Skip to content

Commit fbbafce

Browse files
SecurityCRobSecurityCRob
authored
Merge pull request #2 from Security-Knowledge-Framework/main
Init Repo for feedback and issue templates
2 parents 5c934ea + f5180d2 commit fbbafce

File tree

7 files changed

+1562
-68
lines changed

7 files changed

+1562
-68
lines changed

‎.github/ISSUE_TEMPLATE/bug_report.yaml

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
name: 🐞 Bug Report
2+
description: File a bug report to help us improve the Global Cybersecurity Skills Framework.
3+
title: "[Bug]: "
4+
labels: [bug]
5+
assignees: []
6+
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thank you for reporting a bug! Please fill out the form below to help us reproduce and fix the issue.
12+
13+
- type: input
14+
id: page
15+
attributes:
16+
label: File or page where the bug occurs
17+
description: Include the file name or path (e.g., `roles/developer.json`)
18+
placeholder: e.g. `roles/developer.json`
19+
validations:
20+
required: true
21+
22+
- type: textarea
23+
id: what-happened
24+
attributes:
25+
label: Describe the bug
26+
description: A clear and concise description of what the bug is.
27+
placeholder: e.g. Wrong skill level listed for 'Incident Response Analyst'
28+
validations:
29+
required: true
30+
31+
- type: textarea
32+
id: expected
33+
attributes:
34+
label: What did you expect to happen?
35+
description: Tell us what the correct behavior should be.
36+
placeholder: I expected to see...
37+
38+
- type: dropdown
39+
id: priority
40+
attributes:
41+
label: Priority
42+
options:
43+
- Low
44+
- Medium
45+
- High
46+
- Critical
47+
description: How urgent is this issue?
48+
validations:
49+
required: false
50+
51+
- type: checkboxes
52+
id: terms
53+
attributes:
54+
label: Code of Conduct
55+
options:
56+
- label: I agree to follow the Linux Foundation Code of Conduct.
57+
58+
59+
required: true

‎.github/ISSUE_TEMPLATE/feature_request.yaml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: ✨ Feature Request
2+
description: Suggest a new feature or improvement to the Global Cybersecurity Skills Framework.
3+
title: "[Feature Request]: "
4+
labels: [enhancement, feature-request]
5+
assignees: []
6+
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thank you for taking the time to suggest a new feature!
12+
Please complete the form below so we can understand and evaluate your proposal.
13+
14+
- type: input
15+
id: feature-title
16+
attributes:
17+
label: Feature Title
18+
description: Short title of the feature or enhancement
19+
placeholder: e.g., Add export-to-MarkDown functionality for filtered job roles
20+
validations:
21+
required: true
22+
23+
- type: textarea
24+
id: feature-description
25+
attributes:
26+
label: Feature Description
27+
description: A clear and concise description of the feature you’d like to see.
28+
placeholder: Explain the feature idea, who it benefits, and what problem it solves.
29+
validations:
30+
required: true
31+
32+
- type: textarea
33+
id: motivation
34+
attributes:
35+
label: Why is this feature important?
36+
description: Describe the use case or scenario where this feature would be valuable.
37+
placeholder: e.g., Educators want to export specific job roles with associated skills to create learning pathways.
38+
39+
- type: textarea
40+
id: proposed-solution
41+
attributes:
42+
label: Proposed Solution (optional)
43+
description: If you have an idea on how to implement it, describe it here.
44+
placeholder: e.g., Add a download button in the web UI using existing filtered dataset
45+
46+
- type: checkboxes
47+
id: alternatives
48+
attributes:
49+
label: Have you considered any alternatives?
50+
options:
51+
- label: I’ve considered other approaches and this seems like the best option.
52+
- label: I’m open to other suggestions or implementations.
53+
54+
- type: checkboxes
55+
id: consent
56+
attributes:
57+
label: Contributor Agreement
58+
options:
59+
- label: I agree to follow the Linux Foundation Code of Conduct.
60+
required: true

‎.github/ISSUE_TEMPLATE/role_feedback.yaml

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: 🧠 Role Feedback
2+
description: Suggest a change or improvement to a job role or its skill mapping in the framework.
3+
title: "[Role Feedback]: "
4+
labels: [role-feedback, enhancement]
5+
assignees: []
6+
7+
body:
8+
- type: markdown
9+
attributes:
10+
value: |
11+
Thank you for contributing to the Global Cybersecurity Skills Framework!
12+
Use this form to propose changes or enhancements to a role definition, skill mapping, or proficiency level.
13+
14+
- type: input
15+
id: role-name
16+
attributes:
17+
label: Role Name
18+
description: The job role this feedback applies to.
19+
placeholder: e.g., Application Security Engineer
20+
validations:
21+
required: true
22+
23+
- type: dropdown
24+
id: change-type
25+
attributes:
26+
label: What type of feedback is this?
27+
options:
28+
- Add a new role
29+
- Change skill level
30+
- Modify task or responsibility
31+
- Correct mapping to external standard (e.g., NICE, DoD 8140, e-CF)
32+
- Other
33+
validations:
34+
required: true
35+
36+
- type: textarea
37+
id: description
38+
attributes:
39+
label: Describe the change
40+
description: Clearly explain your suggested change and the reason behind it.
41+
placeholder: Please describe what you would like to change and why.
42+
validations:
43+
required: true
44+
45+
- type: textarea
46+
id: references
47+
attributes:
48+
label: References or Standards (if any)
49+
description: Link to any relevant frameworks, standards, job descriptions, or authoritative sources.
50+
placeholder: e.g., NICE Work Role ID SP-DEV-002, NIST SP 800-181r1, LinkedIn job post
51+
52+
- type: checkboxes
53+
id: consent
54+
attributes:
55+
label: Contributor Agreement
56+
options:
57+
- label: I agree to follow the Linux Foundation Code of Conduct.
58+
required: true

‎CONTRIBUTING.md

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
# Contributing to the Cybersecurity Skills Framework
2+
3+
Thank you for your interest in contributing to the Cybersecurity Skills Framework! This project is part of the Open Source Security Foundation (OpenSSF) and follows the Linux Foundation's community standards.
4+
5+
## Ways to Contribute
6+
7+
We welcome contributions of all kinds, including:
8+
9+
- Proposing or refining job role definitions
10+
- Suggesting improvements to skill descriptions
11+
- Translating or localizing the framework
12+
- Contributing UI/UX enhancements or bug fixes
13+
- Creating educational resources or mappings to standards
14+
- Opening issues and participating in discussions
15+
16+
## Getting Started
17+
18+
1. **Fork the Repository**
19+
- Navigate to the [GitHub repository](https://github.com/ossf/cybersecurity-skills-framework)
20+
- Click on the "Fork" button
21+
22+
2. **Clone Your Fork**
23+
```
24+
git clone https://github.com/your-username/cybersecurity-skills-framework.git
25+
cd cybersecurity-skills-framework
26+
```
27+
28+
3. **Create a Branch**
29+
```
30+
git checkout -b my-feature-branch
31+
```
32+
33+
Make Changes & Commit
34+
```
35+
git commit -am "Add my contribution"
36+
```
37+
38+
Push & Open a Pull Request
39+
```
40+
git push origin my-feature-branch
41+
```
42+
43+
Then go to GitHub and open a new pull request.
44+
45+
4. **Filing Issues**
46+
47+
If you find a bug or have an idea, please open an issue and provide as much detail as possible.
48+
- Clearly describe the problem or enhancement
49+
- Include screenshots, examples, or standards if relevant
50+
- Propose a solution if you have one
51+
52+
5. **Code of Conduct**
53+
54+
All contributors are expected to follow the Linux Foundation Code of Conduct.
55+
56+
6. **License**
57+
58+
By contributing, you agree that your contributions will be licensed under:
59+
- Apache License 2.0 for software
60+
- CDLA for data
61+
- Creative Commons Attribution 4.0 for documentation

‎LICENSE

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@
186186
same "printed page" as the copyright notice for easier
187187
identification within third-party archives.
188188

189-
Copyright [yyyy] [name of copyright owner]
189+
Copyright 2025 Linux Foundation
190190

191191
Licensed under the Apache License, Version 2.0 (the "License");
192192
you may not use this file except in compliance with the License.

‎README.md

Lines changed: 39 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -1,101 +1,73 @@
1-
# **OSSF Project/WG Name**
2-
3-
[Brief description of the initiative]
1+
# **Cybersecurity Skills Framework**
42

3+
A free, open, and customizable web-based tool developed by the Open Source Security Foundation (OpenSSF) and the Linux Foundation to help organizations assess and build cybersecurity skills across various IT roles. The framework provides skill mapping for 14 job families at different experience levels and aligns with industry standards like NIST NICE, DoD 8140, and ICT e-CF.
54

65
##
76
**Motivation**
87

9-
[Background / use cases of the problem to be solved]
10-
11-
12-
##
13-
**Objective**
14-
15-
[What is to be achieved with this initiative]
16-
17-
[OKRs - OPTIONAL]
8+
Today’s organizations face an urgent need to build cybersecurity capacity across their software, DevOps, operations, and GRC teams. However, most frameworks are overly complex, vendor-driven, or narrowly scoped.
189

10+
This initiative addresses the need for a simplified, practical, and open cybersecurity skills framework that is:
1911

20-
##
21-
**Scope**
22-
23-
[What is in and out of scope]
24-
25-
26-
##
27-
**Prior Work**
28-
12+
- Role-based and job family-oriented
13+
- Lightweight and customizable
14+
- Mapped to real-world proficiencies and responsibilities
15+
- Open source and vendor-neutral
2916

17+
Use cases include:
3018

31-
* List of prior and/or related projects
19+
- Building internal security career paths
20+
- Mapping workforce training needs
21+
- Conducting cybersecurity skills assessments
22+
- Bridging the gap between HR, team leads, and technical staff
3223

3324
##
34-
**Active Projects**
25+
**Objective**
3526

36-
[Optional]
27+
To provide an open-source, extensible cybersecurity skills framework that:
3728

38-
##
39-
**Inactive Projects**
29+
- Defines clear roles and responsibilities across 14 job families
30+
- Maps each role to foundational, intermediate, and advanced skill levels
31+
- Aligns with common cybersecurity standards and frameworks
32+
- Encourages adoption across enterprises, education, and governments
4033

41-
[Optional]
4234

4335
#
44-
**Get Involved**
45-
46-
* Official communications occur on the [ADD LINK TO YOUR WG MAILING LIST] (ex: https://lists.openssf.org/g/openssf-tac/topics). \
47-
[Manage your subscriptions to Open SSF mailing lists](https://lists.openssf.org/g/main/subgroups).
48-
* [Add Slack information if availabable]
49-
50-
##
51-
52-
36+
**Get Involved / Quick Start**
5337
###
54-
**Quick Start**
5538

56-
* Areas that need contributions
57-
* Build information if applicable
58-
* Where to file issues
59-
* Etc.
60-
61-
##
62-
**Meeting times**
63-
64-
[TODO: Update with your WG meeting details]
65-
* Every other Tuesday @ 10:00am PST (Link to calendar invite)
66-
* [Meeting Minutes](https://docs.google.com/document/d/1uXQI1vI5_HyOvxHMexrnTY_ruBrynbPl5yOd1UM4g3A/edit#heading=h.yworp6sxzb6g)
39+
* Areas that need contributions:
40+
- New job role definitions
41+
- Skill description refinements
42+
- Translations and localization
43+
- UI/UX suggestions
44+
* Contributing instructions: See [`CONTRIBUTING.md`](./CONTRIBUTING.md)
45+
* File issues or suggestions on [GitHub Issues](https://github.com/ossf/cybersecurity-skills-framework/issues)
6746

6847
#
6948
**Governance**
7049

71-
[TODO: Update this link to your specific CHARTER.md file]
72-
The [CHARTER.md](https://github.com/ossf/project-template/blob/main/CHARTER.md) outlines the scope and governance of our group activities.
50+
The [CHARTER.md](./CHARTER.md) outlines the scope and governance of our group activities.
7351

74-
75-
[OPTIONAL]
76-
* Lead name
77-
* Co-Lead name
52+
* Lead: Glenn ten Cate ([email protected])
53+
* Co-Lead: Christopher Robinson ([email protected])
7854

7955
#
8056
**Intellectual Property**
8157

8258
In accordance with the [OpenSSF Charter (PDF)](https://charter.openssf.org/), work produced by this group is licensed as follows:
8359

84-
[TODO: Select below the applicable license(s), delete those that don't apply, and update the LICENSE file accordingly. For specification development refer to the specific instructions on the [Community Specification Getting Started page](https://github.com/CommunitySpecification/1.0/blob/main/..Getting%20Started.md).
85-
86-
Note that for source code, instead of Apache, you may choose to use the MIT License available at https://opensource.org/licenses/MIT. Otherwise, no other license than those listed here may be used without approval from the Governing Board.]
87-
88-
1. Software source code
89-
* Apache License, Version 2.0, available at https://www.apache.org/licenses/LICENSE-2.0;
90-
2. Data
91-
* Any of the Community Data License Agreements, available at https://www.cdla.io;
92-
3. Specifications
93-
* Community Specification License, Version 1.0, available at https://github.com/CommunitySpecification/1.0
94-
4. All other Documentation
95-
* Creative Commons Attribution 4.0 International License, available at https://creativecommons.org/licenses/by/4.0/
60+
1. Software source code
61+
* Apache License, Version 2.0, available at https://www.apache.org/licenses/LICENSE-2.0
62+
2. Data
63+
* Any of the Community Data License Agreements, available at https://www.cdla.io
64+
3. Specifications
65+
* Community Specification License, Version 1.0, available at https://github.com/CommunitySpecification/1.0
66+
4. All other Documentation
67+
* Creative Commons Attribution 4.0 International License, available at https://creativecommons.org/licenses/by/4.0/
9668

9769
**Antitrust Policy Notice**
9870

9971
Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws.
10072

101-
Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at http://www.linuxfoundation.org/antitrust-policy. If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.
73+
Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at http://www.linuxfoundation.org/antitrust-policy. If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.

0 commit comments

Comments
 (0)