TRAINING, DEVELOPMENT, AND CERTIFICATION FRAMEWORK

Certification Matrix · Development Curriculum · Budget Guidance · Cross-Training

Table of Contents

1. Purpose and Scope
2. Training Philosophy
3. Certification Matrix: Required, Recommended, and Aspirational
4. Training Curriculum by Competency Domain
5. Cross-Training: The 5% Rule
6. Professional Development Budget
7. Conference and External Engagement
8. Training Administration
9. Document Control

1. Purpose and Scope

Cybersecurity skills have a half-life measured in months, not years. A Detection Engineer whose knowledge stops advancing writes rules for last year’s threats. A Cloud Security Engineer who does not track platform evolution reviews architectures against a mental model that is already obsolete. A NERC-CIP Compliance Manager who does not monitor regulatory developments discovers a new requirement when the auditor cites it.

The Job Descriptions (JD-001) list relevant certifications per role. They do not define which are required, which are recommended, who pays, or how certification connects to progression. The Competency Model (CMP-001) defines what good looks like at each grade. It does not define the path to get there. This document closes both gaps.

It provides a role-to-certification matrix with three tiers (required, recommended, aspirational) per role and grade, a training curriculum mapped to CMP-001 competency domains, a cross-training standard that operationalizes the left-right knowledge model into a measurable time commitment, a professional development budget guideline, and conference and external engagement expectations.

It applies to every CERG team member. Certifications are role-dependent; the training philosophy, cross-training expectation, and budget guidelines are universal.

Training Is an Investment, Not a Perk

An organization that treats training as a reward for good performance is sending a signal that capability development is optional. An organization that treats training as a recurring operational expense, budgeted, tracked, and expected, is building a team that gets better every quarter. The first organization loses its best people to the second.

2. Training Philosophy

1. Development is a shared responsibility. The organization provides the budget, the time, and the curriculum. The individual provides the effort, the curiosity, and the follow-through. Neither party can succeed without the other.

2. Certifications validate, they do not replace. A certification confirms that a person has demonstrated a body of knowledge at a point in time. It does not confirm that they apply it effectively in their role. Certifications are useful for hiring credibility, regulatory compliance, and structured learning. They are not a substitute for demonstrated competency.

3. Training closes the gap between current and target. Every development activity should connect to a gap identified in the person’s performance review (PERF-001) or their self-assessment against the competency model (CMP-001). “I want to learn Kubernetes security” is a valid interest. “I need to learn Kubernetes security because my next-grade competency anchor requires architecture reviews of containerized workloads” is a development plan.

4. Cross-training is not optional. The left-right knowledge model (FRM-001 §9.2) depends on every CERG team member understanding the other two pillars well enough to collaborate effectively. Cross-training is a standing expectation, not a discretionary activity.

5. Knowledge shared is knowledge multiplied. If the organization sends a person to a conference, a training course, or a certification boot camp, that person presents what they learned to the team. The organization’s return on the training investment includes not just one person’s capability gain but the team’s.

3. Certification Matrix: Required, Recommended, and Aspirational

3.1 Certification Tiers

NICE Mapping: The NICE Work Role(s) associated with each certification are documented in JF-002. Each certification row below supports the NICE Work Role mapping for the corresponding CERG role. See the individual per-role JD documents for role-specific NICE TKS statement references.

3.2 Engineering Pillar: Certification Matrix

Cloud Security Engineer

Identity Engineer

OT Security Engineer

Application Security Engineer

Endpoint Engineer

Cryptography Engineer

3.3 Risk Pillar: Certification Matrix

Exposure Management Lead

Adversarial Testing Lead

Threat Intelligence Analyst

Vendor Risk Analyst

Detection Engineer

OT Risk Analyst

Identity Risk Analyst

3.4 Governance Pillar: Certification Matrix

NERC-CIP Compliance Manager

CMMC / Federal Compliance Manager

SOX ITGC Lead

Policy & Standards Manager

Risk Register Owner

Evidence Librarian

3.5 Management Track Certification Addendum

CERG managers add the following to their home role family’s certification matrix:

Certification Is a Floor, Not a Ceiling

A person who holds every Aspirational certification for their role and grade is not required to stop pursuing credentials. The tiers represent what the organization commits to supporting. Beyond the Aspirational tier, the individual and their manager make the case for organizational support based on relevance to the person’s development plan and the organization’s needs.

4. Training Curriculum by Competency Domain

4.1 How the Curriculum Works

The training curriculum is organized by CMP-001 competency domain. For each domain, specific training resources, courses, and experiences are recommended at three levels aligned to CERG grades:

• Foundational (S1-S2): Builds the base of competence
• Intermediate (S2-S3): Deepens capability and adds breadth
• Advanced (S3-S4): Develops organizational-level expertise

A person’s development plan (PERF-001) identifies which domains and which level are the priority for the current review period. The curriculum provides the resources. The manager and the individual select the specific courses and experiences.

4.2 Technical Depth

4.3 Cross-Pillar Fluency

4.4 Risk Judgment

4.5 Communication

4.6 Operational Discipline

4.7 Compliance and Regulatory Literacy

4.8 Continuous Learning

5. Cross-Training: The 5% Rule

5.1 The Standard

Every CERG team member is expected to spend at least 5% of their working time on cross-pillar learning and engagement. For a full-time team member, this is approximately:

• 2 hours per week, or
• One day per month, or
• Two weeks per year

This is a performance expectation, not a suggestion. A person who has not engaged with the other two pillars in a quarter should be asked why during their quarterly check-in.

5.2 What Counts

Acceptable cross-training activities include:

• Cross-pillar rotation days beyond the onboarding program (ONB-001 §9)
• Participating in cross-pillar working groups or projects
• Attending standing meetings of another pillar (as an observer-contributor)
• Shadowing a senior practitioner in another pillar for a specific activity
• Reading and providing feedback on a draft standard or procedure from another pillar
• Jointly investigating a cross-pillar incident or finding
• Teaching a brown-bag session on a topic relevant to another pillar
• Self-directed study of another pillar’s tools, frameworks, or methods

5.3 Tracking

The OM-001 §10.4 cross-training log captures cross-training activities. Managers review the log during quarterly check-ins. The log does not need to be granular (it is not a timesheet). It needs to answer: in the last quarter, what did this person do to understand the other two pillars better?

The 5% Rule Is a Minimum, Not a Cap

An Advisor who spends 10% of their time on cross-pillar work because they are leading a cross-pillar initiative is not violating the rule; they are demonstrating advanced Cross-Pillar Fluency. The 5% floor is for team members who are not naturally pulled into cross-pillar work through their role. It ensures that cross-pillar understanding does not become a privilege of seniority.

6. Professional Development Budget

6.1 Per-Person Allocation

CERG organizations should budget an annual per-person professional development allocation. The recommended baseline, adjusted for organizational size and budget, is:

6.2 What the Budget Covers

The professional development budget covers:

6.3 Budget Administration

• The budget is per person, not per team. A manager cannot reallocate a departing team member’s unspent budget to a conference trip for themselves.
• Unspent budget does not roll over. The annual cycle encourages regular development activity, not end-of-year spending sprees.
• Budget requests beyond the annual allocation require a business case: what will the person learn, how does it connect to their development plan, and what is the expected organizational benefit?

7. Conference and External Engagement

7.1 Conference Attendance Criteria

The organization supports conference attendance when:

1. The conference content is directly relevant to the person’s role or development priorities.
2. The person commits to presenting what they learned to the team within two weeks of returning (a 30-minute brown-bag session, a written summary, or an internal training module).
3. Conference attendance is distributed fairly across the team. The same person attending three conferences while a peer attends none is a signal that the team’s development investment is not equitable.

7.2 Priority Conferences by Role Family

7.3 External Engagement Expectations

At the Advisor (S3) level and above, external engagement is an expectation, not a perk:

External Engagement Is Recruitment

A Sr. Advisor who presents at RSA, contributes to a NIST working group, and is known in their sector’s threat-sharing community is not just developing themselves. They are making the organization visible as a place where serious cybersecurity practitioners work. A candidate who researches the organization and finds its engineers presenting at conferences is more likely to apply than one who finds no public presence at all. External engagement is part of the employer brand strategy.

8. Training Administration

8.1 Individual Development Plan

Each team member maintains an Individual Development Plan (IDP) as part of their performance record (PERF-001 §9). The IDP is updated semi-annually and contains:

• 2-3 development priorities for the current review period, each mapped to a CMP-001 competency domain
• Specific training activities, certifications, or experiences planned to address each priority
• Timeline and estimated cost
• Status tracking (planned, in progress, completed)

8.2 Team Training Calendar

Each pillar leader maintains a team training calendar that:

• Tracks certification expirations and renewal deadlines
• Schedules internal knowledge-sharing sessions (brown-bag presentations, tool training, cross-pillar briefings)
• Coordinates conference attendance to avoid staffing gaps
• Identifies team-wide training needs (e.g., a new regulatory framework everyone needs to understand)

8.3 Training Record

The organization maintains a training record for each team member as part of their HR file. The record documents:

• Certifications held, with issue and expiration dates
• Formal training courses completed
• Conference attendance
• Internal training delivered (the person teaching counts as development activity)

The record supports regulatory compliance (NERC-CIP CIP-004 requires documented training for personnel with access to BES Cyber Systems; CMMC requires documented role-based training) and provides the evidence base for promotion cases that reference certification achievements.

9. Document Control

Revision History

Review Triggers

• Material change to certification requirements by certifying bodies (ISC2, ISACA, SANS, CompTIA)
• Material change to the competency model (CMP-001)
• New roles added to the canonical roster (OM-001 §6.1)
• Regulatory changes affecting personnel training requirements (NERC-CIP CIP-004, CMMC, etc.)
• Feedback from performance reviews indicating training curriculum gaps
• Direction from the CISO

Related Documents

Governance owns this document. The Governance Pillar Leader (Policy & Standards) is responsible for initiating reviews, managing the revision cycle, and obtaining CISO endorsement for all changes.

Source: governance/CERG-GOV-TRN-001_Training_Development_and_Certification_Framework.md · Download .md · View on GitHub