Identifying significant, difficult and timeless concepts for cybersecurity assessment tools: Results and analysis of two Delphi processes

As part of our ongoing project to create Cybersecurity Assessment Tools (CATs), we carried out two Delphi processes to help cybersecurity experts and educators build a consensus about the core concepts and skills in the field. We present and analyze the results of these processes.;The first process identified fundamental concepts for our Cybersecurity Concept Inventory to be given to students completing any first course in cybersecurity. The second process identified skills for our Cybersecurity Curriculum Assessment, which will be given to students graduating from college headed for their first job in cybersecurity. These tests will provide infrastructure for evidence-based improvement of cybersecurity education to help universities better prepare the substantial number of cybersecurity professionals needed in America.;Thirty-six experts participated in four to five rounds of data collection. By the end of the processes, experts reached a consensus, as indicated by decreasing variations in their scoring of the importance, difficulty, and timelessness of concepts and topics that they identified. Having a diverse set of cybersecurity experts is also important to increase the adoption of the tests.