CYBRARY Coverage you can put in a budget request
Practice that already speaks the language your program is measured in
Every lab in Forge carries its NIST CSF function, its NICE work roles, its DoD cyber workforce role and proficiency level and its ATT&CK techniques. Progress reports come out in those terms, so workforce qualification and detection coverage are read from what your people actually did rather than assembled by hand at review time.
NIST CSF 2.0
NIST CSWP 29 — six functions, twenty-two categories.
- GV Govern
Strategy, policy, roles and oversight for cyber risk.
- ID Identify
Understand assets, risk and where the exposure sits.
- PR Protect
Safeguards that reduce the chance and blast radius.
- DE Detect
Find and analyze adverse events as they happen.
- RS Respond
Contain, analyze, communicate and mitigate an incident.
- RC Recover
Restore the assets and operations the incident disrupted.
NICE Framework
NIST SP 800-181 Rev. 1, components v2.2.0 — 5 work-role categories, 42 work roles referenced.
- PD Protection and Defense
Identify, analyze and respond to threats against internal systems and networks.
7 work roles mapped onto Forge practice.
- IN Investigation
Investigate cybersecurity events and crimes, and handle digital evidence.
2 work roles mapped onto Forge practice.
- IO Implementation and Operation
Deploy, administer and maintain the systems and networks that carry the mission.
7 work roles mapped onto Forge practice.
- OG Oversight and Governance
Lead, manage, advise and assure the cybersecurity program.
17 work roles mapped onto Forge practice.
- DD Design and Development
Research, design, develop and test secure technology and architecture.
9 work roles mapped onto Forge practice.
DoD Cyber Workforce Framework
The role vocabulary DoDD 8140.01 qualifies against — 71 roles across 7 workforce elements.
- Basic
Applies basic concepts in routine, structured work with frequent specific guidance.
- Intermediate
Works non-routine situations with only periodic high-level guidance.
- Advanced
Works with little or no guidance and can direct others in the role.
MITRE ATT&CK and D3FEND
Attacker techniques and defensive countermeasures, attached to labs and to every detection the range raises.
Each graded case names the technique it exercises, and the live SOC screen shows the technique behind every detection the estate raises — so coverage is counted from runs rather than claimed from a catalog. Defensive countermeasures are mapped alongside, which is what turns a red-team map into a blue-team plan.
IEC 62443 — zones, conduits and foundational requirements
IEC 62443-3-2 zone and conduit design, 62443-3-3 system requirements and security levels SL 1 to SL 4.
The simulated plant is built to a zone model, not decorated with one. Learners work across the Purdue levels with real control traffic between them, and the shift is scored on the safe response: containment that would blind the control room loses marks, because in a plant availability outranks a clean IT answer.
Z-SAFETY · Purdue L0, L1
Safety controller and its interlocks, on its own conduit and never routed.
An attacker with ICS-specific skills, tools and moderate resources.
Z-CONTROL · Purdue L1, L2
PLC-201 and PLC-204, HMI-110, the serial gateway GW-260.
An attacker with ICS-specific skills, tools and moderate resources.
Z-OPS · Purdue L3
HIST-320 process historian, batch records, the engineering workstation.
A low-skill attacker with generic tools and low motivation.
Z-DMZ · Purdue L3.5
Replicated historian, jump host, patch staging — the only way in from business IT.
A low-skill attacker with generic tools and low motivation.
Z-ENTERPRISE · Purdue L4
Corporate IT. Treated as untrusted by everything below it.
Protection against accidental misuse.
Conduits the estate enforces
- C-01 Z-CONTROL → Z-OPSHistorian collection, read-only, one direction.Watched for: A write function code arriving from the historian's address.
- C-02 Z-OPS → Z-DMZHistorian replication and batch-record export.Watched for: Volume or destinations the historian has never used before.
- C-03 Z-DMZ → Z-ENTERPRISEBrokered reads from the replica only. No session reaches the plant.Watched for: Any flow that terminates below the DMZ.
- C-04 Z-CONTROL → Z-SAFETYNothing. The safety system is monitored, never commanded.Watched for: Any packet at all.
What a learner is graded on, requirement by requirement
- FR1 Identification and authentication control
Every human, device and software process on the control network is identified.
Graded in: An unlisted host writing coils on the line; An engineering laptop bridging business IT into the line.
- FR2 Use control
Identified users and devices may only do what their role permits, and it is logged.
Graded in: An unlisted host writing coils on the line.
- FR3 System integrity
Control logic, firmware and process data are not altered without being noticed.
Graded in: A setpoint written by something that should only read; A serial gateway answering for a controller that is gone; A safety interlock held in the forced state.
- FR4 Data confidentiality
Recipes, batch records and process data stay inside the zone that owns them.
Graded in: Batch records leaving overnight.
- FR5 Restricted data flow
Zones are segmented and traffic crosses only through declared conduits.
Graded in: An unlisted host writing coils on the line; Batch records leaving overnight; An engineering laptop bridging business IT into the line; The plant shift itself.
- FR6 Timely response to events
The plant notices a security event and responds without losing the process.
Graded in: Batch records leaving overnight; A setpoint written by something that should only read; The plant shift itself.
- FR7 Resource availability
Control keeps running — availability outranks a clean IT containment.
Graded in: An unlisted host writing coils on the line; A serial gateway answering for a controller that is gone; A safety interlock held in the forced state; The plant shift itself.
Framework names, role identifiers and requirement numbers are used as published by NIST, the Department of Defense, the IEC and MITRE. The mapping between them and Forge content is ours, offered to help you plan; it is not an accreditation, a certification or a conformity assessment, and no authority has reviewed it.