Knowledge
Knowledge (K) – The theoretical understanding an apprentice needs to perform their role effectively. This includes industry-specific principles, regulations, and best practices. - K1: Principles of organisational information security governance and the components of an organisation’s cyber security technical infrastructure including hardware, operating systems, networks, software and cloud
- K2: Cyber security policies and standards based on an Information Security Management System (ISMS)
- K3: Types of physical, procedural and technical controls
- K4: Awareness of how current legislation relates to or impacts upon the occupation including Data Protection Act, Regulation of Investigatory Powers Act, Human Rights Act, Computer Misuse Act, Freedom of Information Act, Official Secrets Act, Payment Card Industry Data Security Standard (PCI-DSS), Wireless and Telegraphy Act, professional body codes of conduct, ethical use of information assets
- K5: Cyber security awareness and components of an effective security culture, different organisational structures and cultures, the importance of maintaining privacy and confidentiality of an organisation’s information and the impact of a poor security culture
- K6: Principles of cyber security compliance and compliance monitoring techniques
- K7: Core terminology of cyber security – confidentiality, integrity, availability (the CIA triad), assurance, authenticity, identification, authentication, authorization, accountability, reliability, non-repudiation, access control
- K8: Common security administrative operational tasks e.g. patching, software updates, access control, configuring a range of firewalls, security incident and event management tools (SIEM) and protection tools (Anti-virus, Anti-malware, Anti-spam)
- K9: Cryptography, certificates and use of certificate management tools
- K10: Processes for detecting, reporting, assessing, responding to, dealing with and learning from information security events
- K11: Principles of identity and access management – authentication, authorisation and federation – and the inter-relationship between privacy and access rights and access control, and the types of access control, access control mechanisms and application control
- K12: Types of digital information assets used in a controlled environment and the need to maintain an inventory of information assets used in a controlled environment and the need for and practice of secure information asset disposal
- K13: Disaster prevention and recovery methods and the need for continuity of service planning and how an organisation might implement basic disaster prevention and recovery practices using conventional and incremental secure backup and recovery techniques and tools both onsite and offsite including geographic considerations
- K14: Categories of cyber security vulnerabilities and common vulnerability exposures –software misconfiguration, sensitive data exposure, injection vulnerabilities, using components with known vulnerabilities, insufficient logging and monitoring, broken access control and authentication, security misconfiguration, incorrect cross-site validation
- K15: Components of a vulnerability assessment scope and techniques to evaluate the results of a vulnerability assessment and provide recommendations based upon the evidence provided by the vulnerability assessment tools. The impact that vulnerabilities might have on an organisation and common vulnerability assessment tools and their strengths and weaknesses
- K16: Threat sources and threat identification and network reconnaissance techniques and the impact that threats might have on an organisation
- K17: Types of information security events – brute force attack, malware activity, suspicious user behaviour, suspicious device behaviour, unauthorized system changes
- K18: Computer forensic principles – the importance of ensuring that evidence is not contaminated and maintaining the continuity of evidence without compromising it
- K19: Standard information security event incident, exception and management reporting requirements and how to document incident and event information as part of a chain or evidence
- K20: Common information security policies – acceptable use, incident management, patching, anti-virus, BYOD, access control, social media, password, data handling and data classification, IT asset disposal
- K21: Cyber security audit requirements, procedures and plans, need to obtain and document evidence in an appropriate form for an internal or external auditor to review
- K22: The significance of customer issues, problems, business value, brand awareness, cultural awareness/ diversity, accessibility, internal/ external audience, level of technical knowledge and profile in a business context
- K23: Evolving cyber security issues in the digital world including the application to critical national infrastructure, communications technologies, the need for information assurance and governance, control systems and internet of things (IoT) devices
- K24: Different learning techniques and the breadth and sources of knowledge and sources of verified information and data
- K25: Importance of maintaining privacy and confidentiality of an organisations information and the impact of a poor security culture
- K26: Concepts of service desk delivery and how to respond to requests for assistance received by a service desk and be able to describe different methods of escalation, when to escalate to a higher level where necessary and the need to communicate accurately and appropriately during an escalation
- K27: Risk assessment, risk management and business impact analysis principles
- K28: How their occupation fits into the wider digital landscape and any current or future regulatory requirements
- K29: How to use data ethically and the implications for wider society, with respect to the use of data
- K30: Roles within a multidisciplinary team and the interfaces with other areas of an organisation
You can view the standard here. |
