  A cyber security organisation needs to ensure that its workforce possesses
the necessary knowledge to fulfil its cyber security business functions.
Similarly, where an organisation chooses to delegate their cyber security tasks
to a third party provider, they must ensure that the chosen entity possesses
robust knowledge capabilities to effectively carry out the assigned tasks.
Building a comprehensive cyber security knowledge profile is a distinct
challenge; the field is ever evolving with a range of professional
certifications, academic qualifications and on-the-job training. So far, there
has been a lack of a well-defined methodology for systematically evaluating an
organisation's cyber security knowledge, specifically derived from its
workforce, against a standardised reference point. Prior research on knowledge
profiling across various disciplines has predominantly utilised established
frameworks such as SWEBOK. However, within the domain of cyber security, the
absence of a standardised reference point is notable. In this paper, we advance
a framework leveraging CyBOK, to construct an organisation's knowledge profile.
The framework enables a user to identify areas of coverage and where gaps may
lie, so that an organisation can consider targeted recruitment or training or,
where such expertise may be outsourced, drawing in knowledge capability from
third parties. In the latter case, the framework can also be used as a basis
for assessing the knowledge capability of such a third party. We present the
knowledge profiling framework, discussing three case studies in organisational
teams underpinning its initial development, followed by its refinement through
workshops with cyber security practitioners.
