The Linux Foundation and Open Source Security Foundation (OpenSSF) have announced the Cybersecurity Skills Framework, designed to help organizations identify their security competencies across several areas that are important to reducing cybersecurity risk.
“This framework is a valuable tool for CIOs, CISOs, and enterprise learning teams,” said Clyde Seepersad, SVP and general manager of Linux Foundation Education. “In an era of accelerating threats, leaders need clear pathways for strengthening security culture across technical teams. This resource helps organizations take a proactive approach to employee development and risk reduction.”
The framework incorporates skills like adhering to security guidelines, knowledge of relevant regulations (ex., GDPR and HIPAA), incident response, proficiency in using security tools and methodologies, and risk management. The skills are divided up into basic, intermediate, and advanced categories.
It provides guidance specific to different IT roles, such as web and software developers, DevOps engineers, IT project managers, platform architects, GRC managers, and more. The roles are defined based on their primary cybersecurity responsibilities and specific skills that go along with those.
The Cybersecurity Skills Framework is customizable, allowing organizations to select the job families that exist within their company and add or remove skills.
“Cybersecurity is now a leadership issue, not just a technical one,” said Steve Fernandez, general manager at OpenSSF. “Our framework gives organizations a straightforward way to identify gaps and prioritize the security skills that matter most, based on role and responsibility—not just checklists. It’s about building real-world resilience.”
