the Workforce Framework for Cybersecurity (NICE Framework) structure and scope. 
• If the proposal is essential and has wide-ranging impact. 
• If the proposal addresses workforce needs that apply across sectors, industries, and types of organizations, versus a change to address the unique requirements of an organization or specific industry or sector.
• How the proposal relates to existing NICE Framework content, including the extent of impact an update might make.
• If Task, Knowledge, and Skill (TKS) statement updates adhere to the Task, Knowledge, Skill (TKS) Statements Authoring Guide for Workforce Frameworks.

Proposals received during comment periods are collected and reviewed by the NICE Program office for adjudication. During this process the NICE office may reach back out to commenters, subject matter experts, and additional stakeholders for additional information. Adjudication identifies comments as follows:

• Noted: Comments that do not require any action (e.g., comments in support of updates). 
• Accepted: The suggested action provided by the commenter is accepted as is and the update made accordingly.
• Accepted with Modification: The feedback provided by the commenter is accepted, though how the update is made may vary from the suggested approach.
• Deferred: Typically denote comments that are out of scope of the current comment period but that will be reviewed separately. 
• Rejected: Feedback that is rejected, typically due to scope issues or contrary feedback from the community. 

Comments received outside of specified comment periods and comments marked as “deferred” from comment periods will be reviewed by NICE Program staff to determine if action can be taken. This may include, for instance, incorporating feedback into planned development, informing NICE as to future directions and work, or following up with the commenters or the community on the feedback for further discussion. 

Comments received during comment periods receive an acknowledgement of receipt from the NICE Program office. Following adjudication, adjustments may be made to NICE Framework components based on the feedback received. This updated content is shared with the community (either as updated version or as a subsequent draft for further comment) with a summary of the feedback received during the comment period.

Comments received outside of comment periods as well as deferred comments will be reviewed periodically by NICE staff. Periodic summaries of the comments that have been received and any actions taken by the NICE Program Office will be made available. Items that are marked as “Under Review” during these periods may require additional stakeholder conversation and may also be noted in the summary. 

In addition, you can contact the NICE program office at any time with specific questions NICEFramework [at] nist.gov ((NICEFramework[at]nist[dot]gov)).

A change log will be maintained and all updates will be communicated via the NICE Framework Resource Center and via the NICE Framework Users Group. 

A detailed change log and unique version identifiers will be used to maintain version control of the NICE Framework components as they evolve (see NICE Framework Revisions for more information). As such, earlier versions of content, including withdrawn content, will still be available for use. 

Please include the following details in your change request:

1. Contact Information: This information will allow us to reach you if there are questions. It will not be shared publicly. 
   1. Name
   2. Title
   3. Organization
   4. Email address
2. Rationale: An explanation as to why the change is being proposed, including information regarding the proposed change’s impact and timeliness. 
3. Type of Change: Please note whether the proposal is for:
   1. New Component
   2. Update to Existing Component
   3. Suggested Removal of Existing Component
4. Proposed Change: The change itself. This may include not just the core change, but also address how that change may impact other related aspects of the NICE Framework. For instance, a new Task statement should include information regarding which Work Role(s) the task should be associated with. A new Work Role should include which Work Role Category it would fall under, as well as any information regarding existing or new TKS statements that would be tied to that role. A suggested deletion should discuss whether the deletion would be replaced with updated content, or if it is being proposed as removed only from one area (e.g., a specific Competency Area) or across the NICE Framework. 

If your request is in response to a Call for Comment, follow the instructions provided as part of that call. If it is outside of a comment period, send your request to NICEFramework [at] nist.gov (NICEFramework[at]nist[dot]gov). (See “When can I submit change requests for changes?” above for more information.)