UPDATES ON THE SAUDI CYBERSECURITY HIGHER EDUCATION FRAMEWORK

As per the mandate of the National Cybersecurity Authority (NCA) that was issued by the Royal Order number 6801, dated October 31, 2017, the NCA is mandated to build the national cybersecurity workforce; to participate in developing education and training programs; to prepare professional standards and frameworks; and to develop and run professional assessment tests related to cybersecurity. Therefore, due to the importance of developing national high-quality academic programs in cybersecurity, the NCA has developed the “Saudi Cybersecurity Higher Education Framework (SCyber-Edu)" to serve as a guide for developing, evaluating, and accrediting cybersecurity higher education programs. This framework was developed by the NCA in cooperation and coordination with the Ministry of Education and the Education and Training Evaluation Commission.

   This framework contributes to setting the minimum curriculum requirements of cybersecurity higher education programs to assure their academic quality. The goal of this framework is to ensure that higher education programs in Saudi Arabia develop highly qualified cybersecurity professionals who can join and enrich the national cybersecurity workforce and contribute to the national efforts towards “A resilient, secure and trusted Saudi cyberspace that enables growth and prosperity".

   SCyber-Edu is designed in alignment with the Unified Saudi Classification for Educational Levels and Specializations, the National Qualifications Framework (NQF), and the guidelines of the National Center for Academic Accreditation and Evaluation.​

This framework covers the following higher education degree programs in cybersecurity:

1.           Intermediate Diploma

2.           Bachelor

3.           Higher Diploma

4.           Master

5.           Doctoral

The framework can be used and applied to cybersecurity degree programs offered by public and private post-secondary educational institutions in Saudi Arabia.

It is important to note that the Associate Diploma is not covered in this framework. This exclusion is based on the requirements of the Saudi Cybersecurity Workforce Framework- Career Progression (SCyWF-CP 1.0), which establishes the Intermediate Diploma as the minimum educational requirement for any cybersecurity job roles. By this alignment, the NCA ensures that graduates possess the necessary depth of technical competency and knowledge to effectively secure the national cyberspace.

Since cybersecurity is a highly dynamic discipline, the curriculum requirements in this framework will be reviewed and updated periodically to maintain relevance with emerging threats and international standards.​

Even though the field of cybersecurity is still evolving as compared to other well-established fields such as computer science, several international frameworks for cybersecurity education have been recently developed to ensure the quality of cybersecurity education programs. These include the framework of the National Centers of Academic Excellence in Cyber Defense (CAE-CD) Program^[1], ABET Criteria for Accrediting Cybersecurity and Similarly Named Computing Programs, IEEE/ACM Cybersecurity Curricula, and the framework of the NCSC-certified Higher Education Program^[2]. These frameworks have major commonalities. These international frameworks have been studied to define the methodology for preparing the Saudi Cybersecurity Higher Education Framework by setting the minimum curriculum requirements for each degree program in cybersecurity in terms of Program Descriptors (PD), through which Program Learning Outcomes can be derived, and Knowledge Units (KUs) that students need to study in the program. As mentioned earlier, the SCyber-Edu is compatible with the Unified Saudi Classification for Educational Levels and Specializations, the National Qualifications Framework (NQF) and the guidelines of the National Center for Academic Accreditation and Evaluation.

The PDs correspond to NQF Level Descriptors which help academic organizations design the Program Learning Outcomes (PLOs) that comprise a set of knowledge, skills and values which graduates are expected to obtain upon completion of the program. The SCyber-Edu is intended to contribute to setting the minimum PDs that need to be considered in writing the PLOs for each degree program. However, an educational institution can add additional PLOs to its cybersecurity programs.

The KUs are thematic groupings that encompass multiple related topics; where the topics cover the required curricular content for each KU. Each KU contains a set of learning outcomes. The KU-specific learning outcomes specify the minimum of what students should know or be able to do after successfully completing the KU. It is important for educational institutions to take into account the depth, expansion and progression of these learning outcomes to suit the level of the program; and to include learning outcomes related to communication skills and values in the curricula.

The SCyber-Edu sets the minimum core KUs that must be covered by the program and provides a list of elective KUs. Educational institutions can offer the desired elective KUs that are relevant to their programs and students can choose from them to complete their graduation requirements. It is important to note that a KU is not necessarily a credit course. A KU may be covered by one or more credit courses and a credit course may cover one or more KUs partially or completely.

For the bachelor's and master's degrees, this framework differentiates between a cybersecurity major degree program and an IT related major degree program with a cybersecurity track within the program.

The KUs are derived from the following sources:

• National Centers of Academic Excellence in Cybersecurity (NCAE-C) – Cyber Defense (CAE-CD) Knowledge Units (KUs) 2024.
• CyBOK, The Cyber Security Body of Knowledge (Version 1.1.0), 2021.
• The IEEE/ACM Cybersecurity Curricula 2017.
• The IEEE/ACM Computer Science Curricula 2023.
  
  The necessary additions and modifications were made to meet the national needs in this field; and to comply with the relevant frameworks in the Kingdom.
  
  For each degree program, SCyber-Edu sets three types of requirements:

1. Admission Requirements: A list of requirements that need to be met prior to admitting a student into the program.
2. Core KUs: Mandatory KUs that a student must complete as part of the graduation requirements.
3. Elective KUs: A list of elective KUs that an educational institution and/or a student can choose from. A minimum number of these elective KUs must be completed as part of the graduation requirements. In specialized cybersecurity programs, the elective KUs must be directly related to the program's name or title.​
   

Some KUs are considered to be prerequisites for other KUs. It is requested that such dependencies are reflected properly in the program of study.

Furthermore, there is a foundational connection between mathematics and many cybersecurity areas; and most undergraduate cybersecurity programs require some foundational mathematics knowledge units. However, the mathematics knowledge units required for a particular program depend heavily on the nature and focus of that program. Therefore, post-secondary educational institutions offering undergraduate programs in cybersecurity are requested to include mathematics knowledge units that are relevant to their programs and that properly meet the prerequisites of the cybersecurity knowledge units in their programs.​

The rest of this document is organized as follows. Section 2 presents the covered cybersecurity programs along with their targeted PDs and KUs requirements. Section 3 describes the details of all KUs. Furthermore, Appendix (A) presents examples of specialized cybersecurity programs, and Appendix (B) summarizes the update of this version.

​​For the Programs, please refere to the attached document.