Partcertification in the professional field of Information Security

The project “Partial Certification in the Vocational Field of Information Security” (“Teilzertifizierung im Berufsfeld Informationssicherheit – TeBeISi”) describes the validation and certification of competences in the field of information security with a special focus on the requirements of Small and Medium-sized Enterprises (SME) and social skills. The project contributed to the promotion of validation of prior learning practices, considering informal and nonformal learning also in reference to European transparency instruments. The validation of information security competences has been identified as a valuable tool to increase the access to qualified employees in the sub-sector of the information security labour market, in which SMEs in particular are confronted with a great challenge of hiring skilled workers and meeting their individual requirements. Through new training and further education options, the project created viable pathways in the project partner countries Italy, Germany, Poland, Austria, and Lithuania for the identification of suitable employees and correspondingly new options for training to meet the needs of SMEs.To make existing competences visible, the TeBeISi project analysed existing occupational profiles in the fields of information security and conducted a qualitative (focus groups and expert interviews with 20 experts from each country) and quantitative research (with 155 experts in total) on needed knowledge and skills in SME environment. The project target around 550 stakeholders in the course of activity implementation. As a result, the project mapped competence units necessary to perform information security related tasks in SMEs under the umbrella profile “Information Security and Data Protection Officer for SME” (Output 1). Building on these findings and the developed profile, national adaption plans for each partner country were developed to gather information on national educational contexts important for an information security curriculum on the TeBeISi topics Results were discussed with national information security and educational experts (Output 2). Upon information collection and analysis (quantitative studies on competence requirements among practitioners and SMEs in all participating countries), the core results of the project have been developed: The self-assessment tool (Output 3) and the corresponding curriculum matching the developed profile (Output 4). The curriculum supports the capacity building among vocational education and training programmes as well as offering additional certification possibilities for students in higher education. This was done with the scope to include competences located on an EQF 5 level to bridge the gap between theoretically required knowledge (e.g., GDPR) and practice-oriented skills. Following the stated needs of SMEs to find and qualify new and existing employees, a digital self-assessment tool has been developed. The tool allows the self-identification regarding the suitability to take over information security related tasks in SMEs based on personal characteristics and pre-existing competences in the field of information security. Based on the findings from the research as well as the developed curriculum and analysis tools, a report has been drafted to lay out the role of employees in the process of establishing information security in SMEs and the strategic necessity and possibility to support SMEs via systematic changes in the educational pathways of different worker groups (Output 5). Finally, a research report was drafted to provide and contextualize all background data which have been collected and analysed in the preparation of the curriculum and the analysis tool (Output 6).The outputs developed strongly focused on the needs of SMEs, which are unable to compete financially in the battle for skilled employees in the field of information security with larger corporations. The developed solutions contribute on a micro-level in the SME, by providing assistance in identifying the skills needed and selecting qualified workers among the existing workforces. On a systemic level, the project laid out a pathway to include information security related skills in educational programmes, which becomes relevant also in the context of educating sovereign citizenship. The project thereby involved institutional stakeholders like training providers and educational institutions, chambers of commerce and expert networks in the partner countries. Based on the projects results - to intensify awareness rising and informative campaigning among the European public and to thereby strengthen the general availability of skilled workers- a circle of experts has been founded (“European Council on Cyber Security, Privacy, and Risk Management”), which continues the suggested pathway of the TeBeISi project to bring security sensitive and basic adherence to safety principles in the digital realm to SMEs and the general public.