Certified Master s in Cyber Security. Certification of Master s Degrees Providing a General, Broad Foundation in Cyber Security

Transcription

1 Certified Master s in Cyber Certification of Master s Degrees Providing a General, Broad Foundation in Cyber Questions and Answers from Briefing Day held on 14 th April To what extent is an undergraduate computer science degree a starting point for these Master s degrees? Because a general cyber security Master s will have a relatively high technical content, we would normally expect that a grounding in STEM subjects or relevant experience are important before embarking on these Master s degrees. 2. What is the future path for Master s Degrees? We plan to certify general cyber security degrees first and then start to look at Master s degrees with narrower focus soon after that. We are open to suggestions as to what we should look at for those Master s with a narrower focus. 3. How many Master s degrees will GCHQ accept onto the certification programme? There is no upper limit. If a Master s degree meets all the assessment criteria then it will be certified. 4. The biggest market for Master s Degrees is overseas students. How does this help GCHQ? The nationality of a student is not relevant to GCHQ. As noted in the Call document, the benefits to students and employers of certified Master s include: identifying degrees with cyber security as sole or main focus identifying degrees which best suit someone s career path As degrees become certified we hope that employers will see a benefit in sponsoring students through such degrees. Hopefully there will be an increase the number of UK nationals taking Master s. Our secondary agenda is to support UK prosperity so if foreign students see even greater benefit in UK degrees we will be supporting that too. Page 1 of 10

2 5. Are you talking about vocational or research based degrees? For the general Master s, the taught part of the degree will have broad coverage of topics and there will also be a research component accounting for somewhere in the region of 25% 45% of the available credits. Master s degrees with narrower focus which will be the subject of future calls may include vocational and/or research elements. 6. We don t see anything in the Call document that suggests students should have a depth of knowledge. Successful certification requires the Assessment Panel to be happy that technical content is covered in sufficient depth appropriate to the time constraints of a 1-year Master s. The Panel also needs to be happy that students are rigorously assessed on their understanding of this material. The panel will base its decisions on the evidence an HEI provides, including: module descriptions, examination and assessment materials, research dissertations, distribution of grades. 7. We use the QAA framework like most Universities do. What additional evidence will we need to give? We want the degree to follow the QAA Framework. All an HEI needs to do is state that it meets the Framework and maintains adherence to the Framework throughout the certification. 8. Could we end up with similar looking Master s degrees? We want to encourage diversity in the range of Master s degrees in cyber security on offer. Appendix B of the Call document identifies indicative topics and the advice given states that all topics would not need to be covered and additionally other topics may be relevant. Thus, for a general Master s there should be sufficient scope for HEIs to provide their own distinctive offerings based on, for example: topic coverage, the expertise and interests of staff, style of teaching. 9. Are we looking at delivering 80% of the modules or 80% of the credits covering cyber security? Following feedback received at the briefing meeting, the figure of 80% has been reduced to 70%. To clarify, it is required that at least 70% of the credits available in the taught part of the course can be mapped to the Disciplines A to H in Appendix B of the Call document. Thus for example in a 180-credit Master s degree in which 120 credits are allocated to the taught part and 60 credits are allocated to the research dissertation, at least 84 credits in the taught element of the degree must be in cyber security. Appendix A of this document gives some examples which we hope provides further clarification. During the assessment panel meeting, the assessors will use the information provided by an HEI to determine if the 70% criterion has been met. Page 2 of 10

3 out of 13 of the Skills Groups must be covered. Can fractions of Skills Groups be used as long as the total is 10? Following feedback received at the briefing meeting, the figure of 10 has been reduced to 9. If an HEI so wishes, it can break down its coverage of Skills Groups into fractions as long as the cumulative sum is at least 9. Applicants should bear in mind the advice given in Appendix B of the Call document, page 12, paragraph d: The Indicative Topic Coverage highlights examples of the specific topics that one would expect to see represented within the syllabi of Master s modules in order for broad coverage of the related Skills Group to be achieved. Given that they are indicative topics, programmes would not be required to cover all of them explicitly (and indeed other topics may additionally be relevant), but there would be expected to be sufficient weight of coverage within each area if the Skills Group was to be satisfactorily addressed. 11. Most MSc courses are accredited by the BCS. Their requirements will compromise the 80% cyber content. What do you suggest? Please see answer to question 9 which clarifies that the 80% figure has been reduced to 70%. 12. Will the Assessment Panel have the opportunity to ask questions of the Universities? The Assessment Panel will not interact with HEIs during the assessment process. Feedback will be given on applications and there is no bar on unsuccessful applicants reapplying. 13. When there is a conversion from Provisional Certification to Full, when does the 5 year certification start from? Certification will start from the date of the Full award. 14. What will happen to Scottish Universities if independence goes ahead? We will be awarding this year and if Scottish independence goes ahead we will deal with the issue then. 15. What do successful universities get? They get the right to say that the Master s degree has been certified by GCHQ. There will also be a certification mark that can be used on all marketing materials associated with the degree. Certification (Full or Provisional) is likely to be one of the requirements for an HEI to become an Academic Centre of Excellence in Cyber Education. Page 3 of 10

4 16. Are there any linked internships or higher apprenticeships? Not at this time. 17. In the situation where a course is currently running will existing students be able to say they have completed a certified degree? For full certification students in academic years and will be entitled to say that they have successfully completed a certified Master s degree. For provisional certification, students currently studying in will be entitled to say that they have successfully completed a Master s degree with provisional certification. 18. What will happen to students who started the degree but part way through the degree certification is lost? It is important to note that GCHQ will work with an HEI to help it maintain certification. However, the relationship is between the student and the HEI and the HEI will have to manage the fact that it offered a student a certified degree programme but was unable to meet this. It is worth considering a couple of examples. A student starts a one-year certified Masters in October and in December several key staff leave the HEI. GCHQ will be informed of this and between them GCHQ and the HEI will agree a plan such as agreeing a time period for the HEI to replace the staff. Provided that the HEI is still able to deliver the degree and suitable staff are hired this should not affect the student. Even if staff are not able to be hired in the agreed time period it is likely that certification would be not be removed until the end of the academic year, provided that the HEI was able to deliver the degree, thus allowing a student to complete a certified degree. The more difficult case is part-time students where certification is lost at the end of the first academic year. As suggested above, the HEI will have to manage this situation with its students. The situation is not dissimilar to the case where BCS/IET re-certification is unsuccessful. 19. What happens if a student takes a series of short courses over an extended period, will that lead to a certified Master s degree? As long as a series of short courses is recognised by the HEI as qualifying for a Master s degree and as long as the degree meets all relevant certification standards throughout, a student will be awarded a certified degree. 20. Will distance learning degrees be accepted? Yes, section 3 of the main body of the Call document states that distance learning degrees are in scope. Page 4 of 10

5 21. Will Integrated Master s Degrees be accepted? Not at this time. These degrees are going to become increasingly important but will require a new assessment model. We hope to issue a call including Integrated Master s in Spring What happens if a degree changes its name, but much of the content is unchanged? For example: a degree in was called Computer, but in it was called Cyber. A full cohort has not gone through the degree. Can we still apply? If it were only a simple name change, we would suggest you apply for full certification and highlight the name change in the application. If it is a name change and there are some minor changes then full certification may still be appropriate but you will need to describe what is new and what has been dropped and provide the requested information for If it is a name change and there are some major changes then full certification may still be appropriate. However, section 3 from appendix C of the Call document will need to be completed for both the new degree and the original degree. Both will need to successfully meet the criteria. To accommodate this, the number of pages allowed to be submitted for section 3 in appendix C is increased to 13 pages. If it is essentially a new degree, then provisional certification is the best route. If there is any doubt, submitting full and provisional applications may be the safest route. 23. Are there any minimum limits on cohort size? There is no minimum cohort size specified in the Call document. However, the size of the cohort is one indicator of the success of the degree and may be taken into account by the Assessment Panel during its deliberations of applications that are considered to be borderline. 24. Why is GCHQ using the term cyber security? That is the name used by government under the National Cyber Programme. Appendix A of the call document provides a description of what is meant by cyber security for the purposes of the certification. 25. If the assessment materials given to students include very large data sets will these need to be provided as part of the application? The specific question related to network data files given to students who are expected to find interesting events. It is not necessary to provide the actual data and a description of the data would be fine. For example, the size of the data set, the overall number of events, the time period in which it was collected, the interesting events that students would be expected to find, and of these the really hard ones to find. Page 5 of 10

6 26. What should I provide if specimen papers for a new degree are not yet available? If the new Master s degree is based on a previous Master s, we would suggest including examples of examination papers from the Master s you used to run where the new modules are very similar to the old modules. For those modules which do not have existing examination papers you can draw on, or for brand new degrees, we would suggest that you describe in general terms the types of questions and assignments that that students might be set. Page 6 of 10

7 Appendix A A.1 Examples of Master s degrees that do and do not meet the 70% criterion With reference to question 9 above, it is required that at least 70% of the taught credits can be mapped to the Disciplines A to H in Appendix B of the Call document. We will refer to this as the 70% criterion. In this section we provide a number of stylised examples of Master s degrees that applicants can use (and adapt as necessary) as a basis for determining whether or not their Master s degrees meet the 70% criterion. Table A.1.1 shows a simple example of a Master s degree comprising 120 taught credits (the remaining 60 credits devoted to the research dissertation) spread across 10 modules with each module worth 12 credits. The first seven of the modules can be mapped to the Disciplines A to H. Thus 70% of the modules (7 out of 10) and 70% of the taught credits (84 out of 120) are in cyber security and therefore the Master s degree meets the 70% criterion. Module ID Credits in Module Fraction of a b c d e f g h i j Total Table A.1.1. Example in which Master s degree meets the minimum 70% criterion for number of credits. Page 7 of 10

8 Table A.1.2 shows a slightly more complex case where only half of the content of two of the modules (a and b) is estimated to be in cyber security. However, the overall total number of credits devoted to cyber security meets the 70% criterion. It should be noted that in order to meet the 70% criterion for credits, eight of the ten modules are included. Module ID Credits in Module Fraction of a b c d e f g h i j Total Table A.1.2. Example in which Master s degree meets the minimum 70% criterion for number of credits. Page 8 of 10

9 The next example in Table A.1.3 indicates the situation in which although all of the modules have some cyber security content the cumulative total of credits in cyber security fails to meet the 70% criterion. Module ID Credits in Module Fraction of a b c d e f g h i j Total Table A.1.3. Example in which Master s degree has 72 out of 120 credits in cyber security (60%) and thus fails to meet the minimum 70% criterion for number of credits. Page 9 of 10

10 The final example in Table A.1.4 shows that even though only 5 of the ten modules are in cyber security, the Master s degree is able to meet the 70% criterion for credits. Module ID Credits in Module Fraction of a b c d e f g h i j Total Table A.1.4. Example of Master s degree in which only 50% of the modules are in cyber security yet which meets the minimum 70% criterion (90 credits out of 120 are in cyber security) because some modules are more heavily weighted in terms of credits than others. Page 10 of 10