Introducing the Information Technology Security Essential Body of Knowledge Framework

Abstract The National Strategy to Secure Cyberspace spurred the development of the Essential Body of Knowledge (EBK) for Information Technology Security. The key feature of this security tool is its ability to act as a framework for analyzing institutional security training needs and managing security workforce development. This is accomplished through a series of steps that map security personnel roles, competency areas, and functional perspectives to an industry accepted matrix of organizational security needs. By capturing the human resource and functional elements of security, the EBK acts as a distillation of best practice, laid out in generic form ready for implementation across a wide spectrum of organizations. This paper introduces the EBK, explains its form and content, and demonstrates how to transition from the generic framework to functional model that is useful in determining organizational security structure and helpful for managing security personnel training and future security needs.