The job practice consists of task and knowledge statements, organized by domains. The domains and their are as follows:

• Understand basic cybersecurity concepts and definitions
• Apply cybersecurity architecture principles
• Identify components of a cybersecurity architecture
• Define network security architecture concepts including:
o topology
o protocols
o components
o principles
• Understand malware analysis concepts and methodology
• Recognize the methodologies and techniques for detecting
host-and-network-based intrusions via intrusion
detection technologies
• Identify computer network defense (CND) and
vulnerability assessment tools, including open source
tools and their capabilities
• Understand system hardening
• Apply penetration testing principles, tools, and techniques
• Define network systems management principles, models,
methods, and tools
• Understand remote access technology and systems
administration concepts
• Recognize the Unix command line
• Distinguish system and application security threats
and vulnerabilities
• Recognize system lifecycle management principles,
including software security and usability
• Understand the local specialized system requirements for
safety, performance, and reliability
• Define types of incidents (categories, responses, and timelines
for responses)
• Outline disaster recovery and business continuity planning
• Understand incident response and handling methodologies
• Understand security event correlation tools, and how different
file types can be used for atypical behavior
• Recognize investigative implications of hardware,
operating systems, and network technologies
• Be aware of the basic concepts, practices, tools, tactics,
techniques, and procedures for processing digital forensic data
• Identify network traffic analysis methods
• Recognize new and emerging information technology
and information security technologies including:
o The current threat landscape
o Mobile devices
o Cloud computing and storage