Addressing Skills Shortage and Gap Through Higher Education

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

NOVEMBER 2021 0 ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

CONTACT

To contact the authors, please use euskills@enisa.europa.eu. For media enquiries about this paper, please use press@enisa.europa.eu.

AUTHORS

Jason R.C. Nurse (University of Kent), Konstantinos Adamos (University of Aegean), Athanasios Grammatopoulos (ENISA), Fabio Di Franco (ENISA)

LEGAL NOTICE

This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the Regulation (EU) No 2019/881.

ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication.

Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication.

ENISA maintains its intellectual property rights in relation to this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2021 Reproduction is authorised provided the source is acknowledged.

Copyright for the image on the cover: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN 978-92-9204-540-1 DOI: 10.2824/033355

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

TABLE OF CONTENTS

EXECUTIVE SUMMARY 4 1. INTRODUCTION 5

1.1 SCOPE OF THE REPORT 6

1.2 TARGET AUDIENCE 7

1.3 REPORT STRUCTURE 7

2. THE SUPPLY OF CYBERSECURITY QUALIFICATIONS AND SKILLS 9

2.1 INTRODUCTION 9

2.2 AN ANALYSIS OF THE CHARACTERISTICS OF CYBERSECURITY PROGRAMMES 10

2.3 AN ASSESSMENT OF ENROLMENTS AND GRADUATES AND THEIR ABILITY TO ADDRESS THE NEEDS FOR SKILLS 18

3. INITIATIVES TO ADDRESS THE CYBERSECURITY SKILLS SHORTAGE AND GAP IN THE EU 24

3.1 INTRODUCTION 24

3.2 RAISE USER AWARENESS AMONGST THE GENERAL PUBLIC AND IN PRIMARY AND SECONDARY EDUCATION 25

3.3 STRENGTHEN TRAINING AND PROMOTE CYBERSECURITY IN HIGHER EDUCATION 28

3.4 ORGANISE CYBERSECURITY EXERCISES AND CHALLENGES 31

4. SUMMARY AND RECOMMENDATIONS 34

4.1 INCREASE ENROLMENT IN CYBERSECURITY PROGRAMMES 35

4.2 SUPPORT A UNIFIED APPROACH ACROSS GOVERNMENT, INDUSTRY AND UNIVERSITIES 36

4.3 UNDERSTAND JOB MARKET NEEDS AND TRENDS 37

4.4 COLLABORATIONS BETWEEN EUROPEAN MEMBER STATES 37

4.5 CYBERHEAD’S VALUE FOR STUDENTS, HIGHER EDUCATION INSTITUTIONS AND MEMBER STATES 38

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION A ANNEX: CYBERHEAD QUESTIONS 39

A.1 ANNEX SUBSECTION 39

A.2 LIST OF QUESTIONS TO BE ANSWERED BY THE HEIS 39

B ANNEX: EXPANDING THE CYBERHEAD QUESTION SET 40 C ANNEX: MEMBER STATE REPLIES 44 D ANNEX: APPROACHES ADOPTED BY NON-EU COUNTRIES 62

D.1 RAISE USER AWARENESS AMONGST THE GENERAL PUBLIC AND IN PRIMARY AND SECONDARY EDUCATION 62

D.2 STRENGTHEN TRAINING AND PROMOTE CYBERSECURITY IN HIGHER EDUCATION 63

D.3 ORGANISE CYBERSECURITY EXERCISES AND CHALLENGES 65

E ANNEX: LIST OF CYBERHEAD PROGRAMMES 66 ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

EXECUTIVE SUMMARY

The cybersecurity skills shortage and gap are well-documented issues that are currently having an impact on national labour markets worldwide. While various initiatives related to cybersecurity skills have been proposed and multiple actions have been launched to address the problems, the shortage and gap persist. ENISA has a long tradition of studies and programmes that have attempted to mitigate similar cybersecurity issues. In an effort to increase the EU’s future cybersecurity workforce and ensure the availability of appropriately trained professionals, ENISA has investigated the problem further.

In this report, ENISA contributes to both practice and research on the cybersecurity skills

This report

shortage and gap in two distinctive areas. Firstly, it provides an overview of the current supply of cybersecurity skills in Europe through an analysis of data gathered and generated by the describes the recently established Cybersecurity Higher Education Database (CyberHEAD). Secondly, it approaches to describes the policy approaches adopted by EU Member States in their quest to increase and

address the

sustain their national cybersecurity workforces. These approaches have been classified and

cybersecurity

analysed based on objectives defined by ENISA’s National Capabilities Assessment Framework (NCAF), namely cybersecurity awareness, training, challenges and exercises. Here we note that skills shortage this report focuses on the role of the higher education sector in addressing the EU cybersecurity and gap within skills shortage and gap, and therefore vocational or lower forms of education in cybersecurity the EU. related topics are not considered as core parts of this study.

It provides

Based on the data collected and analysed under the two areas mentioned above, this report

unique insights

makes five recommendations to address the EU cybersecurity skills shortage and gap:

into the

 Increase enrolments and eventually graduates in cybersecurity programmes through: programmes o the diversification of the Higher Educational Institutes’ (HEIs) curricula in offered by the terms of content, levels and language.

EU’s academic

o the provision of scholarships, especially for underrepresented groups, and more active efforts to promote cybersecurity as a diverse field. institutions  Support a unified approach across government, industry and HEIs through: based on o the adoption of a common framework regarding cybersecurity roles,

CyberHEAD

competencies, skills and knowledge, for example, the one provided by the European Cybersecurity Skills Framework. data. o the promotion of challenges and competitions in cybersecurity skills.  Increase collaborations between Member States in: o launching European cybersecurity initiatives with shared objectives. o sharing of the outputs of programmes (including results and lessons learnt).  Promote analysis of the cybersecurity market needs and trends through: o the identification of metrics showing the extent of the problem and possible measures to cope with it.  Support the promotion of CyberHEAD (and its further evolution) in order to: o facilitate an ongoing understanding of the status of cybersecurity higher education programmes in the EU. o monitor trends regarding the number of cybersecurity graduates who could potentially fill current vacancies in the sector. o support the analysis of demographics (including the diversity) of new students and graduates in cybersecurity. o assist in monitoring the effectiveness of cybersecurity initiatives targeting the supply side (e.g. changes in enrolments in HEI programmes after the release of new cybersecurity initiatives). o demonstrate the value of CyberHEAD for HEIs as well as incentivise HEIs to submit their programmes to CyberHEAD.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

1. INTRODUCTION

Technology plays a central role in society today. It supports initiatives by business and government, enables worldwide communications and drives innovation. As technology has become more prevalent, so has the reality of cyber-attacks targeting corporations, governments and individuals. Over the last five years, the World Economic Forum has consistently rated 1, 2 cyber-attacks as a substantial global risk and the latest reports from ENISA further highlight the complexity of the threat landscape, suggesting that these attacks are increasingly sophisticated, targeted and widespread .

In response to the vast increase in online and emerging cyberthreats, the field of cybersecurity has grown substantially over the last decade. Cybersecurity solutions and technologies are widely available from industry and open-source communities, and security processes, standards and laws (e.g. ISO27000, NIST Cybersecurity Framework, NIS Directive) continue to be developed and refined. These are all signs of an increasingly mature field and are pivotal to adequately addressing the dynamic nature of cyberthreats.

An area where cybersecurity remains under-developed however is in the skills present in the workforce. More specifically, there is a lack of skilled and qualified personnel in the labour market to work in cybersecurity roles and who can sufficiently address the range of cyberthreats posed. Over the years, this has become a well-documented problem, which continues to 4,5,6,7,8,9 significantly impact countries across Europe and the world . Within countries and specific sectors, these issues are even more pronounced due to strong competition for security professionals which often means that certain sectors (e.g. governments and central banks) have difficulty attracting talented security professionals compared to others (such as the finance industry) that can offer more lucrative employment .

The lack of cybersecurity professionals is usually discussed in the context of the cybersecurity skills gap and cybersecurity skills shortage. These are two distinctive, albeit closely related, issues. The cybersecurity skills gap is seen to refer to a lack of appropriate skills in the 11,12 workforce to perform cybersecurity tasks within a professional setting . On the other hand, the skills shortage refers to a lack of cybersecurity professionals to fill cybersecurity roles or, as

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

aptly defined, the ‘unfilled or hard-to-fill vacancies that have arisen as a consequence of a lack of qualified candidates for posts . In this report, we examine both areas.

There have been various attempts to address the cybersecurity skills shortage and gap. Examples of policies include changes in higher education programmes, closer engagement between academia and industry, and an increasing number of security certifications and training 14,15,16,17 opportunities . Educators, in particular, are often viewed as central figures, as evidenced by existing research using France, Germany, Netherlands, Spain, Italy and the UK as units of analysis.

One important question for the EU is how such national policies, programmes and interventions (including any additional ones from industry and academia) may apply to the EU as a whole, and whether they can help in addressing the cybersecurity skills shortage and gap. Therefore, in this report, one goal is to pursue these questions to provide insights and recommendations that are suitable in an EU context.

1.1 SCOPE OF THE REPORT

This report contributes to practice and research into the cybersecurity skills shortage and gap in two ways. Firstly, it provides an overview of the current supply of advanced cybersecurity skills in Europe through an analysis of the recently established Cybersecurity Higher Education Database (CyberHEAD). Secondly, it describes the policy approaches adopted by EU Member States in their quest to increase and sustain their national cybersecurity workforce. With this basis the report then proposes a series of recommendations for reducing the cybersecurity skills shortage and gap through Higher Education in the EU.

A primary area of focus in this report is the ENISA Cybersecurity Higher Education Database (CyberHEAD). Launched in March 2020, this crowd-sourced database – populated by Higher Education Institutions (HEIs) – aggregates cybersecurity degrees in the EU and European Free Trade Association (EFTA) countries. As such, this database provides a unique insight into the supply of cybersecurity skills on offer from European HEIs as well as information about the types of individuals being trained. This report presents the first analysis of this data collected by CyberHEAD.

This report will answer the following research questions:

1. What insights can be derived from ENISA’s Cybersecurity Higher Education Database about the cybersecurity qualifications and skills being developed by European HEIs? 2. Based on ENISA’s Cybersecurity Higher Education Database, how many and what types of individuals are undertaking HEI cybersecurity courses in Europe (i.e. the individuals likely to enter the security workforce)? 3. How are EU Member States attempting to address the cybersecurity skills shortage and gap in their own countries? For instance, what policy initiatives and what programmes exist? How do these compare and contrast within the EU? 4. What recommendations can be provided to address the EU’s cybersecurity skills shortage and gap? This involves questions such as: What recommendations may be

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

provided for the EU generally and EU Member States individually? What policy initiatives may prove valuable at addressing the cybersecurity shortage and gap? How can ENISA’s Cybersecurity Higher Education Database be further enhanced to better capture key indicators of skills supplied and the workforce being trained in the EU?

1.2 TARGET AUDIENCE

The cybersecurity skills shortage and gap represent a significant problem that is faced by governments, industry and the wider society. In this report, we provide key insights into the cybersecurity skills shortage and gap in the EU, reflect on approaches to address it, and conclude with a series of recommendations to enhance the provisions of skills. The research and findings in this report are targeted at four main bodies:

 EU Member States and European institutions interested in cybersecurity skills and the role that Higher Education has to play: This report provides the first comprehensive digest of the provision of cybersecurity qualifications and skills in EU HEIs, as represented by CyberHEAD (which contains 126 programmes from 25 European countries ). It also presents notable insights into current approaches to address the skills shortage and gap and the recommendations for states, which draws on international best practices, which can be applied.  EU Higher Education Institutions (HEIs): This report’s findings can provide an overview of the cybersecurity qualifications and skills on offer in HEIs across the EU, how they are supplied, and how many students are currently enrolled and graduating broken down by gender. Such summary information, along with this report’s recommendations, can help HEIs better tailor new or existing programmes (e.g. to match demand in certain subject areas, or fill a gap in other areas).  Business and industry: Businesses and the security industry generally are central to mitigating the shortage of cybersecurity professionals. This report’s findings define some of the ongoing problems within the HEI sector, and present opportunities for businesses to work more closely with academia to create HEI curricula that are in line with the needs of businesses in the EU.  Researchers and the academic community: The research presented in this report advances the current discourse into cybersecurity skills, using quantitative (e.g. from CyberHEAD) and qualitative data (e.g. reports from EU Member States), while also outlining a series of recommendations. This is one of the largest studies to date on this topic in the EU and can provide a basis for future research efforts and intellectual discussion.

1.3 REPORT STRUCTURE

This report is organised as follows:

 Section 2 analyses data from ENISA’s Cybersecurity Higher Education Database (CyberHEAD) to understand the characteristics of programmes, the students engaging with them, and the ability of graduating students to assist in addressing the EU’s need for skills.  Section 3 examines the different approaches adopted by EU Member States to mitigate the cybersecurity workforce skills shortage and gap. This is based on a questionnaire completed by States and openly sourced information.  Section 4 reconsiders the previous sections and provides recommendations on how EU’s cybersecurity skills shortage and gap may be addressed. This section also includes recommendations for the further development of CyberHEAD given the key role it may play in understanding the state of the EU’s cybersecurity skills.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

In addition, the Annexes delve deeper into some of the above topics:

 Annex A lists the questions that need to be answered by European academic institutions (HEIs) when listing their programmes in CyberHEAD.  Annex B investigates the questions that might be added to the database in the future in order to give further insights into the cybersecurity skills gap and shortage.  Annex C includes the full replies provided by the Member States on cybersecurity skills, policies and initiatives. This data informed Section 3.  Annex D lists the approaches taken by two non-EU countries (the United Kingdom and the United States) in their efforts to address the shortfall in cybersecurity professionals.  Annex E includes the 126 programmes listed in CyberHEAD on the 20th of June 2021.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

2. THE SUPPLY OF CYBERSECURITY QUALIFICATIONS AND SKILLS

2.1 INTRODUCTION

To analyse the supply of cybersecurity qualifications and skills in the EU, this report makes use of ENISA’s Cybersecurity Higher Education Database (CyberHEAD). This database is the largest resource of its nature and is able to provide a reliable and up-to-date snapshot of cybersecurity programmes available across the EU. This is complementary to, and informed by, other efforts (e.g. pilot maps from the Cyber Competence Network (CCN)) which aim to catalogue security courses and training across Europe . It should be noted that CyberHEAD may not list all the available cybersecurity programmes in the EU, because it is a crowd-sourced database which relies on HEIs to submit their programmes.

CyberHEAD – Cybersecurity Higher Education Database

provides the largest reliable and updated source of information on higher education cybersecurity programmes in Europe

www.enisa.europa.eu/cyberhead

For degree programmes to be eligible for inclusion in CyberHEAD, there are two core criteria . Firstly, the degree must be recognised by the national authority of an EU or European Free Trade Association (EFTA) Member State. Secondly, the degree’s content must contain a notable volume of cybersecurity topics. Cybersecurity is defined as any subject within the knowledge areas of the Cybersecurity Curricula 2017 developed by the Joint Task Force on Cybersecurity Education . More specifically:

 For a bachelor’s degree: at least 25% of the taught modules must address cybersecurity topics.  For a master’s degree: at least 40% of the taught modules must address cybersecurity topics.  For a postgraduate specialisation programme: at least 40% of the taught modules must address cybersecurity topics and the programme must have a minimum of 30 hours for the European Credit Transfer and Accumulation System (ECTS).

The questions that HEIs are expected to answer in order to be added to CyberHEAD, which also define the type of data stored in the database, can be found in Annex A.

The dynamic nature of programmes – i.e. the speed at which degrees may be launched, changed or removed – makes it difficult for any database to be complete. On the 20th of June 2021, CyberHEAD contained 126 programmes from 25 European countries as can be found in Annex E. Figure 1 presents the geographical distribution of CyberHEAD programmes.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Figure 1: Geographical distribution of CyberHEAD programmes

Section 2 is composed of two parts: Section 2.2 reports on an analysis of HEI data to derive insights into the cybersecurity qualifications and skills provided, while Section 2.3 uses CyberHEAD’s data to examine demographic information about the cohorts and graduates of the programmes listed.

2.2 AN ANALYSIS OF THE CHARACTERISTICS OF CYBERSECURITY PROGRAMMES

CyberHEAD includes a variety of information about cybersecurity programmes, which can be used to assess the nature of skills courses being offered in the EU. The oldest programme in the database started in 2000 and is a bachelor’s degree in Secure Information Systems, and after that there is a master’s degree in Cybersecurity which was founded in 2002. Most programmes (64%) were launched between 2015 and 2020, with 2019 being the most prolific year (20 new courses were established, 16% of the total in the database).

Figure 2 provides an overview based on programmes where we possess data on the years when they were started, while Figure 3 aggregates these data to visualise the increase of cybersecurity programmes over the years. These trends broadly match the rise in cybersecurity as a field of study and practice, and the increase in demand for adequately trained security professionals. Several notable strategies and reports were also released in the lead up to these years including the EU Cybersecurity Strategy, ENISA’s Cybersecurity Education snapshot for workforce development in the EU and the International Information System Security Certification Consortium’s (ISC)² report on Cybersecurity Workforce Competencies .

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

These reports, in combination with the increase in demand for cybersecurity skills and changes in the labour market , have undoubtedly influenced the demand for, and provision of, securityoriented HEI programmes.

Figure 2: Programmes established per year

Figure 3: Total programmes per year

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Master-level qualifications constitute most of the programme types (77%) in the database, followed by bachelor programmes (17%) and postgraduate programmes (6%), as can be seen from Figure 4. The high number of master programmes is intriguing when considering that there is a higher cybersecurity topic requirement (i.e. at least 40% of taught modules) compared with undergraduate programmes (which require at least 25%). The large quantity of master's degree programmes suggests that cybersecurity is regarded as a specialist topic which should be taught at a higher educational level than an undergraduate degree. This is also noticeable in some courses as they present admission profiles that call for recent graduates in Computer Science, Engineering, Mathematical Sciences or Physical Sciences. There is also an emphasis on work experience as a requirement for admission to a small set of master programmes. In such cases, at least two years of relevant professional experience is mentioned, preferably after an undergraduate degree.

Bachelor qualifications in cybersecurity seem less common based on the data but there has been a rise in new courses since 2018. A challenge for the establishment of such programmes, however, is for HEIs to convince students to commit to a specific qualification pathway instead of a more general degree such as computer science or engineering, which may give them broader career options later on. Choosing cybersecurity as an undergraduate degree may be risky for many students, particularly as cybersecurity jobs are attainable with only a computing or engineering degree. For reference, if we compare the proportion of master and bachelor programmes to those in other countries, the UK’s National Cyber Security Centre shows that certified master qualifications are similarly prominent .

Figure 4: Programme types

The accessibility of EU HEI programmes is an important concern when discussing the

cyber skills gap. Courses that present barriers to entry for students can impact recruitment and ultimately reduce the pool of graduates that may later enter the security workforce. Accessibility is interpreted broadly in this report, and as such is concerned with any factors that may impact the ability to access or apply for courses. To assess accessibility, this report examines the delivery method adopted by current programmes, the language in which programmes are taught, and whether fees apply for EU citizens. All these factors provide some basic insights into how open current courses are to applicants from across the EU and are grounded in general 30,31 literature regarding potential inhibitors to education .

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Considering delivery methods first, 57% of programmes are classroom only, 29% are blended (classroom and online) and 14% are online (see Figure 5). This suggests that geographic proximity to the HEI is necessary in most programmes. While the benefits of classroom-based interaction are undeniable (and typically range from tailored in-person teaching to dedicated security labs and class-based exercises), online courses are increasingly popular as they are more flexible and can cater to a large number of geographically dispersed students. This reality has become even more salient due to the COVID-19 pandemic and the various national and city-wide lockdowns across Europe.

Figure 5: Programme delivery methods

Language is relevant to the discussion of opportunities and barriers-to-entry because at least 24 languages are spoken across Europe. Programmes in widely known languages such as English are arguably more accessible to a greater number of EU citizens. In total, 16 languages were represented in the CyberHEAD data: 38% of courses were in English, 17% in Spanish, 11% in German, 7% in Italian, 5% in French, 4% in Greek, and 4% in Portuguese (see Figure 6).

There is some overlap in the origin of courses with programmes from Italy, Spain, France, and Austria appearing most. The fact that 38% of programmes are taught in English is excellent given the diversity of languages in Europe, but an even higher percentage of English-based programmes also presents additional benefits. For instance, it might facilitate the creation of a fully rounded professional who is able to read and communicate in English and interact seamlessly in an international setting. It might also attract international students looking for the best opportunities in the EU.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Figure 6: Programmes per language with percentages

Fees are another important topic when it comes to considering access. This report found that in 71% of programmes EU citizens need to pay fees in order to enrol (see Figure 7). This topic is more contentious because although free programmes can lower the financial barrier to entry, HEIs need income to fund teaching staff, dedicated software and computing labs. Unless these funds are provided by governments or through industry partnerships, fees will still have to be charged.

Figure 7: Programme fees

A primary aim of this report is to determine the skills provided by EU cybersecurity programmes. To investigate this further, this study assessed the amount of credits (measured using the European Credit Transfer and Accumulation System (ECTS)) allocated to various security topics within each course. Across all programmes (bachelor, master and postgraduate programmes) where data was provided:

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

 48.45% of content was dedicated to Security Computing/Engineering disciplines,  9.55% to Law, Ethics, Policy, Privacy, Cybercrime disciplines,  12.11% to Organisational, Risk management, Business, Compliance disciplines,  4.49% to internships,  and 25.4% to other content. For a breakdown according to programme, see Figure 8. Figure 8: All Bachelor and Master/Postgraduate programmes average ECTS allocation Programmes Average ECTS Allocation

Bachelor Programmes: Average ECTS Allocation

Master/Postgraduate Programmes: Average ECTS Allocation

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

The data demonstrates a clear presence of more cybersecurity engineering topics in the EU’s

CyberHEAD

HEI cybersecurity programmes, which is especially visible in master and postgraduate programmes. The bachelor programmes contain only 33.73% of cybersecurity engineering shows, on material, and instead have substantial ‘Other’ content (at 42.92%). This is likely attributable to average, a clear the need to cover more general topics outside the scope of security (including foundational prevalence of computing courses) considering that these cannot be assumed because it is a first degree.

cybersecurity computing and

Reflecting on this finding, it appears to map well with the skills needed as discussed in reports

engineering topics

on the cybersecurity skills shortage and gap. The 2020 ESG and ISSA report found that the areas with the greatest shortage of cybersecurity skills were application security, cloud in the EU’s higher computing security, security analysis and investigations, security engineering, and the education administration of risk and/or compliance . Many of these areas continued to be weak in the

cybersecurity

2021 ESG and ISSA report. Cloud computing security (which is within Security

programmes

Computing/Engineering disciplines) is highlighted in the (ISC)² Cybersecurity Workforce Study 2020 as the principal area in which professionals should aim to increase their skills . These studies suggest that current programmes have the appropriate subject focus.

Beyond Cybersecurity Computing/Engineering disciplines, it is encouraging to see programmes also offering topics such as Organisational, Risk Management, Business, Compliance disciplines and Law, Ethics, Policy, Privacy and Cybercrime. However, these seem low when compared to skills required by the labour market as mentioned in the (ISC)² Cybersecurity Workforce Study . In this study, Risk assessment, analysis, management and governance, and Risk management and compliance occupy the second and forth positions (respectively) of the top cybersecurity skills of interest to professionals. This research is especially relevant to this report’s work as 28% of the 3,790 respondents were from Europe.

Over time, the importance of law, ethics and privacy concerns within cybersecurity are also likely to increase, due to regulations such as the General Data Protection Regulation (GDPR) and the NIS Directive. The reality is that these topics are not traditionally taught within engineering or computers science degrees and therefore will require HEIs to involve educators from other departments. An added benefit to offering a broader curriculum would be the development of more rounded cybersecurity students who will then be able to blend technical and socio-technical skills in a professional setting.

An important point concerning the above analysis is that it presents mean averages across the entire 124 programmes present in the database . A reality however is that, as with all degree courses, some courses specialise in certain areas and therefore contain more (or less) of certain topics. For instance, a cybersecurity degree offered by a Politics department will differ significantly to one offered by an Engineering school; i.e. the former is likely to include more Law, Ethics, Policy, Privacy and Cybercrime disciplines rather than engineering or computer science courses.

To provide more insight into the programmes, we also assessed the number of programmes that concentrated on Security Computing/Engineering disciplines as compared to those that focused on other disciplines. In total, 60 programmes contained 50% or more content (in terms of ECTS points) on Security Computing/Engineering disciplines. This represents almost half of all programmes and reaffirms the above findings.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Considering Organisational, Risk management, Business, Compliance disciplines and Law,

Beyond

Ethics, Policy, Privacy and Cybercrime disciplines, only 10 programmes possess more than

Cybersecurity

50% of these disciplines combined. This demonstrates the dearth of such programmes but presents opportunities for further expansion in HEIs. computing and

engineering

Preparing graduates for the cybersecurity workplace is an implicit goal of HEI programmes.

disciplines,

There are various ways in which this can be achieved. For instance, internships in organisations

programmes also

provide students with valuable working experience through which knowledge can be applied

focus on topics

and practice gained. Programmes with educators from industry (or content directly informed by industry) ensure that security topics are relevant to actual workplace tasks and issues. Finally, such as courses which prepare students for a professional security certification (e.g. CISSP, CISM) or Organisational, are accredited by national security bodies directly support the development of a career in

Risk Management,

security. We reflect on these topics further below.

Business, Compliance

Assessing CyberHEAD data, only 34% of EU programmes envisage a compulsory internship for students. While internships can be challenging to setup, the lack of internship opportunities may disciplines and negatively impact the skills of graduates, and also make it more difficult to attain a security job Law, Ethics, given a lack of working experience. Internships are one of the top recommendations in the

Policy, Privacy and

Cybersecurity professionals report and the BHEF’s report on reducing the deficit in

38 Cybercrime.

Cybersecurity talent . Another method of supporting engagement with industry is through the use of educators and guest lecturers who are employed in the cybersecurity industry. This type of interaction was present in 75% of the programmes, which is an impressive statistic (see Figure 9). Although the data do not provide information on the extent to which these professionals are engaged in these educational settings, it is encouraging to find this level of collaboration between the HEIs and industry.

Figure 9: How programmes prepare students for the work environment

As it relates to professional certification, 23% of programmes in the database reported that they prepare students for specific professional certifications. The top 7 certifications that were mentioned are shown in Figure 10 and include: ISO 27001, CEH, CISM, CCNA Security, CySA+, CISSP and CompTIA Security+. This low percentage appears to be reasonable because, while certificates may be ideal to link the supply with the demand for cybersecurity skills, educationalists may contend that HEIs should arguably be more concentrated on foundational knowledge and skills. The certifications mentioned appear quite common,

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

especially ones such as CISSP, which are viewed as particularly coveted and conducive to 39, 40, 41 enhancing the chances of acquiring a job in cybersecurity .

There are also several other certifications which are held by security professionals in industry. These include Cisco Certified CyberOps, CCNP Security, CCSP, Certified Web Security Professional and CISA . Adapting such courses that prepare students for any of these wide ranges of certificates as well may further increase their job prospects.

A noteworthy factor is their hands-on nature and the work experience that they require, which may make them less suitable to be adopted in traditional HEI settings. One option could be for certain HEI programmes to build on the technical knowledge necessary to obtain certificates while also ensuring that an appropriate academic foundation is provided within their courses. This would be especially important for HEIs, as the CISSP has been recognised as being comparable to the RQF Level 7, which is the same level as an UK master degree .

Figure 10: Top seven (7) certifications in CyberHEAD

2.3 AN ASSESSMENT OF ENROLMENTS AND GRADUATES AND THEIR ABILITY TO ADDRESS THE NEEDS FOR SKILLS

Another important question this report seeks to answer pertains to the demographic of individuals undertaking HEI cybersecurity courses in the EU. Addressing this question would

GRADUATES

provide some understanding of the number of graduates who could potentially enter the

PROJECTION

cybersecurity workforce over the next 2-3 years, the gender balance within EU HEI programmes The number of (which also has further implications on the persons entering the workforce) and insights that cybersecurity may be attained at the level of EU Member States. graduates is going to double in the next 2- Focusing first on current graduates, a total of 2,444 students graduated from the HEIs in 2020 3 years. according to CyberHEAD’s data. Of these, 1,940 were from master and other postgraduate programmes, and 504 from bachelor programmes. Looking at the enrolment data present in the database, 4,843 students entered their first year of studies in 2020. Of these, 3,415 were new students at the master and postgraduate level and 1,428 at bachelor level (see Figure 11).

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

The benefit of knowing the number of enrolments per year (in the database) is that one can make a projection about the number of cybersecurity students who may enter the cybersecurity workforce in the near future, taking into account some assumptions such as that enrolled students successfully complete their studies and that the majority of students in these programmes decide to pursue a cybersecurity career.

For instance, as master programmes are typically one-to-two years in duration, it may be assumed that either in 2021 or 2022, the number of master and postgraduate graduates will be 76% more than in 2020. For bachelor programmes, which typically have a duration of 3 years, the number of graduates who may enter the workforce in 2023 is almost triple with respect to 2020. Overall, based on the same assumptions, we can expect that the number of graduates in cybersecurity will double in 2 or 3 years (i.e. when the first-year students complete their academic studies). It should be noted that the increase in potential graduates can primarily be linked to the introduction of new programmes, and not necessarily large rises in enrolment.

Figure 11: New enrolments and graduates in 2020

Gender balance is another important topic that should be examined as we investigate cybersecurity education and the cybersecurity industry. As noted in existing research, gender CyberHEAD diversity in security roles can often be less representative than some national populations .

shows an under-

From an analysis of CyberHEAD’s data, the percentage of female students graduating in 2020

representation of

with respect to the overall population was 18% (434). In the same year, only 20% (940) of students enrolled were female (see Figure 12). These numbers are lower than what is reported women studying in studies that found that women represent 25% of the industry’s cybersecurity workforce , cybersecurity. which again suggests that HEIs should aim to increase their enrolment numbers further.

The general underrepresentation of women in Science, Technology, Engineering and Mathematics (STEM) and in cybersecurity is a well-documented phenomenon , but research has shown that this issue is improving . One of the primary suggestions to increase the representation of women in cybersecurity is to encourage them to pursue STEM degrees in the first place. This could therefore

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

be a perfect opportunity for EU courses to try to boost female enrolment, given the benefits this would have on the larger security industry in the EU. To add to this, a more concrete suggestion that might be explored is spotlighting women in cyber roles and recent female graduates, offering mentoring opportunities for young students or by offering scholarships to female students. Each of these actions may assist in increasing enrolments, which could later translate into graduates entering the EU security workforce.

Figure 12: Students that graduated (left) and new students enrolled (right) in 2020 by gender

Graduates by Gender New Students Enrolled by Gender

On the issue of gender diversity and the number of graduates at the country level, we can observe in Figure 13 that there are only six countries with a rate of 20% or more of female graduates (out of the total number of graduates) within their cybersecurity programmes, namely Romania (50%), Latvia (47%), Bulgaria (42%), Lithuania (31%), France (20%) and Sweden (20%).

Regarding enrolment’s numbers, Romania (48%), Latvia (42%), Estonia (30%), Hungary (27%), Spain (24%), Finland (23%), Denmark (22%), Cyprus (22%), Greece (21%) and Germany (20%) report the highest number of female enrolments . This enrolment rate is above the 20% average across the entire CyberHEAD database. Unfortunately, these statistics mean that, overall, most HEI programmes in Europe have particularly low levels of gender diversity. The nature of enrolment thus suggests that this issue could persist in the future EU workforce as well and it can directly impact the workforces in the States identified .

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Figure 13: Female students graduated (top) and new female students enrolled (bottom) in 2020 per country

Female Students Graduated in 2020 - Percentage per Country

New Female Students Enrolled in 2020 - Percentage per Country

Going beyond these descriptive figures there is also a critical question as to whether the gender balance in countries has improved or worsened. This can be examined to some extent by reviewing the number of graduates in 2020 (viewed as a representation of the past) and the enrolments in that year (a representation of the present situation, which also influences future graduates), by combining the data used in Figure 13.

A total of twelve countries reported increases in female students on programmes when comparing those graduating and those recently enrolled: Estonia (10% to 30%), Switzerland (0% to 24%), Poland (0% to 15%), Cyprus (13% to 22%), Spain (18% to 24%), Finland (17% to 23%), Germany (14% to 20%), Greece (17% to 21%), Italy (15% to 19%), Austria (12% to 14%), Ireland (9% to 10%) and Belgium (11% to 12%). This is a positive and encouraging finding.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Nine countries, however, reported decreases in the percentage of females on average enrolled across programmes: Bulgaria (42% to 18%), Lithuania (31% to 19%), Latvia (47% to 42%), Portugal (13% to 9%), Romania (50% to 48%), Luxembourg (14% to 13%), France (20% to 19%), Netherlands (16% to 15%) and Sweden (20% to 19%). While these numbers are prone to fluctuations from year-to-year, these countries and their HEIs should pay closer attention to gender balance and act to actively reduce the gender gap.

At a more general level, it is also pertinent to reflect on how cybersecurity programmes, student enrolments and the number of students graduating compare between countries. Although CyberHEAD may not be, at this point in time, completely representative of EU cybersecurity programmes, it is the largest database established thus far and therefore can still provide some valuable insights.

The top six countries with the highest number of cybersecurity programmes by population are Cyprus, Latvia, Luxembourg, Lithuania, Austria and Finland respectively (Figure 14). As these programme totals offer only a very high-level view, it is also prudent to assess the breakdown by student enrolments and graduates.

Figure 14: Number of programmes by country per capita (based on 1-1-2021 Eurostat)

For enrolments by population, Cyprus again scores highly followed by Finland, Austria, Lithuania and Estonia (Figure 15). Also, in examining graduates, there is a similar trend with Cyprus, Finland, Estonia, Austria and Luxembourg leading. These rankings are undoubtedly impacted by the smaller sizes of the populations of these countries as compared to larger

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

states. For instance, Cyprus has only 3 programmes, 128 students enrolled and 53 graduates, yet it scores the highest – albeit its population being 896,005. Although the size of the country affects the above figures, it is still encouraging to see the emphasis placed by HEIs in these countries on developing their cybersecurity HEI programmes. Figure 15: New students enrolled and graduates by population (in Million) New Students Enrolled by Population

Graduates by Population

This concludes our analysis into the supply of cybersecurity qualifications and skills in the EU, based on ENISA’s Cybersecurity Higher Education Database (CyberHEAD).

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

3. INITIATIVES TO ADDRESS THE CYBERSECURITY SKILLS SHORTAGE AND GAP IN THE EU

3.1 INTRODUCTION

In the context of the cybersecurity skills shortage and gap, actions around Europe have been taken not only to increase the cybersecurity workforce but also to increase the quality of candidates and equip them with the skills most requested by the industry.

Since 2010, the European Commission‘s Digital Agenda for Europe has highlighted the challenge concerning the ‘lack of digital literacy and skills’ and that their enhancement would promote employment in the overall ICT field (including security). Additionally, it has been noted that the ‘ICT skills shortage’ needs to be addressed through coordination and a joint approach by the EU Member States (MS). Similar goals were also included in the renewed Digital Education Action Plan (2021-2027) . Furthermore, to tackle the growing gap between capacities and market needs caused by the fast evolution of technology, initiatives such as the European Digital Skills and Jobs Platform – offering information and resources on digital skills – were launched.

At the policy level, the NIS Directive , published in July 2016, requires EU MSs to adopt a national strategy for the security of network and information systems, also referred to as a National Cyber Security Strategy (NCSS). By 2021, most of the EU MSs have included in their NCSS at least one objective that aims to address the cybersecurity skills shortage.

The following section examines several policy initiatives that address the cybersecurity skills shortage and gap in Europe. The data used was collected via a questionnaire which was sent to representatives of EU MSs at the end of March 2021. The information provided by the MSs was supplemented by publicly available information. In April 2021, 13 out of 27 EU MSs provided information on their cybersecurity workforce initiatives; these are included in full in Annex C. We have to note that this section does not seek to list all the initiatives working towards alleviating the problem. Instead, it explores a sample of such initiatives to gain an understanding of the state of such efforts across the EU.

The analysis below will follow ENISA’s National Capabilities Assessment Framework (NCAF) , more specifically the strategic objectives under ‘Cluster 2 - Capacity-building and awareness’. Within this cluster, we made use of three strategic objectives in order to classify the initiatives of Member States to mitigate the cybersecurity skills shortage and gap:

 Raise user awareness amongst the general public, as well as primary and secondary education – Identify gaps in cybersecurity knowledge and address them

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

by raising awareness or by developing or strengthening basic knowledge. Related initiatives should target the general public as well as primary and secondary school students and teachers.  Strengthen training and promote cybersecurity in higher education – Enhance the operational capabilities of the existing cybersecurity workforce, encourage university students to join the cybersecurity field and equip them with the appropriate knowledge bases, foster collaboration in cybersecurity between academia and industry and align cybersecurity training with business needs.  Organise cybersecurity exercises and challenges – Identify the skills that need to be assessed, set up a national cyber exercise planning team, integrate cyber exercises within the lifecycle of the national cybersecurity strategy or the national cyber contingency plan. Deploy cyber-ranges that allow individuals to advance their skills in cybersecurity inside controlled environments. Identify young talent and promote cybersecurity by organising competitions.

Annex D lists an analysis of some of the initiatives conducted outside the EU.

3.2 RAISE USER AWARENESS AMONGST THE GENERAL PUBLIC AND IN PRIMARY AND SECONDARY EDUCATION

Most of the initiatives to fill gaps in cybersecurity knowledge have involved awareness-raising events and the inclusion of digital skills (including information security) in primary and secondary education. These initiatives have aimed to not only to improve cyber capabilities in the younger generation but also to promote cybersecurity and motivate students to study cybersecurity and to seek a career in this sector. In many cases, cybersecurity skills and competencies have been introduced as part of broader digital literacy programmes. Below we present the most relevant initiatives.

CZECH REPUBLIC

The NCSS (2021-2025) of the Czech Republic dedicates an entire section to cybersecurity ‘Education and Awareness’, stressing the need to develop cybersecurity skills and educate the population (especially high-risk groups). Cybersecurity education starts in pre-school and aims to teach the safe use of digital technologies.

To this end, the Czech Republic’s National Cyber and Information Security Agency (NÚKIB) seeks to ensure that building relevant cybersecurity skills is a goal at the primary and secondary school levels. The revision of the educational plan is currently underway and NÚKIB is aiming to ensure that relevant cybersecurity skills are implemented at these levels of education.

The Czech NCSS also includes goals related to ’Expanding the Qualified Base’ of cybersecurity and the need to create and maintain a qualified cybersecurity workforce. There are two ways it seeks to achieve this: firstly, by promoting awareness-raising programmes and creating the appropriate working conditions that encourage talented people to study and pursue a career in cybersecurity; secondly, by improving the ability of organisations to hire and retain cybersecurity professionals using inducements such as the provision of opportunities for career growth, attractive salaries and healthy work cultures and environments.

Furthermore, NÚKIB offers internships to university students in various cybersecurity areas, while it also organises an annual conference called CyberCon , which is open to the public and focuses on students and education. Moreover, NÚKIB also hosts various public panel

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

discussions and workshops centred around the topics of cybersecurity (often targeting children, the elderly, parents, and/or teachers), which include cybersecurity courses for the public .

DENMARK

The Danish National Cyber and Information Security Strategy (2018) has launched two cybersecurity awareness programmes under the ‘Better competencies initiatives’: 1) an initiative called the ‘Digital judgment and digital competencies acquired via the educational system’ which focuses on raising awareness of security challenges and developing cybersecurity teaching resources targeting young children, students and teachers; and 2) an initiative called ‘Improved awareness drives aimed at citizens and businesses’ which targets specific groups of citizens and businesses to address their cybersecurity challenges.

Moreover, the Danish government has organised awareness campaigns and disseminated educational materials via the ‘sikkerdigital.dk’ information portal, hosted by the Danish Agency for Digitisation (an agency of the Ministry of Finance) and the Danish Business Authority. Through this portal, citizens, companies and authorities can access cybersecurity related knowledge, guidance and tools, which can be used to improve online security. The main purpose of the portal is to strengthen competencies in the field of cybersecurity in both the public and private sectors, to raise awareness of cyberthreats and to continuously improve knowledge on how they can be safely mitigated.

Moreover, the Danish government has developed and supported a number of cybersecurity educational programmes and academic curricula to be taught at the primary and secondary 62,63 education levels. Additionally, Denmark’s digital learning portal (EMU) was established in order to provide educational material on digital education, cybersecurity and more broadly in ICT. It is currently being evaluated in Danish primary schools. Furthermore, the Ministry of Children and Education has also developed a large quantity of educational material the focuses on helping educators teach data protection and information security.

GREECE

Greece, in its latest NCSS (2020-2025) , puts special emphasis on capacity building, in particular the development of cybersecurity skills. On raising awareness, the strategy foresees the creation of an Education and Awareness Action Plan. Moreover, the strategy highlights the special emphasis that will be given to the creation of appropriate incentives for the younger generation in order to acquainted them with cybersecurity and induce them to consider it as a subject of study or specialisation.

IRELAND ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

secondary education. Furthermore, the strategy also aims to support initiatives which encourage women to join the cybersecurity field, such as the ‘Cyber Women Ireland’ initiative.

LATVIA

The latest Latvian NCSS (2019-2022) had an area dedicated to ‘public awareness, education and research’, among other topics. In particular, the strategy’s action plan includes the following initiatives in awareness:

 raising awareness about information security among students and teachers,  improving public awareness of online safety, and  developing and implementing annual multi-agency action and campaign plans with cybersecurity information events and awareness raising campaigns.

LITHUANIA

Lithuania’s NCSS (2018) acknowledges the cybersecurity skills shortage problem, stating that the needs of the Lithuanian labour market are currently not being met by the supply of those skills. Nevertheless, the strategy observes that cybersecurity courses are available for civil servants in order to improve their cybersecurity skills and, based on statistics related to the number of participants, attendance by civil servants is growing each year. The strategy also states that in order to improve the country’s cybersecurity culture, fundamental cybersecurity knowledge should be provided at all educational levels.

MALTA

One of the goals of the Maltese NCSS (2016) is to establish a specialist cybersecurity educational curriculum and to integrate the digital education of its citizens into primary schools.

THE NETHERLANDS

One of the actions taken by the Dutch National Cybersecurity Agenda (NCSA) on the issue of cybersecurity knowledge and awareness was to include ‘Digital Literacy’ in the curriculum at the primary and secondary education levels. Moreover, the policy documents also encourage the business community and civil society organisations to advance further the digital skills of employees and citizens. Furthermore, Kennisnet , a public organisation which was funded by the Ministry of Education, Culture and Science, supports the use of ICT in schools, providing educational content, strategic advice and expertise in the broader field of ICT.

SLOVENIA

The Slovenian NCSS (2016) sets two awareness related measures to improve citizens’ safety in cyberspace. Firstly, it sets up the regular implementation of awareness-raising programmes on cybersecurity; secondly, it adds cybersecurity content to education and training programmes.

SPAIN

Through Digital Spain 2025 ‘Line 3 - Digital Skills’, Spain promotes of basic digital skills to the public in order to increase confidence in conducting online activities responsibly. The plan aims to equip both students and workers with the advanced digital skills required in the workplace and for everyday use, to promote digital careers and reduce the gender gap in digital skills.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Another measure concerns the identification and development of cybersecurity talent in order to address the overall shortage of skills.

Furthermore, the National Plan for Digital Skills of Spain (2021) provides 3.75 billion euro to promote public reforms and investments in fields such as digital inclusion (including reducing the digital gap between men and women), the digitalisation of education and the acquisition of digital skills by both unemployed and employed workers.

3.3 STRENGTHEN TRAINING AND PROMOTE CYBERSECURITY IN HIGHER EDUCATION

Initiatives that aim to build up cybersecurity training and higher educational programmes are of great importance when it comes to mitigating the cybersecurity skills shortage and gap as they improve the operational capabilities of the existing cybersecurity workforce, encourage students to pursue cybersecurity topics and promote and foster relations between academia and the industry, as well as aligning cybersecurity training with the actual needs of industry. In what follows, we present some key initiatives.

CZECH REPUBLIC

The Czech Republic’s Action Plan is a policy document that traditionally complements the NCSS. It was approved by the government in July 2021 and the following three focus areas in relation to cybersecurity skills are listed:

1. Quality education system, 2. Outreach and education, and 3. Vocational education and expanding the qualified base.

The above three areas specify 23 tasks that are expected to have a positive impact on the development of cybersecurity skills. These tasks deal with the definition and implementation of standards in cybersecurity skills into general and vocational education, training, conferences, workshops and other activities. NÚKIB is responsible for most of these tasks and cooperates with several other entities (e.g. the Ministry of Education, Youth and Sports) to fulfil them.

DENMARK

In Denmark, in order to have sufficiently skilled personnel to detect and handle cyber-attacks, the Centre for Cybersecurity (CFCS) has created its own Cyber Academy.

With regards to higher education, a number of HEIs have organised two-day seminars in cybersecurity supported by CFCS. The lectures and practical exercises included topics such as

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

threat analysis, avoidance and mitigation (both at the technical and business level), as well as data security management (authentication, confidentiality, integrity, privacy, etc.). Moreover, summer schools have been launched focusing on cybersecurity and building cyber skills.

In August 2019, several HEIs conducted a Summer School in Cybersecurity supported by CFCS . The Summer School included classes on basic security and network principles, software development and practices in IT operations (DevOps) and security, data carving in forensics, and network security exercises. The Summer school was repeated in 2020 .

GERMANY

In Germany, course offerings, in particular in computer science and IT security, will be expanded by establishing additional university professorships and by supporting leading institutions. Additionally, cooperation with private industry will be supported through, for example, funds channelled by foundations and externally funded teaching and research posts.

HUNGARY

In Hungary, the development of cybersecurity skills is an integral part of the new Cybersecurity Strategy that was adopted in 2018 . It is now mandatory for Chief Information Security Officers (CISOs) in the public service to attend two semesters of postgraduate cybersecurity training at the National University of Public Service . Moreover, a 10-week cybersecurity internship is mandatory for those enrolled in master programmes at the National University of Public Service .

In Hungary, one can also find WITSEC (Women in IT Security), the association of women working in the field of IT security, which was founded in 2014 and whose main aim is to provide mentorship, development of IT skills and security skills among youngsters, especially girls .

IRELAND

Ireland continues its efforts to address the skills gap in cybersecurity by implementing the 85. measures mentioned in its latest NCSS (2019-2024) The strategy recognises the need not only to train new personnel but also to upskill professionals in ICT and other related sectors. The strategy also notes that, in spite of last year’s efforts in addressing the cybersecurity skills shortage and gap, there exists a time lag between academia and industry. Thus, there is an urgent need to create a pipeline of graduate students with the appropriate cybersecurity skills. Additionally, another measure is to provide support to initiatives under the Technology Skills 2022 Initiative, including the development of Skillnet and ICT apprenticeship programmes.

The Skillnet agency is a supporting agency working in the area of workforce development with the aim of increasing the competitiveness, productivity and innovation of Irish businesses. To improve skills in the ICT sector, cybersecurity skills are also taken into account through the organisation of training programmes. Furthermore, the Cyber Skills project, which received an 8.1 million euro investment, is aiming to provide pathways and micro-credentials in order to tackle the cybersecurity skills shortage.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION LATVIA

The latest Latvian NCSS (2019-2022) has ‘public awareness, education and research’ among its main focuses. In particular, the strategy’s plan includes tasks such as:

 Delivering advanced cybersecurity training for specific target groups, and  Upskilling digital competencies in the public sector and among government employees as well as promoting good ICT safety practices.

Furthermore, a legal framework in the area of cybersecurity has been established, the ‘Law on the Security of Information Technologies’ , which has important implications for cybersecurity education also. In fact, the Cabinet Regulation No.442 on ‘Procedures for the Ensuring Conformity of Information and Communication Technologies Systems to Minimum Security Requirements’ (adopted July 28, 2015) serves as a guideline for educational institutions when creating and adopting educational curricula .

LITHUANIA

Lithuania’s NCSS (2018) identifies the need to study its own shortage problem in cybersecurity skills firstly at national level. Furthermore, the strategy sets as an objective the development of creativity, advanced capabilities and cybersecurity skills at a level of competence that is capable of meeting market needs. Based on the strategy, this objective could be achieved by improving cybersecurity competencies, developing training systems that are oriented towards market needs that provide accreditation and certification, and are suitable training environments.

MALTA

In Malta, the ‘B SECURE’ scheme , which was launched at the Malta Cybersecurity Summit in 2019, offers training courses for both executives and industry professionals. Moreover, CSIRT Malta offers cybersecurity training to its constituents.

THE NETHERLANDS

In the Netherlands, the National Cybersecurity Agenda (NCSA) recognises that the next important step towards addressing the skills shortage problem is an analysis identifying gaps between higher education curricula (the supply) and industry requirements (the demand) in the creation of well-trained personnel.

SPAIN

The 2019 Spanish NCSS has the goal of promoting a ‘culture and commitment to cybersecurity and empowerment of human and technological capabilities’. This goal points out the need to acquire technical and human resources and adopt training in the appropriate skills to use cyberspace more securely. To achieve this goal, it encourages the strengthening of the cybersecurity industry and its ability to generate and retain talent. In particular, measures 5 to 8 of the strategy are associated with the identification of the skills needed by industry, the promotion of training and the retention of cybersecurity talent.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Besides university degrees in the field of cybersecurity, Spain also has vocational training programmes. These have three levels (basic, intermediate and advanced), with the advanced level being recognised as preparing students to the same level as a university master’s degree.

As a first step in the development of such specialised cybersecurity courses, two basic 94,95 courses will be delivered for the first time in the 2021-22 academic year. The Spanish National Cybersecurity Institute (INCIBE) was involved in the Working Group that developed the syllabus for these courses and is collaborating with the Spanish Ministry of Education and Vocational Training to train the professionals who will teach these courses in partnership with the School of Industrial Organisation (EOI).

Moreover, INCIBE is working on the establishment of training paths with the intention to cover the competencies needed for the cybersecurity profiles that are most in demand in the country.

3.4 ORGANISE CYBERSECURITY EXERCISES AND CHALLENGES

Other important initiatives are those that aim to test the skills of cybersecurity professionals and the readiness of cybersecurity teams. Cybersecurity exercises are an increasingly popular activity for assessing the efficiency, preparedness and ability of security teams and systems in solving a security crisis. On the other hand, cybersecurity challenges complement exercises by focusing on attracting the interest of young talent in ‘Capture-the-flag’ or other attack/defence types of cybersecurity games.

At the EU level, ENISA is in charge of coordinating a pan-European series of exercises called Cyber Europe . This programme consists of EU-level cyber incident and crisis management exercises for both the public and private sectors from the EU and EFTA Member States. The exercises, which have been organised every two years since 2010, are simulations of largescale cybersecurity incidents that can escalate into cyber crises. In addition, the Cyber Exercise Platform (CEP) managed by ENISA supports the management of complex exercises such as virtual exercise ‘playgrounds’ with high-end technical challenges by bringing together experts of the incident development community. In addition, ENISA offers training and research related to cybersecurity exercises in the form of guidelines on exercise planning , a global survey of 99 100 exercises and incidents research , and has also contributed to the French National Cybersecurity Agency for the Security of Information Systems (ANSSI) guide on cyber exercises .

The EU also engages and supports cybersecurity exercises outside the EU. For instance, in May 2021, EU CyberNet participated in the first national cyber exercise of the Dominican Republic ‘Cyber llamas . In the same month, a cybersecurity simulation exercise took place in Kyiv (Ukraine) with state cybersecurity officials, organised by the EU4DigitalUA project.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

One of the most popular and well-received cybersecurity challenges for youth is the European Cybersecurity Challenge (ECSC). The ECSC initiative has sparked a number of national initiatives worldwide that focus on identifying young cybersecurity talent and training them to attend national cybersecurity skills challenges supported by national agencies. The popularity of the ECSC has grown exponentially in recent years. The first edition of the ECSC took place in Austria in 2014, where 30 participants from only three national teams attended. In the latest iteration in 2021 hosted in Prague, 19 national teams and 169 contestants participated in a two-day long skills challenge featuring tasks from various cybersecurity knowledge areas.

CYPRUS

In its latest NCSS (2020) , Cyprus acknowledges the benefits of cyber crisis simulation exercises. These can improve national capabilities in the field by testing the communication systems for crisis management and enhancing the efficacy of incident handling. For this reason, the strategy includes the planning and organisation of regular national cybersecurity exercises based on realistic scenarios as well as active participation in Pan-European and other international exercises.

CZECH REPUBLIC

In the Czech Republic, the NCSS sets, as an objective, the sharing of knowledge and expertise which is acquired by the NÚKIB in cybersecurity exercises, training and other activities. As a result, NÚKIB regularly organises technical and non-technical cybersecurity exercises for various partners with the aim of strengthening their cybersecurity skills and resilience. In addition, the agency supports cybersecurity competitions, such as the European Cybersecurity Challenge (ECSC). To track such initiatives (such as cybersecurity courses, exercises, etc.) the number of participating users is monitored.

IRELAND

In Ireland, the Discover Programme of Science Foundation Ireland (SFI) is funding the ‘Cyber Academy’ project , a summer bootcamp initiative for young people from 15-18 years old. The initiative includes exploration of general and technical cybersecurity topics, career talks with cybersecurity professionals and the National Cyber Schools Challenge (NCSC).

SPAIN

In Spain, since 2014 INCIBE has been organising CyberCamp , an event which mainly aims to identify career paths for students and to broaden technical knowledge, as well as to awaken and promote talent in cybersecurity through technical competitions. Two competitions are organised during the camp, one for individuals and the other team-based (CyberOlympics ). The competition for individuals also has the purpose of selecting the Spanish team attending ENISA’s annual ECSC. The team competition is aimed at secondary school and vocational training students, and it is the first step before moving on to the competition for individuals. Thus far, the design of the tests and challenges of these competitions have not been based on any specific criteria or definition of competencies. However, the intention is to adapt them to the competencies and profiles needed by the Spanish cybersecurity industry.

There are additional Spanish competitions developed by different organisations and entities that seek to boost the interest of the younger generation in dedicating themselves professionally to

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

cybersecurity. Some of these competitions were established nationally over the last year by public bodies, such as:

 National League of challenges in Cyberspace organised by the Spanish Civil Guard, and  CyberWallChallenge organised by the Spanish National Police as part of its CyberWallAcademy training action.

GREECE

The latest Greek NCSS (2020-2025) focuses on capacity building, including organising national cybersecurity exercises in cooperation with national and European agencies. In this regard, a series of flagship activities to develop preparedness and the operational skills of participating organisations have been implemented in the form of responses to simulated cybersecurity incidents (supervised by the National Cybersecurity Authority), made possible by the development and use of cyber range platforms. Greece has also been participating in the ECSC consistently since 2017.

SLOVENIA

In 2021, Slovenia participated in the ECSC for the first time in order to develop cybersecurity skills among its youth and to nudge students into acquiring such skills. The plan is to continue to regularly attend and participate in the ECSC in the future.

This concludes this section’s examination of the different approaches adopted by EU Member States to mitigate the cybersecurity workforce skills shortage and gap.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

4. SUMMARY AND RECOMMENDATIONS

This section provides recommendations and key insights based on the analyses presented in this report.

Section 2 began this research and reported on the status of cybersecurity programmes at higher educational institutions (HEIs) in the EU and EFTA countries. It focused on the supply of cybersecurity qualifications and skills by analysing the characteristics of the 126 programmes in ENISA’s CyberHEAD database. It also provided an assessment of the number of new students studying cybersecurity as well as the number of graduates both at the level of the EU and of individual Member States.

Section 3 examined the different approaches adopted by EU Member States to address the cybersecurity workforce skills shortage and gap by analysing initiatives regarding cybersecurity awareness, training, challenges and exercises.

In order to better understand the cybersecurity skills shortage and gap and plan a coherent strategy to mitigate these problems, our analysis recommends an approach based on five key features:

 Increasing enrolments and eventually graduates in cybersecurity programmes through: o the diversification of the HEIs curricula in terms of content, levels and language; o the provision of scholarships, especially for underrepresented groups, and more active efforts to promote cybersecurity as a diverse field.  Supporting a unified approach across government, industry and HEIs through: o the adoption of a common framework regarding cybersecurity roles, competencies, skills and knowledge such as, for example, the framework provided by the European Cybersecurity Skills Framework; o the promotion of cybersecurity skill-building challenges and competitions.  Increasing collaborations between Member States (MSs) in: o launching European cybersecurity initiatives with shared objectives; o sharing of the outputs of programmes (including results and lessons learnt).  Promoting analysis of the needs of the cybersecurity market and related trends through: o the identification of metrics showing the extent of the problem and possible measures to cope with it.  Supporting the use and promotion of CyberHEAD (and its further evolution) in order to: o facilitate an ongoing understanding of the status of cybersecurity higher education programmes in the EU; o monitor trends regarding the number of cybersecurity graduates who could potentially fill current vacancies in the sector; o support the analysis of demographics (including the diversity) of new cybersecurity students and graduates; o assist in monitoring the effectiveness of cybersecurity initiatives targeting the supply side (e.g. changes in enrolments in HEI programmes after the release of new cybersecurity initiatives); o demonstrate the value of CyberHEAD for HEIs as well as incentivise HEIs to submit their programmes to CyberHEAD.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

In the next sections, we detail and outline the context for these recommendations. Here we note that this report’s analysis and its recommendations focus on addressing the EU’s cybersecurity skills shortage and gap through the higher education sector, and therefore vocational or lower forms of education are not considered.

4.1 INCREASE ENROLMENT IN CYBERSECURITY PROGRAMMES

A wider selection and greater diversity of cybersecurity programmes in HEIs should be provided to increase enrolments and eventually graduates who may than enter the cybersecurity INCREASED workforce. The lack of qualified cybersecurity professionals can only be addressed through an

ENROLMENTS

increase in the pipeline of individuals with the appropriate skills to tackle emerging cybersecurity A wider selection and threats. Therefore, the report recommends further analysis of the following: greater diversity of cybersecurity

The range of skills required needs to be reflected in the curricula in terms of content and

programmes in HEIs levels. For instance, in the CyberHEAD database it was found that there were surprisingly few should be available non-technical topics covered especially at the master and postgraduate levels. While technical to increase skills are clearly in high demand, knowledge and skills in social science (e.g. from enrolments and Organisational, Risk management, Business and Compliance disciplines, to Law, Ethics, Policy, eventually graduates Privacy and Cybercrime disciplines) are increasingly important. These skills and other soft skills who may then enter (e.g. management, communication, etc.) are considered particularly crucial in the industry. the cybersecurity workforce. An increase in the topics covered by programmes would allow students to be able to choose from courses that specialise in programmes which combine a technical curriculum with some organisational and policy aspects, or a non-technical (e.g. business-oriented programme) curriculum with fewer technical aspects. In both cases this could still help to address key gaps in industry. As the topic diversity of programmes is expanded, this should also be represented in the prerequisites to entry. That is, if a programme is concentrating on more technical topics, it should require some level of a technical background (e.g. a bachelor’s degree in engineering or computing or a professional certification), but if it is concentrating on Law, Ethics, Policy, Privacy and Cybercrime disciplines, the requirements should be relaxed and replaced with more suitable criteria.

The levels at which programmes are available can play a primary role in increasing enrolment and subsequently graduates. Currently, bachelor programmes are only minimally represented in the CyberHEAD dataset. While the dataset may not be entirely representative, it is widely known that bachelors in cybersecurity are rarer than master programmes. Nonetheless, increasing the number and variety of bachelors by including a noteworthy cybersecurity component would be advantageous for multiple reasons.

Firstly, such programmes have much larger cohorts (the maximum yearly cohort size for bachelor programmes in CyberHEAD is 117 on average while it is only 55 for master programmes) and could therefore contribute significantly to increasing the talent pool. Secondly, 114,115,116,117,118 considering that cybersecurity is becoming a more established profession , students may wish to have an opportunity to select a cybersecurity-focused initial degree instead of waiting to specialise at the graduate level.

The accessibility and openness of programmes should also be considered, with a focus

on language and delivery methods (i.e. online, classroom or blended). As found in this report, online programmes are less available than on-site courses. Increasing the availability of

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

online degrees or blended education can reduce barriers to those who are unable or cannot afford to move home or travel. Launching more blended and online degree options may also result in a rise in enrolment. Additionally, though language is contentious as there is no one shared language in the EU, if courses were offered in multiple languages (or a few widely spoken languages), student uptake could increase at both bachelor’s and master’s degree levels.

More scholarships should be made available and more active efforts focused on diversity in

order to increase enrolments and the graduate pool of cybersecurity students, since, based on CyberHEAD’s data, 71% of programmes charge students tuition fees. In particular, scholarships for underrepresented groups (such as women, ethnic and other minorities) might be beneficial and could potentially help recruitment. These would have to be advertised and targeted properly as research has found that such groups (especially women) are often not aware of opportunities in the cybersecurity field . To add to this, women and minority groups from cyber roles (or those that are recent cyber graduates) should be spotlighted to highlight this career or study pathway as an opportunity for prospective students from underrepresented groups. Each of these actions might assist in increasing enrolments, which could later result in graduates entering the EU security workforce. Funding for these activities and for scholarships is an area where government and industry can assist to ensure that university fees are not a significant inhibitor to the development of national and regional cybersecurity workforces.

4.2 SUPPORT A UNIFIED APPROACH ACROSS GOVERNMENT, INDUSTRY AND UNIVERSITIES

The skills shortage and gap can only be addressed through a joint effort among key

A more concerted

stakeholders. Thus, a more concerted effort between government, industry and HEIs is needed

effort between

to produce more cybersecurity graduates, particularly those with skills that can meet market requirements. To this end, this report makes the following recommendations: governments,

industry and HEIs

Support the development and adoption of a common language regarding cybersecurity is needed to roles, competencies, skills and knowledge, for example the one provided by the

produce more

European Cybersecurity Skills Framework (ECSF). In this context, ENISA launched an Ad

appropriately

Hoc Working Group on the European Cybersecurity Skills Framework in December 2020. A multi-disciplinary group of experts was brought together with the aim of promoting skilled harmonisation of cybersecurity education, training, and workforce development concepts and cybersecurity tools. In July 2021, the Ad Hoc Working Group completed the first draft of the European

graduates.

Cybersecurity Skills Framework (ECSF), producing a user manual which will be released imminently with the goal of making the implementation of the framework easier. The user manual will use several examples to explain how the framework can be implemented in different European organisations. The ECSF, if successful in achieving its objective, will be an invaluable instrument for supporting the design of cybersecurity related training programmes in the area of skills and career development; as well as supporting employment in cybersecurity .

Support Cybersecurity Challenges. ENISA organises the European Cyber Security Competition (ECSC) which – along with the national cybersecurity skill-building competitions across Europe – provides excellent training and exposure for younger individuals interested in the sector. Cybersecurity companies and public organisations also use these skill challenges to identify, attract and recruit cybersecurity talent. Moreover, they are likely to increase interest in a cybersecurity career and be effective in creating a network of young cybersecurity specialists .

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Academic institutions should encourage their students to participate – even if they are not enrolled in traditional STEM curricula. Companies and organisations could suggest cybersecurity challenges that are aligned with real-world events as well as create partnerships with academia to, for example, facilitate internships or provide feedback for the curricula.

4.3 UNDERSTAND JOB MARKET NEEDS AND TRENDS

The EU and its Member States (MSs) should aim to develop and maintain a good understanding of the needs of the cybersecurity market and related trends in order to tackle the MARKET skills problem effectively. For this reason, this report recommends:

NEEDS AND TRENDS

Conduct research and monitoring activities in the EU and in Member States to

The EU and Member

continuously assess what cybersecurity skills the market needs and what cybersecurity

States should have a jobs it can offer. This insight should then be used to allow appropriate actions to be taken to good understanding prepare the future workforce. of the needs of the cybersecurity market Metrics that highlight the actual problem may include but are not limited to: and related trends in order to tackle the  the number of unfilled cybersecurity vacancies, problem efficiently.  the average time to fill cybersecurity vacancies,  which skills, and in what percentage, are mostly needed in certain positions,  the number of cybersecurity professionals that do not possess the requisite skills or possess these skills only partially,  the average training time to acquire new skills,  an estimation of the cybersecurity workforce size,  the percentage of unqualified candidates.

MSs could monitor such metrics not only for maintaining awareness of their national labour markets but also as a way of assessing progress towards the implementation of their NCSSs.

4.4 COLLABORATIONS BETWEEN EUROPEAN MEMBER STATES

A number of EU initiatives have attempted to tackle the cybersecurity skills shortage and gap.

Develop synergies

Similarly, Member States (MS) have also launched their own actions and included them as

among Member

objectives in their NCSSs. Even when focused on the skills problem at the level of the MSs, the nature of the EU means that national programmes are likely to have an influence beyond their States’ geographic boundaries and extend their benefits to other MSs, helping to tackle the matter at cybersecurity the EU level. In a similar vein, synergies among MSs and EU institutions, which might be

initiatives with the

facilitated through EU common funding, should be strengthened. For this reason, this report

support of

recommends:

European bodies

Facilitating new joint initiatives to address the cybersecurity skills shortage and gap. and EU funded

Since many MSs share similar issues when it comes to the shortage of cybersecurity skills, projects. launching common initiatives could prove an advantageous solution to pull resources together. These collaborations may involve:

 developing cybersecurity related material grounded in practice and research,  releasing joint campaigns in raising awareness,  expanding on previously launched initiatives to include other MSs.

Exchanging outputs of initiatives with other MSs with the support of European bodies. By sharing the results of initiatives with other Member States in terms of metrics (e.g. participation, people reached), in deliverables (e.g. curricula, e-learnings) and lessons learnt (e.g. activities that worked or failed), the EU can work more efficiently towards closing the gap. Furthermore, this will promote the re-use of already developed material (either sourced from MSs or EU institutions), eventually saving resources.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION 4.5 CYBERHEAD’S VALUE FOR STUDENTS, HIGHER EDUCATION INSTITUTIONS AND MEMBER STATES

The supply of cybersecurity skills should also be regularly analysed in order to

The value and use

understand how cybersecurity-related programmes and training responds to market

of CyberHEAD for

needs. This would also allow better planning towards what other initiatives should be put in place to alleviate the scarcity of graduates. CyberHEAD provides some of the most important students, HEIs metrics in order to understand the development of skills in MSs. and Member

States should be

CyberHEAD provides a unique database of cybersecurity courses in the EU and EFTA

further

countries. Prospective students interested in studying cybersecurity can use the

emphasised and

database to quickly search for programmes according to a variety of requirements. For

promoted across

instance, they can search by location, programme type (master, bachelor, etc.), programme language, delivery method (online, classroom or blended) and fees. Two particularly important the EU. data points available to students in CyberHEAD are whether programmes offer internships and their core curriculum. Internships are crucial for gaining practical experience, while knowing the ECTS (European Credit Transfer System) credits allows students to find programmes suited to their interests and needs.

European HEIs can gain further exposure by including their degrees in CyberHEAD. Currently there are 126 programmes scattered around 25 European countries. While this is a good number given the young age of CyberHEAD, there is a strong need for more programmes, especially from countries that have low representation in CyberHEAD. To enable this, more should be done to incentivise EU HEIs to enter their programmes into the database. As one individual (e.g. a professor or an administrator within HEIs) may not be able to answer all questions, EU MSs should consider whether there are any resources or incentives that could be offered to support HEIs in the first rounds of data collection.

EU Member States can also directly benefit from CyberHEAD, for example when they can access relevant information to assess the status of their national cybersecurity programmes and can themselves conduct many of the analyses presented in this report

(e.g. on gender balance, predicted numbers of future graduates entering the workforce). These analyses can be performed over time to track changes in programme offerings and the extent to which national cybersecurity jobs are being filled. This may also allow countries to measure the impact of their national or local initiatives and may even be used to inform national policy.

This report therefore recommends that CyberHEAD’s benefits (exemplified above) should be further emphasised and promoted across the EU, and supported by MSs, who will also ultimately benefit from the database.

Additional data gathering in CyberHEAD should be investigated as it will allow a deeper insight into skills programmes in the EU as well as provide a platform through which the EU (and MSs) can compare and contrast data with other regions and countries. However, as mentioned above, additional data gathering could increase the workload for HEIs and for those validating them. A cost-benefit analysis taking into account the wider benefits of CyberHEAD to the EU should be conducted before including these extra questions to ensure they are not too time consuming. A list of additional data-gathering questions and the reasoning why they should be included is provided in Annex B.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

A ANNEX: CYBERHEAD QUESTIONS

A.1 ANNEX SUBSECTION

Annex A includes the questions that need to be answered by the European HEIs (academic institutions) that want to be listed in CyberHEAD. ENISA validates each submission to ensure that the programme submitted falls within the scope of the database as described in Section 2.1. Any programme that features enough courses in cybersecurity – as indicated in the study plan – may be eligible for listing in the database. In order to confirm that the programme meets the requirements for the database, an instance of the study plan might be requested.

A.2 LIST OF QUESTIONS TO BE ANSWERED BY THE HEIS

1. Institution name (Please insert the name of your university) 2. Programme name (Please insert the name of your programme) 3. Type of programme 4. Delivery

5. Language

6. Country

7. URL (Please provide the URL corresponding to the programme’s webpage)

8. Does the programme provide (even through optional courses) specialisation in a specific area of cybersecurity? (40% of the courses should be dedicated to this specific area of cybersecurity)

9. Is the programme accredited/certified by a national cybersecurity authority following a formal accreditation/certification process? (Please state whether the programme is accredited/certified by a national cybersecurity authority following a formal accreditation/certification process. Example: see for example France ANSSI’s accredited programs.)

10. Does the programme prepare students to undertake any professional certification? If so, what certification?

11. When was the programme established?

12. How many new students have enrolled in the programme in 2020?

13. How many new female students have enrolled in the programme in 2020?

14. How many students graduated in 2020?

15. How many female students graduated in 2020?

16. What is the maximum number of students that can be accepted in this programme?

17. Fee for EU Citizens

18. Number of ECTS

19. How many ECTS are related to security computing/engineering disciplines (System security, Network Security, Component Security, Data Security, Software Security)?

20. How many ECTS are related to Law, Ethics, Policy, Privacy, Cybercrime disciplines?

21. How many ECTS are related to Organisational, Risk management, Business, Compliance disciplines?

22. Does the programme foresee a compulsory internship? (Please also select how many ECTS are reserved for the internship?)

23. Are there modules/lectures/units in the programme that are taught by professionals/specialists that are currently employed within the industry?

24. Further Information (please provide any further information that you wish to be visible in the database regarding your degree.)

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

B ANNEX: EXPANDING THE CYBERHEAD QUESTION SET

This annex reports on an investigation that was conducted to identify questions that may be considered for addition to the CyberHEAD question set. Such questions would be targeted at allowing CyberHEAD to better achieve its goals (see Section 2). More specifically, a larger number of questions also has the benefit of supplying more useful information for students when they are choosing a programme as well as supplying the EU with a more structured and comparable information across Europe on the academic programmes.

Firstly, an analysis on the information currently published and shared by HEI degree programmes across Europe was conducted. This approach is based on the argument that degree programmes – particularly programme websites – have been developed over many years specifically to accommodate the information students desire when researching degrees. By comparing and contrasting information provided on a large number of programme websites, it would therefore be possible to identify a series of key information items which may be recommended for inclusion in the CyberHEAD database questionnaire posed to HEIs.

Following the approach outlined above, a total of 100 European degree programme websites were gathered and assessed. These were gathered from countries that include the UK, Italy, France, Spain, the Netherlands, Belgium, Hungary, Finland, Switzerland, Sweden, Lithuania and the Czech Republic . The UK featured most prominently in the sample, with 72 degrees. This high representation was intentional and sought to acknowledge the advanced state of cybersecurity degree courses in the UK, as well as the reality that the UK is often seen as a 124,125 primary destination for international students to pursue higher education . EU programmes were gathered from the CyberHEAD database and online searches, while UK programmes were all gathered using online searches.

From an analysis of the degree programmes, a set of information commonly included was identified. Attention was also paid to information that may assist in achieving another aim of the CyberHEAD database, i.e. data that could allow for monitoring of the cyber skills shortage and gap in the EU. This information, in question form, is presented below. Questions that are already present in the CyberHEAD database are excluded. Furthermore, questions are presented in three tiers according to their perceived usefulness based on the opinions of the report’s authors. These questions provide input to recommendations (which are mentioned in Section 4).

Tier 1 – High priority

1. Is the programme full-time, part-time, or both? 2. Are there scholarships or financial support options available? 3. What types of jobs will the programme allow students to attain afterwards?

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

4. Does the programme partner with any security industry organisations, consortiums or academies? 5. To what extent are organisations or individuals from the security industry involved in programme development? 6. What is the breakdown of the programme teaching format, in terms of lectures, seminars/tutorials and practical exercises?

Tier 2 – Medium priority

1. Does the programme have dedicated cybersecurity facilities and labs? 2. Does the programme have any industry certifications built into it? 3. To what extent is cybersecurity-specific employability support available to students? 4. Is the programme accredited by a professional computing/IT/engineering body or association?

Tier 3 – Low priority

1. What is the length of the programme? 2. What are the entry requirements of the programme? 3. What is the deadline for applications to the programme? 4. Are there any additional programme costs to students in addition to tuition fees? 5. What percentage of students find employment within 6 months of the programme completing?

The second purpose of the CyberHEAD database is to allow cybersecurity skills across the EU to be investigated, and in particular the supply-side of skills programmes. This can be divided into two areas: the skills being provided in current programmes, and the types of individuals being trained by the programmes. To identify a suitable set of additional information that may be gathered from an updated database, examining existing research (such as international and 126,127 governmental reports ) into the gaps in cybersecurity skills is crucial. Such an analysis would provide insights into the types of topics under deliberation across the world, and the areas where gaps in skills and training are most prevalent. This information can provide input to metrics for the state of the offerings of courses on security skills in Europe.

Based on the approach taken, a selection of areas of importance was defined. Focusing first on the security skills provided in current programmes: there are numerous types of information that may be recommended for addition to the CyberHEAD database which would be key to understanding the state of the security programmes of European HEIs. These are phrased below, as questions, similar to the format earlier in this report. A reference is added to questions to identify where the notion originated.

Tier 1 – High priority

1. To what extent are non-technical (or ‘soft’) skills such as communication, leadership and management, a part of the skills taught or practiced in the programme?

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Tier 2 – Medium priority

1. What is the length of workplace placements in degree courses? 130,131 2. What are the primary topics covered in the programme? 3. How regularly is the programme syllabus refreshed? 4. How much of the programme includes practical learning or hands-on learning and training? 5. To what extent does industry consult on programme content, give guest lectures, participate in showcases, etc.? 6. To what extent do students practice applying and implementing technical skills in a business context?

Tier 3 – Low priority

1. Does the programme or do students on the programme participate in capture-the-flag competitions?

The second area concentrates on the types of individuals being trained in programmes. This is important to consider, given issues of workforce diversity, particularly in the technology field. The following questions are recommended based on the analysis conducted.

Tier 1 – High priority

1. How many (or what percentage of) ethnic-minority students are present in the programme each (or last) year?

Tier 2 – Medium priority

1. How many (or what percentage of) students each (or last) year are sponsored (or paid for) by their employers? 2. For postgraduate programmes, what percentage of students each (or last) year had backgrounds in non-IT/engineering subjects?

Tier 3 – Low priority

1. What is the average age of students on the programme?

To further inform the CyberHEAD database, this report conducted a high-level analysis of the online policy documents focusing on how countries have attempted to address the shortages

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

and gaps in skills. From that analysis, the following questions are recommended for addition to the CyberHEAD database. Similar to above, the questions are presented in three tiers according to perceived usefulness from the perspective of the report’s authors.

Tier 1 – High priority

1. Are there any programme review processes or outcome-oriented metrics or surveys in place to refine cybersecurity programmes? 2. Is sufficient budget available for the provision of cybersecurity courses and cybersecurity educators?

Tier 2 – Medium priority

1. Do you follow any national or international cybersecurity frameworks when designing cybersecurity courses? 2. Are there any metrics in place to review the demand for your cybersecurity programme?

Tier 3 – Low priority

1. Do you have optional or mandatory cybersecurity courses available?

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

C ANNEX: MEMBER STATE REPLIES

Annex C includes the replies of EU Member States (MSs) to the following questions:

1. Who are the national actors active in cybersecurity skills in your Member State? 2. How does your national cybersecurity strategy or other legislation link to initiatives in cybersecurity skills such as: vocational studies in cybersecurity, public-private partnerships in cybersecurity skills, women in cybersecurity, internships in cyber, national competitions, or any educational activities in cyber? 3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so, how?

CYPRUS

1. Who are the national actors active in cybersecurity skills in your Member State?

At present, cybersecurity skills and education are promoted by the Digital Security Authority (NIS Competent Authority, which includes the national CSIRT-CY), the Ministry of Education, a number of local public and private universities, and through further initiatives (see response to Q2 below).

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

The current version of the National Cybersecurity Strategy (https://dsa.cy/wpcontent/uploads/csrc-2020.pdf), discusses cybersecurity skills, education and training initiatives in section 3.10 (Action 15) of the document (only available in Greek at present). Additionally, through the support of the DSA (among others), the Cyprus Computer Society annually organises the national cybersecurity challenge, which feeds into the European Cybersecurity Challenge every year.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

Not at present, although we are examining ways in which such impacts can be measured.

CZECH REPUBLIC

1. Who are the national actors active in cybersecurity skills in your Member State?

National Cyber and Information Security Agency (NÚKIB) – the agency has:

 a department focusing on education - specifically focusing on education and outreach in the area of cyber security and skills development  a cyber exercise unit - focusing on coordination and preparation of a wide range of technical and non-technical cybersecurity exercises on the national and international level (Cyber Czech, Cyber Coalition, Locked Shields, CMX); it also creates tailored mobile cybersecurity for partners; and contributes to educational awareness activities

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

 as well as a national cybersecurity strategy (NCSS) that will be further presented at question 2.

Ministry of Education, Youth and Sports

Educational institutions

 there are 6 public universities offering programs in the field cybersecurity or similar producing approx. 1000 – 1500 graduates yearly, which is not enough to cover the needs of these professionals in the Czech Republic, and hundreds of cybersecurity professionals are lacking  the universities also offer Postgraduate, Doctoral Studies or research initiatives, such as:  Laboratory for AI and cybersecurity (Czech Technical University in Prague + private company Avast)  Cybersecurity Hub (a project founded by 3 public universities)  Research team Advanced Cybersecurity at the University of Technology in Brno  National Competence Centre for cybersecurity (PPP – universities, private companies, public sector)

Non-governmental organisations (e.g. AFCEA) – among others organises the European Cybersecurity Challenge

Others, such as:

 CZ.NIC - an interest association of legal entities; one of their aims is also public education is specific areas of cybersecurity  Digikoalice – an open fellowship of representatives of state institutions, IT companies, ICT sector, educational institutions, academic assemblies, non-profit organisations, statutory authorities of schools, educational institutions and other entities that wish to contribute to the better digital literacy of citizens of the Czech Republic

Private institutions (CEVRO institute – MBA program)

IT Companies (e.g. CISCO Networking Academy)

Private companies

 PwC and Cyber Arena  CyberG

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

National Cyber and Information Security Agency (NÚKIB)

The main legislative document in the field of cybersecurity, Cybersecurity Act, defines prevention, education and systematic support in the field of cybersecurity as one of the competences of NCISA.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

National Cybersecurity Strategy (NCSS) dedicated a whole section to Education and Awareness (section Resilient Society 4.0) stressing the need to develop cybersecurity skills and educate population (especially the at-risk groups). In the upcoming Action plan, that is traditionally complementing the NCSS, there are three areas of focus: 1. Quality education system, 2. Outreach and education and 3. Vocational education and expanding the qualified base which together specify 23 tasks that have a positive impact on cybersecurity skills development. These tasks are concerned with defining and implementation of standards of cybersecurity skills into general and vocational education, training, conferences, workshops and other activities together with high schools, colleges, and universities.

Additionally, NCSS aims at sharing knowledge and expertise that NÚKIB acquires through cybersecurity exercises, training and other activities. Not only that, NÚKIB also regularly organises technical and non-technical cybersecurity exercises for various partners with the aim of strengthening their cybersecurity skills and resilience.

Among others, NÚKIB also generates and offers and support materials to teachers and atrisk groups (children and elderly), as well as offers support to the analysis of needs at the job market in the area of cybersecurity, or supports cybersecurity competitions, such as the European Cybersecurity Challenge — ECSC – this year, the competition is hosted in Prague.

NÚKIB is also open to university students in the form of internships in various areas in cybersecurity. Moreover, NÚKIB organises an annual conference called “CyberCon”, which is open for public and among others also focuses on students, outreach and education and tries to present various topics of cybersecurity. Various public panel discussions and workshops focused on topics of cybersecurity are organised by NÚKIB (often focusing on children, elderly, parents, teachers). NÚKIB also prepared and made public cybersecurity courses for the general public. Other than that, courses for public officers exist and are used by various national institutions for personnel training.

Other legislation and strategy:

Generally, we monitor that the educational plans at the level from primary schools to high schools miss generally digital and ICT skills, let alone cybersecurity skills. The revision of the educational plans is underway and NÚKIB is trying to make sure that relevant cybersecurity skills are implemented at these levels of education as well.

We also monitor various digital strategies at the national level that often include topics such as digital literacy, digital skills, ICT skills, etc., however, cybersecurity skills as such are either included only slightly, if at all.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

NCSS – the action plan and its progress is evaluated (mostly qualitatively) every year.

Cybersecurity courses, exercises and other activities – are evaluated based on attendance/the number of users going through these courses and events.

DENMARK

1. Who are the national actors active in cybersecurity skills in your Member State?

Several national actors are active in developing cybersecurity skills within Denmark, including: the Centre for Cybersecurity, the Agency for Digitisation, the Ministry of Education, primary and secondary schools, as well as universities. The Danish Business Authority also supports increasing cyber skills in SMEs.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

The National Cyber and Information Security Strategy from 2018 has a number of initiatives to strengthen cyber competencies and skills, see page 27-33 in the national strategy: https://digst.dk/media/16943/danish_cyber_and_information_security_strategy_pdfa.pdf <https://digst.dk/media/16943/danish_cyber_and_information_security_strategy_pdfa.pdf>

Moreover, awareness campaigns and educational materials at the Government information portal, Sikkerdigital.dk are all part of strengthening competencies in the field of cyber- and information security in the public and private spheres https://sikkerdigital.dk/.

The public SME program SMV:Digital provides grants to SMEs for the procurement of private consultations to help the SMEs complete their digital transformation, including grants for help with digital security.

In January 2020, the Danish Industry Foundation launched a Danish Hub for Cybersecurity in collaboration with Denmark’s technical University, DTU. The purpose of the hub is to bolster innovation and development within the area of cybersecurity and to strengthen competencies in cybersecurity among primarily SME’s, start-ups and suppliers.

https://www.cyberhub.dk/

In relation to education, the Danish government has developed and supported a number of educational programmes and academic curricula in cybersecurity in primary and secondary education. The Ministry of Education has established a learning portal with educational material on digital education, cybersecurity and digital judgement, and a broader technological comprehension educational program including cyber and information security is being tested in the Danish primary school.

The Ministry of Education has also developed a large amount of educational materials focusing on helping educators teach data protection and information security.

In regards to higher education, Denmark has both courses and summer schools, as well as Bachelor and Master programmes, which focus on cybersecurity and building cyber skills.

The Danish government has developed and supported a number of educational programmes and academic curricula in cybersecurity in higher education.

In order to have sufficiently skilled personnel to detect and handle cyber attacks on Denmark, in particular with regard to critical infrastructure, the Centre for Cybersecurity has developed and executed its own intensive Cyber Academy. The Cyber Academy had 15 graduates in 2019.

In August 2019, a number of higher education institutions carried out a Summer School in Cybersecurity supported by Centre for Cybersecurity. The Summer School included classes on amongst others basic security and network principles, DevOps and security, data carving in forensics, and network security exercises. The Summer school was repeated in 2020.

Cyber Days (supported by Centre for Cybersecurity)

A number of higher education institutions have carried out a two days seminar in Cybersecurity (Cyber Days) supported by Centre for Cybersecurity. The lectures and practical exercises included topics such as threat analysis, avoidance, and mitigation (both at the technical and

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

business level), as well as data security management (authenticity, confidentiality, integrity, privacy, etc.). University educations/training: IT University of Copenhagen The IT University of Copenhagen offers 4 Bachelor (BSc.) programs and 5 Master (MSc.) programs that include different levels of cybersecurity courses in their curriculum. The University has established Center for Information Security and Trust, a multidisciplinary research centre that aims to create an academic and practical foundation for raising the level of IT security in Denmark so that it matches current and future cyber threats. Master in Cybersecurity (Aalborg University) Aalborg University’s M.Sc. programme in Cybersecurity is an engineering programme targeted at B.Sc. graduates interested in privacy, network and software. The Cybersecurity educational programme equips the student with the skills to handle challenges in the increasing number of cyber-attacks, which companies and institutions are facing. Centre for Cybersecurity has participated in developing some of the learning modules together with Aalborg University. Bachelor in Cyber Technology (DTU) Technical University of Denmark offers an engineering Bachelor in Cyber Technology that focuses on programming and software development competences including cybersecurity. Master in IT Security (IT-Vest) Aarhus University, University of Southern Denmark and Aalborg University (IT-Vest) offers a single course Master in IT Security. Part time Master in Cybersecurity (DTU) Technical University of Denmark offers a part time Master in Cybersecurity. Diploma in IT Security (Copenhagen School of Design and Technology) Copenhagen School of Design and Technology offers a diploma part time education in IT Security aimed for public and private sector employees. Diploma in IT Security (Business Academy Aarhus) Business Academy Aarhus offers a diploma part time education in IT Security aimed for public and private sector employees.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

Not presently, but we are investigating ways to measure the impact of the initiatives.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION GERMANY

1. Who are the national actors active in cybersecurity skills in your Member State?

 In Germany, the national stakeholder landscape regarding cybersecurity skills is highly diverse including stakeholders from various backgrounds including private and public sector, civil society, associations and others.  It is important to note that in Germany school and university education are mainly in the remit of the “Länder” ("cultural sovereignty"), while the Federal Government also plays a significant role (e.g. Higher Education Pact, award of scholarships, Alliance for Education). Shared responsibility between “Länder” and Federal Government is particularly important in the fields of non-school vocational training, training assistance and continuing education.  A key strategic actor for cybersecurity skills is the National Cybersecurity Council, established with the 2011 Cybersecurity Strategy and serving the Federal Government as a strategic adviser for the ongoing and evolving strategy process on cybersecurity issues in Germany. The National Cybersecurity Council brings together high-level representatives from the federal and state levels, as well as the private sector, thereby offering a suitable format to advance the strategic cybersecurity issues most important for Germany. The National Cybersecurity Council will increasingly draw on expertise from society, private industry and the research community. Invited experts speaking on individual strategic topics will provide background for discussion and for drawing up recommendations for action.

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

 Link to German national cybersecurity strategy 2016: https://www.bmi.bund.de/DE/themen/it-und-digitalpolitik/it-und-cybersicherheit/cybersicherheitsstrategie/cyber-sicherheitsstrategie-node.html All following page references refer to English translation in attachment .  The German national cybersecurity strategy 2016 highlights several action areas with relevance for cybersecurity skills, in particular:  Action area 1: Remaining safe and autonomous in a digital environment, strategic objective “Promoting digital literacy among all users” (p. 10)  Action area 3: Strong and sustainable cybersecurity architecture for every level of government, strategic objective “Using resources, recruiting and developing staff” (p. 27f)  Action area 4: Germany’s active role in European and international cybersecurity policy, strategic objective “Bilateral and regional support and cooperation for cyber capacity building” (p. 31f)  Ongoing strategy development in the National Cybersecurity Council (p. 33f)  Not only the German national cybersecurity strategy references the importance of cybersecurity skills. Other strategies of the German Federal Government also incorporate objectives regarding digital skills with related funding, e.g. digital strategy of the German Federal Government (“Digitalstrategie der Bundesregierung”) or the German “High-Tech Strategy 2025” (https://www.bmbf.de/en/high-tech-strategy- 2025.html).

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

 The German national cybersecurity strategy 2016 is currently under evaluation.

Other remarks:

 The entire IT-sector in Germany is facing the challenge of a lack of IT-professionals. This leads to rising wages all over the country and a competition between employers as well as public sector and industry.  As an example: BSI as employer competes with the private sector by underlining its special mission for government, business, and society as the federal cybersecurity authority. In particular, aim and purpose of our work are to convince IT-professionals to work with BSI. To do so, BSI’s HR department conducts various media campaigns to spread its message and to provide insights into the work and profiles of different employees. BSI offers furthermore various opportunities for students, e.g. to apply for a scholarship, to do an internship, or the mentoring for their thesis.  BSI Human Resource Development uses a range of instruments to attract potential candidates as well as to select and develop the skills of employees, e.g.: i. Onboarding procedure ii. Leadership Development Program iii. Assessment Center for leadership positions iv. Internships in different divisions of BSI and cooperation with other national agencies v. Networking initiatives: BSI also supports national and international networks, e.g. Global Digital Women.

GREECE

1. Who are the national actors active in cybersecurity skills in your Member State?

National activities regarding skills strengthening on cybersecurity are spread across various competent public institutions. The relevant activities target education, vocational training and awareness raising. The National Cybersecurity Authority is actively monitoring the participation of the various actors in cybersecurity capacity building.

A substantial number of Universities (Ministry of Education and Religious Affairs) have developed courses on cybersecurity, while several of them participate in research activities and programmes related to security of networks and information. The Training Institute of the National Centre of Public Administration & Local Government (Ministry of Labour and Social Affairs) has developed and conducting life-long training courses on cybersecurity, addressing the skills gap of the public sector. Furthermore, the Hellenic Centre for Safer Internet, under the auspices of the Foundation for Research and Technology Hellas (FORTH), and the Cyber Crime Unit of the Hellenic Police are running campaigns dedicated to awareness raising of citizens, employees and teachers. Lastly, the National Cybersecurity Authority (Ministry of Digital Governance) is currently shaping a strategic plan to identify and tackle gaps, as well as to support existing activities.

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

The National Cybersecurity Strategy 2020-2025 gives special emphasis to capacity building, inter alia through the development of cybersecurity skills into a dedicated Strategic Objective: “5. Capacity building, promoting information and awareness raising”. In particular:

 Under Specific Objective “5.A. Building capacity by organising cybersecurity exercises”, a series of flagship activities have been included, specifically targeted in the development of readiness/preparedness and operational skills, inter alia through

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

the utilisation of security incidents simulation and the development of a dedicated platform.  Under Specific Objective “5.Β. Apply state - of - the - art educational and training methods and tools”, a series of flagship activities include the creation and distribution of information and education material, as well as the elaboration of an Education and Awareness Action Plan and the development of a comprehensive Framework for upgrading Expertise and Skills of Professionals.  It is also highlighted that, under this Specific Objective, special emphasis is given to the creation of appropriate incentives for the younger generations so as to become acquainted with cybersecurity and consider it as a subject of study or specialisation.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

The National Cybersecurity Authority is actively monitoring the national initiatives regarding cybersecurity skills. The foreseen “Education and Awareness Action Plan” is anticipated to include mechanisms for assessing the outcomes of activities in building cybersecurity skills.

HUNGARY

1. Who are the national actors active in cybersecurity skills in your Member State?

Cybersecurity skill development is currently focused around the higher education. On BA level, there are various specialties around information security, e.g. at University of Óbuda and Budapest University of Technology and Economics and Corvinus University of Budapest. A cybersecurity engineer BSc program is currently under accreditation at the University of Óbuda. On Master level, University of Public Service has an MA on cybersecurity and Eötvös Lóránd University has an MSc on cybersecurity. Some Postgraduate trainings are also available at the University of Public Service and University of Óbuda. Additional short term courses between 3-5 days are also available on several universities and on the market.

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

Vocational studies: it is mandatory for the CISOs in the public service to attend a 2 semesters long Postgraduate training at the University of Public Service according to the Act L. of 2013 on the electronic information security of state and municipal organisation.

PPP in cybersecurity skills: cybersecurity skills development is an integral part of the national NIS strategy (Governmental Decree 1838/2018 (XII. 28.) on the network and information system security strategy of Hungary) Women in Cybersecurity: there is no national strategy or legislation in this topic.

Internship in cyber: 10 weeks internship is mandatory on the cybersecurity MA program of the University of Public Service due to the relevant law on higher education.

National competitions: The Hungarian Cybersecurity Challenge is organised since 2018 as a national competition, as it is written in the national NIS strategy. In general, skills development is emphasised in the national NIS strategy.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

Yes, the national NIS strategy’s action plan between 2020-22 has a non-public version that contains KPIs for the above mentioned tasks.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION IRELAND

1. Who are the national actors active in cybersecurity skills in your Member State?

Please refer to the National Cybersecurity Strategy 2019-2024 for a contextual overview of initiatives on skills. Measures 12 and 13 are particularly relevant. Many of the initiatives are ‘bottom up’ rather than ‘top down’ with a large number of actors involved. We are not a ‘command and control’ society so in practise many of the initiatives, including government funding are not explicitly linked to legislation.

Updates on skills initiatives are delivered to quarterly meetings of the Inter-Departmental Committee overseeing implementation of the National Cybersecurity Strategy.

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

These initiatives should be linked to the national cybersecurity strategy or other legislation.

The NCSC itself with the Department of Environment, Climate and Communications is directly involved in curriculum development for a short course in cybersecurity for 12/13 to 15/16 year olds in second level schools. This involves a pilot implementation with schools, teachers and other education stakeholders.

Skillnet Ireland is tasked with upskilling and delivering conversion courses, including in the field of cybersecurity. Last year it ran quarterly capture the flags, and webinar events on key aspects of cybersecurity. ‘Cyber Women Ireland’ is about promotion of female participation in cybersecurity.

The national industry cluster “Cyber Ireland” has received support from Government, notably the State agencies, IDA Ireland and Enterprise Ireland in its setup. The ‘Cyber Skills’ project I an € 8.1m investment in third level institutions in Ireland in collaboration with Northern Ireland and Virginia Tech in the US, who have a cyber range facility to assist with improving the suitability of education courses for industry. Science Foundation Ireland’s discover programme is funding ‘Cyber Academy’ a Summer bootcamp initiative for 15 to 18 year olds that includes career talks, schools cyber challenge and cyber tech skills.

From CyberIRELAND

From the National Cybersecurity Strategy 2019-2024 see measure 12 & 13 that relate to skills https://www.ncsc.gov.ie/pdfs/National_Cyber_Security_Strategy.pdf The initiatives listed in the report are not directly funded under the national strategy, but those funded by the government all relate to national skills policies / strategies.

From my knowledge, the government supported initiatives include:  New cybersecurity courses funded under the Human Capital Initiative & Springboard  Cyber Skills Project funded under Human Capital Initiative  Cybersecurity Skills Initiative (CSI) - Technology Ireland ICT SKillnet  FIT Cybersecurity Apprenticeship  FutureInTech <https://www.futureintech.ie/pathways/cybersecurity-analyst/> has a Cybersecurity Analyst Course

This programme is aimed at those who are unemployed and came about as a result of the large numbers of individuals in different sectors (retail, hospitality etc.) who were displaced by Covid.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION LATVIA

1. Who are the national actors active in cybersecurity skills in your Member State?

There are national and also international actors, mostly academia, involved in development of cybersecurity skills.

The Ministry of Education and Science has the most important role in the field of education at the national level. The ministry enhances public knowledge and awareness about scientific, technological, engineering and mathematical developments that form the knowledge base on cyberspace at all levels of education. It also contributes to higher research capacity of universities through national and European Union Structural Funds (European Regional Development Fund, European Social Fund) investments into development and boosting of research infrastructure, including human capital.

Education in information technologies (IT) field starts in primary schools and continues in secondary schools and universities. National defence lessons, where cyber is one of the topics, will be mandatory subject at secondary schools starting September, 2024. The cybersecurity topics are also included in the curriculum of the Cadet Force.

Cybersecurity related professional education is also provided by professional secondary education institutions, for example, the Saldus Technical School. After secondary or professional secondary education, interested ones can continue their studies and join Bachelor degree studies or choose the first level higher professional study programmes, for example, the Riga Technical College.

Public and private higher education institutions provide Bachelor Degree programmes in IT. Also, several higher educational institutions are providing professional Master Degrees in cyber field, for example, the Riga Technical University, the University of Latvia, the Vidzeme University of Applied Sciences and the BA School of Business and Economics.

The Information Technology Security Incident Response Institution of the Republic of Latvia (CERT.LV) organises national technical exercises for state and local government IT security specialists, as well as annual cybersecurity conference and workshops twice a year. CERT.LV also provides several types of IT security awareness programmes for wide audience starting from teachers to IT security professionals. In 2019-2020 CERT.LV in the framework of Connecting Europe Facility project organised campaign “Cybersecurity at your workplace”. All those activities are aimed to rise overall level of cyber awareness. Since 2006 the Latvian Safe Internet Centre “Net-Safe Latvia” is a body engaged in public awareness rising about internet safety issues and child safety online.

National Armed Forces are rising cyber expertise by participating in national and international exercises. The Baltic Defence College, which is a multinational military college established by Estonia, Latvia and Lithuania in 1999, has included cyber elements into Joint Command and General Staff Course and the course “Cyber Defence Policy on National and International Levels”. The last is organised in cooperation with the European Security and Defence College.

Latvia is also sponsoring nation of the NATO Cybersecurity Centre of Excellence, which organises technical, legal, operational level and strategic level training.

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Latvia has a cybersecurity strategy since 2014. The Cybersecurity Strategy of Latvia 2014-2018 was adopted in 2014, but the Cybersecurity Strategy of Latvia 2019-2022 - in 2019. The latest outlines 5 key areas of action, where public awareness, education and research is defined as a separate area of action:

 Promotion of cybersecurity, reduction of digital security risks,  Strengthening the resilience of information and communication technologies, the provision of critical information and communication technologies and services to the public,  Public awareness, education and research,  International cooperation  The rule of law in cyberspace and the reduction of cybercrime.

Every area of action includes an action plan with specific tasks given to ministries and other involved parties. The Cybersecurity Strategy of Latvia 2019-2022 states that “all stakeholders are equally important for securing networks and information systems, and that means everyone should be equally aware of risks they are exposed to when online and actions that may prevent such exposure”. The action plan for the area “Public awareness, education and research” includes tasks, for example:

 raise awareness of students and teachers about information security, protection of privacy and reliable online services, or  improve public awareness about online safety (age-group-specific information and instructional materials with guidelines on online safety, social media campaign security) and deliver advanced cybersecurity training for specific target groups. Develop and implement annual multi-agency action and campaign plan with cybersecurity information events and awareness raising campaigns.

Therefore, the strategy defines awareness, education and research as one of five areas of action and it has direct impact on cybersecurity initiatives, but nevertheless it does not specifically name all of them.

Latvia has established a legal framework in the area of cybersecurity – the Law on the Security of Information Technologies and the Cabinet of Ministers Regulations pursuant to it. The link between legal framework and cybersecurity initiatives might be not so evident, but is not less important. For example, the Cabinet Regulation of July 28, 2015 No.442 “Procedures for the Ensuring Conformity of Information and Communication Technologies Systems to Minimum Security Requirements” serves as guideline for educational institutions when creating and adopting curriculum.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

Impact of the initiatives are usually monitored by the ones who are conducting them. For example, CERT.LV has conducted assessments of IT security awareness by distributing questionnaires to participants at CERT.LV events. Education activities on other hand can be measured by number of applicants and graduates.

Regarding national cybersecurity strategy reviews, a mid-term progress review of the Cybersecurity strategy of Latvia 2014-2018 was conducted in 2016 and the final progress review was completed in 2019. The final review identified that majority of tasks have been implemented or are in execution stage. The review also identified three challenges that had effect to fully achieve the individual tasks: cybersecurity issues are not always a priority, a lack of personnel and a lack of funding. A progress review of the Cybersecurity Strategy 2019-2022

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

is planned to be completed by 1st of May 2022 when preparation of a strategy for the next four year period will be ongoing.

LITHUANIA

1. Who are the national actors active in cybersecurity skills in your Member State?

In the Lithuania actors, involved in development of cybersecurity skills are schools, academia, private sector and governmental institutions.

Schools: Education of IT starts in primary schools.

Academia: Universities with IT, engineering and cybersecurity programs

Private sectors: entities, which provides training, certification.

Governmental institutions: Institutions, which provides training for the government entities (for example NSCS under Mod).

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

It is directly related to the third target of the Lithuania’s strategy – to promote cybersecurity culture and development of innovation and to fourth target – to strengthen a close cooperation between private and public sectors.

The first objective of the third target is to expand scientific research and activities which create high added value in the area of cybersecurity. This objective will be fulfilled by creating suitable conditions for the creation of new, advanced capabilities which develop cybersecurity initiatives by promoting the growth of the cybersecurity market, export of cybersecurity services to foreign markets, by expanding the cybersecurity sector of financial technology and by carrying out corresponding research.

The second objective of the third target is to develop creativity, advanced capabilities and cybersecurity skills and qualification which match with the needs of the market. This objective will be attained by having representatives of public and private sector as well as science and education institutions create a cybersecurity competence model, establish cybersecurity competence standards, develop systems of training, accreditation and certification all of which would be oriented towards the needs of the labour market, also have them attract and develop talents, create training and testing environment of cybersecurity, teach the beginners/newcomers and provide opportunities of re-training/re-qualification to persons working in the ICT field, improve knowledge on cybersecurity of persons who work with sensitive data.

The third objective of the third target is to promote the cooperation between the public and private sector and science and education institutions in developing cybersecurity innovation. This objective will be fulfilled by identifying the common needs of private and public sectors, their importance to scientific cybersecurity research, by creating technical measures, methods and other resources, by developing competences to resolve cybersecurity problems and carry out specific cybersecurity objectives.

The first objective of the fourth target is to improve the coordination of cooperation between private and public sectors. This objective will be reached by creating a sustainable model of cooperation between private and public sectors in the field of cybersecurity, by identifying

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

responsibility and capabilities, by strengthening the country’s cybersecurity, by making exchange of relevant information on cyber threats, cyber incidents which have taken place and lessons learned between private and public sectors more effective, by developing early warning system, by creating new and improving the existing communication methods and processes.

The second objective of the fourth target is to increase the degree of cybersecurity maturity of the representatives of private small and medium-sized businesses. This objective will be fulfilled by encouraging (urging) the representatives of small and medium-sized businesses to check the status of their cybersecurity and plug the gaps in cybersecurity.

The third objective of the fourth target is to create responsible practice of disclosing the ICT security gaps in private and public sectors. This objective will be reached by initiating a responsible practice of disclosing ICT gaps in private and public sectors, by establishing operational principles of this field, the procedure of application of methods, technical capacities and other measures designed for this purpose.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

Yes, criteria for the implementation of cybersecurity strategy is approved by the Lithuania’s Government:

https://eseimas.lrs.lt/portal/legalAct/lt/TAD/27107170d04511e8a82fc67610e51066?jfwid=dg8d31595

MALTA

1. Who are the national actors active in cybersecurity skills in your Member State?

Currently, the national actors which are active in cybersecurity skills are the Critical Information Infrastructure Protection Unit (NIS Competent Authority – includes also CSIRTMalta which is the national CSIRT), eSkills Foundation (founded by the Ministry for Education and Employment, Malta Digital Innovation Authority, Malta Enterprise, Malta Chamber of Commerce, Enterprise and Industry, Malta Communications Authority, Malta Information & Technology Agency, Malta Gaming Authority, and Ministry for the Economy, Investment and Small Businesses), Malta Information & Technology Agency, private and public universities, and additional initiatives.

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

Through the current strategy, Malta Cybersecurity Strategy 2016, the goal of Education (Goal 5) is discussed where a strategic approach towards an ongoing educational campaign is recommended. One such scheme that was launched in the first edition of the ‘Malta Cybersecurity Summit’, in 2019, is the ‘B SECURE’ scheme, where it offers training courses for both Executives and Industry Professionals. Apart from this, the CSIRTMalta Constituent Programme offers cybersecurity training to its constituents.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

No impact assessment has been made to date.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION NETHERLANDS

1. Who are the national actors active in cybersecurity skills in your Member State?

We have quite a few national actors active in cybersecurity skills in The Netherlands. Including The Hague Security Delta (HSD) – a network for the development of knowledge and innovation in security –, the platform for information security (PvIB) – an independent knowledge centre –, and DCYPHER – the Dutch cybersecurity platform for higher education and research. The Dutch government also has an i-traineeship for young cyber professionals to gain work experience and knowledge in the field. Finally, the NCSC and i-Partnerschap are working on setting up a government PhD programme (rijkspromovendiprogramma).

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

The cybersecurity council (cybersecurity raad) recently wrote a report on this in Dutch. The report advocates a continuous development of cybersecurity knowledge and skills. In February 2021 the collaboration platform cybersecurity knowledge and innovation was launched, to stimulate an increase of specialised cybersecurity professionals. In 2019 the Human Capital Agenda Security was launched by HSD, to improve the supply and demand of cybersecurity professionals. A similar mission is found in the Roadmap Human Capital 2020-2030.

Furthermore, the NCSC is involved in CTF, like challenge the Cyber and ISIDOOR, and Women in Cyber is a Dutch organisation.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

Currently we do not have an impact assessment.

SLOVENIA

1. Who are the national actors active in cybersecurity skills in your Member State?

In Slovenia cybersecurity is part of the educational programmes at the university level in some Slovenian faculties, namely the Faculty of Electrical Engineering and Computer Sciences and the Faculty for Security Studies of the University of Maribor, the Faculty of Computer and Information Sciences and the Faculty of Social Sciences of the University of Ljubljana, the Faculty of Health Sciences of the University of Primorska, the Faculty of Information Studies of Novo mesto, and the licensed independent higher education institution GEA College. Other important actor in promoting and acquiring cybersecurity skills is the Cybersecurity Section within the Association of Informatics and Telecommunications at the Chamber of Commerce and Industry of Slovenia which has organised several hackathons for the youth.

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

The National Cybersecurity Strategy of 2016 set two measures for achieving the goal of safety of citizens in cyberspace. Those measures were regular implementation of awareness-raising programmes on cybersecurity and introduction of cybersecurity content in education and training programmes. Slovenia is quite successful in performing the former but unfortunately not successful in performing the latter. In 2021 Slovenia will participate in the European Cybersecurity Challenge for the first time in order to popularise acquiring the cybersecurity skills

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

among the youth. It is planned that every year’s national challenge and the participation in ECSC become traditional.

The new cybersecurity strategy will address various initiatives for acquiring and developing cybersecurity skills.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

For the time being the impact of cybersecurity initiatives has not been measured, but this will change with the new cybersecurity strategy.

SPAIN

1. Who are the national actors active in cybersecurity skills in your Member State?

Spain has three official documents, which endorse the actions that are being carried out in terms of talent and skills in Cybersecurity.

These three documents are:

 The National Cybersecurity Strategy (link)  Within this strategy, there is the "Objective IV: Culture and commitment to cybersecurity and empowerment of human and technological capabilities" and in its "Line of action 5: Strengthen the Spanish cybersecurity industry and the generation and retention of talent, for the strengthening of digital autonomy (measures 5 to 8)" we can find all the measures related to the promotion of talent.  The Digital Agenda “España Digital 2025” (link)  Also, within this plan, in "Line 4: Cybersecurity (measure 14.2 - (2) generation, identification and development of talent in cybersecurity, to increase capacities and respond to the growth of the sector and the Spanish cybersecurity industry)", all the actions related to talent in Cybersecurity are specified.  The National Digital Skills Plan (link)  This plan provides for public reforms and investments to the sum of 3.75 billion euros and its goals are guaranteeing digital inclusion, reducing the digital gap between men and women, guaranteeing the digitalisation of education, promoting the acquisition of the digital skills of the unemployed and of workers, increasing the number of ICT specialists and promoting the necessary digital skills of companies. In order to reach these goals, cybersecurity skills are considered fundamental and, because of that, they are taken into account in this plan.

With this framework in mind, the Spanish government has set up the National Cybersecurity Forum (FNCS), which is a public-private collaboration space promoted by the National Security Council (DSN) with the collaboration of INCIBE (Spanish National Cybersecurity Institute) and the CCN (National Cryptologic Centre), whom hold the two vice-presidencies.

 The FNCS, aligned with the aforementioned documents, is working on several lines focused on generating cybersecurity culture (Working Group 1), offering support to Industry and R&D&i (Working Group 2) and an opportunity for training and talent in cybersecurity (Working Group 3). Issues related to cybersecurity talent are dealt with in WG 3 and in one of the sub-working groups of WG 2 (matching industry demands regarding talent and skills).  Specifically, the objectives of WG3 are:  To update or, when appropriate, to develop cybersecurity competency frameworks that respond to the needs of the labour market.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

 Identify the needs for professional cybersecurity skills, fostering collaboration with educational and training institutions, promoting lifelong learning, training for employment and university education, promoting accreditation and professional certification systems.  Promote the inclusion of professional cybersecurity profiles in public sector job descriptions.  Detect, foster and retain cybersecurity talent with special attention to the field of research.  Promote cybersecurity digital literacy initiatives and plans.  Seek and recognise the collaboration and participation of the media to achieve greater reach in campaigns aimed at citizens and minors.

In parallel, INCIBE is executing additional actions in the field of cybersecurity competences at a national level. These actions include the launch of a Cybersecurity Talent Analysis and Diagnosis Service in Spain which, among other things, aims to carry out more than 600 surveys to determine the real need for profiles at national level.

2. How does your national cybersecurity strategy or other legislation link to cybersecurity initiatives in skills such as: Vocational studies in cybersecurity, PPP in cybersecurity in skills, women in cybersecurity, internship in cyber, national competitions, any education activities in cyber?

There are several other initiatives that have already been carried out over the years and that could be of interest, as many of them will continue to be adapted to the new profiles sought:

 Market studies:  Apart from the aforementioned study being carried out by INCIBE, the rest of the initiatives launched in Spain have been at a more local level and not supported by any of the documents or laws mentioned.  Competitions:  Since 2014, INCIBE has been organising the CyberCamp event, which mainly aims to identify career paths and broaden technical knowledge, as well as to awaken and promote talent in cybersecurity through technical competitions.  In this sense, two competitions are organised as part of the event, one individual and the other by teams (CyberOlimpics).  The team competition is aimed at secondary school and vocational training students and serves as a first step before moving on to the individual competition.  The individual competition also serves to select the Spanish team that participates every year in the ENISA European Cybersecurity Challenges  Up to now, the design of the tests and challenges of these competitions hasn´t been based on any specific criteria or definition of competencies; however, our intention is to adapt the challenges to the competencies and profiles needed in the Spanish industry and also to increase the number of training sessions and competitions by levels and competencies that they develop.  There are more competitions developed by different organisations and entities that seek the same objective, to boost the interest of the new generations in dedicating themselves professionally to Cybersecurity. Below are some of the competitions developed over the last year at national level by public bodies:  National League of challenges in Cyberspace organised by the Spanish Civil Guard (link)

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

 CyberWallChallenge organised by the Spanish National Police as part of its CyberWallAcademy training action. (https://www.ecteg.eu/c1b3rwallacademy-es/)

 Professional studies:  In addition to university studies in the field of cybersecurity (which we previously mentioned in another thread on the different degrees available in Spain) and which you can find a list of in the INCIBE catalogue, there are also vocational training studies.  These studies have three levels (basic, intermediate and advanced). The last of these levels is recognised at the same level as university Master degrees, and this year the first courses of this type in cybersecurity have been published:  Course of Specialisation in Cybersecurity in Information Technology Environments endorsed by Royal Decree 479/2020, of 7 April, establishing the Course of Specialisation in Cybersecurity in Information Technology Environments and setting the basic aspects of the curriculum (https://www.boe.es/diario_boe/txt.php?id=BOE-A-2020-4963).  Specialisation Course in Cybersecurity in Operational Technology Environments, endorsed by Royal Decree 478/2020, of 7 April, which establishes the Specialisation Course in Cybersecurity in Operational Technology Environments and sets out the basic aspects of the curriculum (https://www.boe.es/diario_boe/txt.php?id=BOE-A-2020- 4962).  These two Cybersecurity Specialisation courses will be taught for the first time in Spain this coming academic year (2021-22) as the first step towards developing Cybersecurity courses at the other two levels of this type of training (INCIBE has collaborated in the Working Group that developed the CV of these courses and we are collaborating with the Spanish Ministry of Education and Vocational Training in the continuity of the actions for the other levels, as well as in the training of the professionals who will teach these courses, together with the School of Industrial Organisation - EOI https://www.boe.es/boe/dias/2021/03/12/pdfs/BOE-A-2021-3904.pdf).  Women in cybersecurity:  In relation to women in cybersecurity, we can highlight two initiatives at the national level:  INCIBE has launched "Despega" (“Take-off”) a program that aims to promote the presence of women in cybersecurity, including actions to raise awareness, attract talent, training, visibility, entrepreneurship and employability for women.  On the other hand, the first national chapter of ECSO's Women4Cyber programme has recently been founded in Spain, which is also working on these initiatives, aligned with the initiatives at European level and which is reaching agreements with different entities (both public and private) seeking to promote the presence of women in this area.  Educational actions in cybersecurity:  In addition to what has already been mentioned in previous points, INCIBE is working in the medium to long term on the establishment of training itineraries (with its own content as well as that of third parties), aligned with the profiles that will be obtained from the different initiatives underway and whose objective is to cover the demand for the necessary professionals at national level and that have quality training oriented towards the competences required for each of the most indemand profiles.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Up to this point, we have indicated the initiatives at national level that are being worked on, but which do not yet have published deliverables and which, in many of them, we are going to take the results of the ENISA WG as a point of reference.

3. Has the impact of cybersecurity initiatives such as those mentioned above been measured and if so how?

In most of the initiatives showed before, there is no specific measuring tools for the impact. However, we have information regarding indicators of the initiatives carried out so far, with data on participation in some Massive Online Open Courses (MOOCs).

Registered Passed Course Season Satisfaction rate participants participants

L1 – SMES 6* 11.747 3091 4,32 (1-5 scale)

L2 – Móviles 2 4.000 448 Not available

Only qualitative analysis: L3 – SCI 2** 2.132 721 most of positive comments

L7 – FCSE

1 1.779 1064 79,75% mostly satisfied

(basic)

L7 – FCSE

1 1.818 758 75,62% mostly satisfied

(advance)

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

D ANNEX: APPROACHES ADOPTED BY NON-EU COUNTRIES

This annex examines the approaches adopted by two non-EU countries (the United Kingdom and the United States) in their efforts to improve cybersecurity skills and education, and reduce the shortfall in cybersecurity professionals. This analysis is based on open-source information.

In the United Kingdom (UK), cybersecurity and cyber defence have been a national priority for many years. In order to increase the pool of cybersecurity skills, the UK has also focused on ‘widespread and innovative collaboration across all sectors’ . The UK’s latest NCSS (2016- 2021) stresses the need to ‘develop’ the cyber skills base in the country. More importantly, 145,146 the Initial National Cybersecurity Skills Strategy (2019) considers cybersecurity education to be a strategic outcome with the overall goal of ensuring that the country has enough cybersecurity professionals to meet national needs.

In the past 30 years, the United States (US) has developed strategies and policies related to cyberspace (security and defence). One of the priorities set by the US National Cyber Strategy (2018) was to enhance efforts to build cyber capacity . Pillar II of the strategy specifically refers to the need to develop the workforce and maintain the supply of talent by: 1) increasing reskilling and educational opportunities for workers, 2) enhancing the federal cybersecurity workforce, and 3) using executive authority to highlight and reward talent .

Below we conduct a high-level analysis based on the three primary areas used in Section 3.

D.1 RAISE USER AWARENESS AMONGST THE GENERAL PUBLIC AND IN PRIMARY AND SECONDARY EDUCATION UNITED KINGDOM

Launched in 2016 by the UK’s National Cyber Security Centre (NCSC), the CyberFirst initiative has been extended and has become part of an ‘£84 million government cybereducation programme’. It offers, among other, courses and competitions for young people (11- 17 years old) and its CyberFirst Girls competitions motivates girls to develop their cyber skills.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

In terms of campaign initiatives targeting the public, the UK launched Cyber Aware (led by the NCSC). Its aim is to teach people on how to stay secure online and how to protect themselves in a practical way . Moreover, ‘Get Safe Online’ acts as one of the UK's leading resources on awareness, helping to protect people, financial assets, devices and businesses from fraud, abuse and other online threats . Its website offers the public practical advice on, for example, how to perform backups and keep safe online.

UNITED STATES

In 2018, the US’s Department of Commerce and Department of Homeland Security (DHS) released a report on ‘Supporting the Growth and Sustainment of the Nation’s Cybersecurity Workforce’ . The report also raises awareness regarding the skills shortage problem, acknowledges the need for an immediate expansion of the cybersecurity workforce, and provides the following findings:

 the increasing concerns of employers about the importance of cybersecurity related educational programmes;  the insufficient number of skilled cybersecurity teachers at the primary and secondary school levels and in higher education, as well as a lack of training instructors;  the need to increase the number of female candidates for cybersecurity careers and the re-education of non-IT personnel in organisations;  the need to simplify hiring procedures (e.g. lengthy security clearance delays); and  the lack of reliable data to deliver a comprehensive picture of the needs of the cybersecurity workforce and related education and training programmes.

More recently, in March 2021, the Interim National Security Strategic Guidance document, which also highlights the importance of investing in people to build a talent base, was released.

Launched in 2020, Cyber.org is a cybersecurity-centric workforce development organisation, backed by the cyber unit of DHS and CISA, that promotes cyber education and literacy. It targets K-12 students (from kindergarten to 12th grade). It has published materials for teachers to educate students on the basics of cybersecurity. In addition, the organisation has published ‘K-12 Cybersecurity Learning Standards’ which focuses on three core themes: Computing Systems, Digital Citizenship and Security.

D.2 STRENGTHEN TRAINING AND PROMOTE CYBERSECURITY IN HIGHER EDUCATION UNITED KINGDOM

To prepare a knowledge base for scientific cybersecurity, the Cybersecurity Body of Knowledge (CyBOK) project at the University of Bristol in the UK aims to ‘codify the foundational and generally recognised knowledge on cybersecurity’. The project serves as a knowledge hub and

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

guide for existing literature such as textbooks, academic research articles, technical reports, white papers and standards .

Furthermore, the UK’s NCSC certifies bachelor, integrated master, and master programmes, and apprenticeships. This initiative directly stems from the UK Cybersecurity Strategy 2016-21, which states that ‘the UK requires more talented and qualified cybersecurity professionals’ . To obtain certification, degree courses should have a minimum number of credits in computer science or cybersecurity, depending on whether they are bachelor or master programmes. The NCSC provides either provisional or full certification, which is valid for 5 years.

In 2013, the Centres for Doctoral Training (CDTs) in Cybersecurity were established as a part of the 2011 national cybersecurity programme. A CDT in cybersecurity provides a 4-year programme. Doctoral students attend a taught component in their first year and undertake a specific research project with a clear focus on cybersecurity in the remaining 3 years.

From the training side, the Cyber Retraining Academy is a UK government-funded programme that provides an intensive 10-week conversion programme for people without a formal background in cyber. This provides people with new opportunities by allowing them to move into cybersecurity careers while, at the same time, it directly alleviates the shortage problem in the cybersecurity workforce.

UNITED STATES

In the US, the National Security Agency (NSA) has invested substantially in the creation of rigorous cybersecurity programmes across a network of universities . Nevertheless, reports suggest that ‘only 42% of the top 50 computer science programmes in the country include security courses for undergraduates’ . According to CyberSeek, an initiative funded by the National Initiative for Cybersecurity Education (NICE), from April 2020 to March 2021, the country’s total employed workforce in cybersecurity was 956,341 persons, whilst the number of online job listings for cybersecurity-related positions was 464,420 .

Established in 2010, the Workforce Framework for Cybersecurity (NICE Framework) aims to aid in sustaining the cybersecurity workforce in partnership with the government, academia, and the private sector on education, training, and the development of the workforce . According to the Cybersecurity & Infrastructure Security Agency (CISA) , by using the NICE Framework, among others, the creation of educational programmes aligned to jobs could be facilitated while, at the same time, the appropriate knowledge and skills needed by the market could be selected and delivered to students. To help in the implementation of the framework, the Department of Homeland Security (DHS) published resources (e.g. toolkit, mapping tools) for educators and employers. Moreover, CyberSeek , which was built through a public-private partnership, is a tool that provides data about supply and demand for cybersecurity jobs in the US.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

The National Centres of Academic Excellence in Cybersecurity (NCAE-C) programme, managed by the National Cryptologic School, developed a set of academic standards (cybersecurity curriculum and academic excellence) that colleges and universities in the US are encouraged to meet. Currently, there are three categories:

 Cyber Defence Education (CAE-CDE) designation awarded to regionally accredited academic institutions;  Cyber Research (CAE-R) designation awarded to Department of Defense (DoD) schools, PhD producing military academies; and  Cyber Operations (CAE-CO) a deeply technical, inter-disciplinary, higher education programme.

Lastly but not least, the DoD has been vocal about the challenge of recruiting and retaining 170 171 cyber talent due to competition with industry . The DoD Cyber Workforce Framework was developed in 2020 and was defined in DoD Directive 8140.01. It works as a lexicon and refines ‘all of the DoD’s cyber skillsets needed to conduct its missions into 54 roles’ .

D.3 ORGANISE CYBERSECURITY EXERCISES AND CHALLENGES UNITED KINGDOM

The ‘Cybersecurity Challenge’ was established in 2010 in order to organise a series of national competitions, learning programmes and networking initiatives to attract more people from diverse backgrounds to become cybersecurity professionals . It also acts as an ‘entry point for students into other UK wide educational programmes such as Cyber First, Cyber Discovery and the Cyber Centurion competition .

UNITED STATES

The US Cyber Challenge (USCC) is a national programme that organises cybersecurity camps and competitions targeting students. Free online competitions, called Cyber Quests, are conducted every year in order to assess the cybersecurity knowledge of participants. Depending on their performance, contestants may be invited to Cyber Camps where cybersecurity training sessions taught by top instructors take place.

Additionally, in 2019 the President’s Cup Cybersecurity Competition was established. It targets federal employees. The competition aims to identify cybersecurity talents inside the federal workforce, through challenges focusing on all cybersecurity areas covered by the NICE Framework.

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

E ANNEX: LIST OF CYBERHEAD PROGRAMMES

Annex E presents a list of the 126 programmes published in CyberHEAD and whose data were used in drafting this report.

Institution name Programme name Programme type Country

Alpen-Adria University Artificial Intelligence and Master’s Degree Klagenfurt Cybersecurity FH Campus Wien IT Security Master’s Degree FH JOANNEUM IT & Mobile Security Master’s Degree Sichere Informationssysteme FH OÖ Bachelor’s Degree Bachelor Sichere Informationssysteme FH OÖ Master’s Degree Master FH OÖ Information Security Management Master’s Degree

Austria

Sankt Pölten University of Applied Sciences (FH St. IT Security Bachelor’s Degree Pölten) Sankt Pölten University of Applied Sciences (FH St. Information Security Master’s Degree Pölten) Sankt Pölten University of Applied Sciences (FH St. Cyber Security and Resilience Master’s Degree Pölten) MSc Software Engineering and TU Wien Internet Computing - Specialization Master’s Degree in Security and Privacy Howest University of Applied Bachelor of Applied Computer Bachelor’s Degree Sciences Science - major in Cybersecurity Master of Electrical Engineering KU Leuven Master’s Degree (ICT Security and Networks) Belgium Université Libre de Bruxelles, Université Catholique de Louvain, Université de Namur, Master of Science in Cybersecurity Master’s Degree Ecole Royale Militaire, HELB, ESI University of Library Studies and Information Technologies Information security Bachelor’s Degree (ULSIT) Bulgaria University of Library Studies and Information Technologies Information security Master’s Degree (ULSIT)

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

University of National and Management of Cybersecurity Master’s Degree World Economy European University Cyprus MSc in Cybersecurity Master’s Degree

Open University of Cyprus Computer and Network Security Master’s Degree Cyprus

University of Central Lancashire Cyprus (UCLan MSc Cybersecurity Master’s Degree Cyprus) Brno University of Technology Information Security Bachelor’s Degree

Brno University of Technology Cybersecurity Master’s Degree

Computer Systems, Communication Masaryk University and Security (Information Security Master’s Degree Czech

Republic

Specialization)

Software Systems and Services Masaryk University Management - Management of Master’s Degree Cybersecurity Masaryk University Cybersecurity Bachelor’s Degree

Aalborg University Cyber Security Master’s Degree

Denmark

Technical University of Master of Cyber Security Master’s Degree Denmark

Tallinn University of Cyber Security Master’s Degree Estonia Technology

JAMK University of Applied Bachelor of Engineering, ICT with Bachelor’s Degree Science cyber security orientation

JAMK University of Applied Master's Degree in Information Master’s Degree Sciences Technology, Cyber Security

Bachelor's Degree Programme in Laurea University of Applied Business Information Technology Bachelor’s Degree Sciences (ICT with Cybersecurity orientation) Finland

Bachelor's Degree Programme in Laurea University of Applied Business Information Technology Bachelor’s Degree Sciences (Cybersecurity Specialization)

Kyberturvallisuuden maisteriopinnot University of Jyväskylä Master’s Degree / MSc Cybersecurity

Cyber Security, Master of Science University of Turku Master’s Degree in Technology

ENSIBS - Ecole Nationale Supérieure d'Ingénieurs de Spécialité Cyberdéfense Master’s Degree Bretagne Sud EURECOM Master of Science in Digital Security Master’s Degree

Post Master Degree in Security in Computer Systems and Postgraduate EURECOM Communications (Specialized programme engineer)

France

MBA Management de la Postgraduate Institut Léonard de Vinci Cybersécurité programme

Master of Information Systems Risk IRIAF, University of Poitiers Master’s Degree Management (MRSI)

Sécurité des Systèmes et des Télécom SudParis Master’s Degree Réseaux

Cyber-Sécurité des Systèmes Université Bretagne Sud Master’s Degree Embarqués Université Grenoble Alpes Cybersecurity Master’s Degree

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

University of Brittany South (Université Bretagne Sud/UBS) - Component Software Cybersecurity Master’s Degree National engineering school of Brittany South (ENSIBS)

Cyberschool: Mathematics of University Rennes 1 Master’s Degree information theory, cryptography

Mannheim University of Cyber Security Bachelor Bachelor’s Degree Applied Sciences

Germany

University of Bonn Bachelor Cyber Security Bachelor’s Degree

University of Passau M.Sc. Computer Science Master’s Degree

Athens University of Information Systems Security & Master’s Degree Economics & Business Development

International Hellenic MSc in Cybersecurity Master’s Degree University University of Piraeus Digital Systems Security Master’s Degree Greece

Distributed Systems, Security and University of Piraeus Master’s Degree Emerging Information Technologies

MSc in Information and University of the Aegean Master’s Degree Communication Systems Security

National University of Public Cyber Security (kiberbiztonsági) Master’s Degree Hungary Service

Bachelor of Science (Honours) in Technological University Computing in Digital Forensics & Bachelor’s Degree Ireland Dublin, Blanchardstown Cyber Security

Bocconi University and Master of Science in Cyber Risk Master’s Degree Politecnico of Milano Strategy and Governance

M.Sc. in Computer Engineering Politecnico di Milano Master’s Degree (cybersecurity concentration) Sapienza University of Rome Master of Science in Cybersecurity Master’s Degree

Università degli Studi di Bari Sicurezza Informatica Master’s Degree Aldo Moro Università degli Studi di Milano Sicurezza dei Sistemi e delle Reti Bachelor’s Degree

Sicurezza dei Sistemi e delle Reti Università degli Studi di Milano Informatiche (Computer Systems Bachelor’s Degree and Networks Security) online

Data Science and Innovation Università degli Studi di Management (study program in Italy Master’s Degree Salerno "Cyber Risk Management for Advanced Defence Strategies")

Postgraduate Università degli Studi di Torino Cybersecurity programme

Computer Engineering, University of Cagliari Cybersecurity and Artificial Master’s Degree Intelligence

DATA AND COMMUNICATION University of Naples SECURITY ENGINEERING Master’s Degree Parthenope Academic year: 2019/2020 University of Padova Cybersecurity Master’s Degree

University of Perugia Cybersecurity Master’s Degree

MSc Computer Engineering (with University of Pisa Master’s Degree Cybersecurity curriculum)

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

University of Pisa Master Degree in Cybersecurity Master’s Degree

Master in Cybersecurity Postgraduate University of Pisa / CNR (specialization course) programme

Diplomatic, International and Global University of Salerno Bachelor’s Degree Security Studies

EIT Digital MSc Cybersecurity University of Trento Master’s Degree (CSE)

Artificial Intelligence & University of Udine Master’s Degree Cybersecurity

BA School of Business and Professional master's degree in Master’s Degree Finance Cybersecurity Management

Latvia

Riga Technical University Cybersecurity Engineering Master’s Degree

Vidzeme University of Applied Cybersecurity Engineering Master’s Degree Sciences

Mykolas Romeris University Cybersecurity Management Master’s Degree

Cybersecurity and Technologies Mykolas Romeris University Bachelor’s Degree Management

Lithuania

Vilnius Gedmininas Technical Information and Information Master’s Degree University (VilniusTech) Technologies Security

Information Systems and Cyber Vilnius University Bachelor’s Degree Security

Information System Security University of Luxembourg Master’s Degree Luxembourg Management (ISSM)

Eindhoven University of Information Security Technology Master’s Degree Technology track

Netherlands

University of Amsterdam Security and Network Engineering Master’s Degree

University of Twente and TU 4TU Cybersecurity Master Master’s Degree Delft Specialization

University of Agder Master in Cybersecurity Master’s Degree Norway

Czestochowa University of Computer Science: Cybersecurity Master’s Degree Technology

Poland

Warsaw University of Cybersecurity Bachelor’s Degree Technology

Mestrado em Segurança Faculdade de Ciências da Informática (Masters in Information Master’s Degree Universidade do Porto Security)

Instituto Politécnico de Viana Mestrado em Cibersegurança Master’s Degree do Castelo (Master in Cybersecurity)

School of Management and Technology - Polytechnic of Computer Networks Security Bachelor’s Degree

Porto Portugal

School of Technology and Management of Polytechnic of Cybersecurity and Digital Forensics Master’s Degree

Leiria

Universidade de Lisboa, Information Security and Master’s Degree Escola Naval Cyberspace Law

University of Aveiro Cybersecurity Master’s Degree

Master Programme in Information University of Lisbon Master’s Degree Security

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

University Politehnica of Coding and Storage Theory of Bucharest-Faculty of Applied Master’s Degree Romania Information Master Sciences

Campus Internacional de Ciberseguridad (ENIIT Máster en Ciberseguridad Master’s Degree Business School)

Campus Internacional de Ciberseguridad (ENIIT Máster en Ciberderecho Master’s Degree Business School)

Campus Internacional de Ciberseguridad (ENIIT Máster en Ciberinteligencia Master’s Degree Business School)

Campus Internacional de Ciberseguridad (ENIIT Máster en Criptografía Aplicada Master’s Degree Business School)

Campus Internacional de Ciberseguridad (ENIIT Máster en Seguridad Ofensiva Master’s Degree Business School)

Campus Internacional de Máster en Reversing, Análisis de Ciberseguridad (ENIIT Master’s Degree Malware y Bug Hunting Business School)

Máster Data, Complex Networks & Postgraduate DCNC Sciences Cybersecurity Sciences programme

Escuela Internacional de Máster Alta Especialización en Criminología y Criminalistica Master’s Degree Informática Forense y Cibercrimen (EICYC)

Escuela Internacional de Máster Analista Internacional en Criminología y Criminalistica Master’s Degree Spain Cibercrimen y Ciberdelito (EICYC)

La Salle Campus Barcelona - Postgraduate Master in Cybersecurity Ramon Llull University programme OBS Business School Máster en Ciberseguridad Master’s Degree

Master Universitario en Universidad de La Laguna Ciberseguridad e Inteligencia de Master’s Degree Datos

Master of Research in Universidad de León Master’s Degree Cybersecurity (Online)

Master of Research in Universidad de León Master’s Degree Cybersecurity

Universidad Politécnica de Master Universitario en Master’s Degree Madrid Ciberseguridad

Grado en Ingeniería de la Universidad Rey Juan Carlos Bachelor’s Degree Ciberseguridad

Master's Degree in Computer Universitat Rovira i Virgili Master’s Degree Security and Artificial Intelligence

University of A Coruña / Máster en Ciberseguridad Master’s Degree University of Vigo University of Alcala University Master in Cybersecurity Master’s Degree

University of Castilla-La Master en Ciberseguridad y Master’s Degree Mancha Seguridad de la Información

Postgraduate University of Granada Master Propio en Ciberseguridad programme

ADDRESSING THE EU CYBERSECURITY SKILLS SHORTAGE AND GAP THROUGH HIGHER EDUCATION

Máster Universitario en Seguridad University of Jaén Master’s Degree Informática

Master in Computer Science University of Malaga Master’s Degree (specialisation in Cybersecurity)

Master's Programme in Network Halmstad University Master’s Degree Forensics

Master Programme in Information Luleå University of Technology Master’s Degree Security Sweden

Networks and Systems University of Skövde Bachelor’s Degree Administration

Privacy, Information and Cyber University of Skövde Master’s Degree Security - Master's Programme

Bern University of Applied Digital Forensics & Cyber Master’s Degree Science Investigation

Master of Advanced Studies in Berner Fachhochschule Master’s Degree Cyber Security

ETH Zurich Master in Cyber Security Master’s Degree

Switzerland

Lucerne University of Applied MAS Information & Cyber Security Master’s Degree Sciences and Arts

Lucerne University of Applied Information & Cyber Security Bachelor’s Degree Sciences and Arts

Lucerne University of Applied MAS Information Security & Privacy Master’s Degree Sciences and Arts

-N -EN -468 -21 -09 TP

ABOUT ENIS A

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

ISBN 978-92-9204-540-1 doi: 10.2824/033355