A Framework for Designing and Certifying ECSF-Aligned Cybersecurity Training through Cyber Ranges and Virtual Learning Environments

A Framework for Designing and Certifying ECSF-Aligned Cybersecurity Training through Cyber Ranges and Virtual Learning Environments | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article A Framework for Designing and Certifying ECSF-Aligned Cybersecurity Training through Cyber Ranges and Virtual Learning Environments Julia Sánchez, Alan Briones, Sara Ricci, Jakub Čegan, Argyro Chatzopoulou, and 3 more This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-7988565/v1 This work is licensed under a CC BY 4.0 License Status: Published Journal Publication published 05 Feb, 2026 Read the published version in International Journal of Information Security → Version 1 posted 9 You are reading this latest preprint version Abstract This paper presents the REWIRE Courses and Certification Framework, a methodological approach for designing, developing, and validating cybersecurity training aligned with the European Cybersecurity Skills Framework (ECSF). The framework combines instructional design principles based on the ADDIE model with certification mechanisms structured around ISO/IEC 17024:2012 standards. It provides a replicable model that guides training providers from learning outcome definition to course implementation and evaluation, ensuring full alignment with ECSF occupational profiles. The proposed framework integrates theoretical, practical, and evaluative components that can be delivered through Vocational Open Online Courses (VOOCs) within Virtual Learning Environments (VLEs) and by incorporating Cyber Range exercises. The methodology has been validated through its implementation in the European-funded REWIRE project, which served as a practical testbed for its application and refinement, and was later applied in the NG-SOC project. It supports both upskilling and reskilling pathways and enables transparent mapping between competences, roles, and certification levels. In general, this approach bridges the gap between cybersecurity education and the European labor market, promoting quality assurance, interoperability, and recognition of cybersecurity competences across EU Member States. Cybersecurity Education Cybersecurity Training Cyber Range Training European Cybersecurity Skills Framework (ECSF) Upskilling and Reskilling Certification Framework Instructional Design Full Text Additional Declarations Competing interest reported. The authors declare that this work was developed within the framework of the REWIRE - Cybersecurity Skills Alliance: A New Vision for Europe project, which has received support from the Erasmus+ Programme of the European Union. REWIRE is co-funded by the European Commission under Grant Agreement No. 621701-EPP-1-2020-1-LT-EPPKA2-SSA-B. Two of the authors (Yianna Danidou and Argyro Chatzopoulou) serve as guest editors for the Special Issue to which this paper has been submitted. They were not involved in the peer review process of this manuscript and will have no access to reviewer information or decisions. Cite Share Download PDF Status: Published Journal Publication published 05 Feb, 2026 Read the published version in International Journal of Information Security → Version 1 posted Editorial decision: Revision requested 18 Nov, 2025 Reviews received at journal 18 Nov, 2025 Reviews received at journal 16 Nov, 2025 Reviewers agreed at journal 31 Oct, 2025 Reviewers agreed at journal 31 Oct, 2025 Reviewers invited by journal 31 Oct, 2025 Editor assigned by journal 31 Oct, 2025 Submission checks completed at journal 31 Oct, 2025 First submitted to journal 30 Oct, 2025 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-7988565","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":538243296,"identity":"18a6d1d4-a27d-4425-ad12-351a2e58b9ec","order_by":0,"name":"Julia Sánchez","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA+UlEQVRIiWNgGAWjYBACxgYwdYCBgR3IelAA4jADWWzEaOEB4gQDmBgeLVAAVC6RQKQW5gb2h58Lau7Iyc98/vBDgoENg8Htgw0MH8oO43EYj7H0jGPPjBln5xhLJBikMRicS2xgnHEOrxYGad6Gw4nN0jlAtxkcZjA4w9jAzNuGTwv7499ALfVtkscf/0gw+A/R8hevFgYzkC0JPBIMZkBbDkC0MOLT0sxjZs1z7LDhDJ4cM4sEg2QeSaCWgz3n0nFqMWxvf3ybp+awvHz78cc3PlTYyfGdYT744EeZNW4tzWgCPCDiAE71QCCPT3IUjIJRMApGARgAAHkFU3BKeYF5AAAAAElFTkSuQmCC","orcid":"","institution":"Ramon Llull University","correspondingAuthor":true,"prefix":"","firstName":"Julia","middleName":"","lastName":"Sánchez","suffix":""},{"id":538243297,"identity":"1c3a7b5a-03d4-40af-a20c-694f76621fb0","order_by":1,"name":"Alan Briones","email":"","orcid":"","institution":"Ramon Llull University","correspondingAuthor":false,"prefix":"","firstName":"Alan","middleName":"","lastName":"Briones","suffix":""},{"id":538243298,"identity":"3ebe6cda-369d-4427-81b8-ef1e1323cca2","order_by":2,"name":"Sara Ricci","email":"","orcid":"","institution":"Brno University of Technology","correspondingAuthor":false,"prefix":"","firstName":"Sara","middleName":"","lastName":"Ricci","suffix":""},{"id":538243299,"identity":"0c466191-9fec-41ce-b112-30c627453192","order_by":3,"name":"Jakub Čegan","email":"","orcid":"","institution":"CyberSecurity Hub, z. ú","correspondingAuthor":false,"prefix":"","firstName":"Jakub","middleName":"","lastName":"Čegan","suffix":""},{"id":538243300,"identity":"f9760576-3f82-4f58-89c3-326d7ca018f9","order_by":4,"name":"Argyro Chatzopoulou","email":"","orcid":"","institution":"APIROPLUS SOLUTIONS LTD.","correspondingAuthor":false,"prefix":"","firstName":"Argyro","middleName":"","lastName":"Chatzopoulou","suffix":""},{"id":538243301,"identity":"5b556c45-4f7a-462c-bf1a-d049cd360cea","order_by":5,"name":"Yianna Danidou","email":"","orcid":"","institution":"European University Cyprus","correspondingAuthor":false,"prefix":"","firstName":"Yianna","middleName":"","lastName":"Danidou","suffix":""},{"id":538243302,"identity":"c4b1e14e-3a25-4c0a-b429-e1ddf55efa4d","order_by":6,"name":"Andreas Menegatos","email":"","orcid":"","institution":"University of Piraeus","correspondingAuthor":false,"prefix":"","firstName":"Andreas","middleName":"","lastName":"Menegatos","suffix":""},{"id":538243303,"identity":"5ddabf22-71d9-4155-8043-e6bb1ce9d3c8","order_by":7,"name":"Guiomar Corral","email":"","orcid":"","institution":"Ramon Llull University","correspondingAuthor":false,"prefix":"","firstName":"Guiomar","middleName":"","lastName":"Corral","suffix":""}],"badges":[],"createdAt":"2025-10-30 11:08:12","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-7988565/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-7988565/v1","draftVersion":[],"editorialEvents":[{"content":"https://doi.org/10.1007/s10207-025-01202-0","type":"published","date":"2026-02-05T15:59:54+00:00"}],"editorialNote":"","failedWorkflow":false,"files":[{"id":95746212,"identity":"12a700a1-6782-4508-80fa-dc45f17dec43","added_by":"auto","created_at":"2025-11-12 14:45:03","extension":"json","order_by":0,"title":"","display":"","copyAsset":false,"role":"acdc-reference","size":9926,"visible":true,"origin":"","legend":"","description":"","filename":"8bff74d091174531b982bbce89002319.json","url":"https://assets-eu.researchsquare.com/files/rs-7988565/v1/d4791e957122f9a3d1a0c643.json"},{"id":102234746,"identity":"6b5f342c-d8bc-47d9-b7a1-1ec3f7478bd8","added_by":"auto","created_at":"2026-02-09 16:13:11","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1206527,"visible":true,"origin":"","legend":"","description":"","filename":"REWIREC2F.pdf","url":"https://assets-eu.researchsquare.com/files/rs-7988565/v1_covered_76000959-1f03-4d39-9297-9b07e86d2dfc.pdf"}],"financialInterests":"Competing interest reported. The authors declare that this work was developed within the framework of the REWIRE - Cybersecurity Skills Alliance: A New Vision for Europe project, which has received support from the Erasmus+ Programme of the European Union.\nREWIRE is co-funded by the European Commission under Grant Agreement No. 621701-EPP-1-2020-1-LT-EPPKA2-SSA-B.\n\nTwo of the authors (Yianna Danidou and Argyro Chatzopoulou) serve as guest editors for the Special Issue to which this paper has been submitted. They were not involved in the peer review process of this manuscript and will have no access to reviewer information or decisions.","formattedTitle":"A Framework for Designing and Certifying ECSF-Aligned Cybersecurity Training through Cyber Ranges and Virtual Learning Environments","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":true,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"international-journal-of-information-security","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"ijis","sideBox":"Learn more about [International Journal of Information Security](http://link.springer.com/journal/10207)","snPcode":"10207","submissionUrl":"https://submission.nature.com/new-submission/10207/3","title":"International Journal of Information Security","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false},"keywords":"Cybersecurity Education, Cybersecurity Training, Cyber Range Training, European Cybersecurity Skills Framework (ECSF), Upskilling and Reskilling, Certification Framework, Instructional Design","lastPublishedDoi":"10.21203/rs.3.rs-7988565/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-7988565/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"This paper presents the REWIRE Courses and Certification Framework, a methodological approach for designing, developing, and validating cybersecurity training aligned with the European Cybersecurity Skills Framework (ECSF). The framework combines instructional design principles based on the ADDIE model with certification mechanisms structured around ISO/IEC 17024:2012 standards. It provides a replicable model that guides training providers from learning outcome definition to course implementation and evaluation, ensuring full alignment with ECSF occupational profiles. The proposed framework integrates theoretical, practical, and evaluative components that can be delivered through Vocational Open Online Courses (VOOCs) within Virtual Learning Environments (VLEs) and by incorporating Cyber Range exercises. The methodology has been validated through its implementation in the European-funded REWIRE project, which served as a practical testbed for its application and refinement, and was later applied in the NG-SOC project. It supports both upskilling and reskilling pathways and enables transparent mapping between competences, roles, and certification levels. In general, this approach bridges the gap between cybersecurity education and the European labor market, promoting quality assurance, interoperability, and recognition of cybersecurity competences across EU Member States.","manuscriptTitle":"A Framework for Designing and Certifying ECSF-Aligned Cybersecurity Training through Cyber Ranges and Virtual Learning Environments","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2025-11-12 14:44:59","doi":"10.21203/rs.3.rs-7988565/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2025-11-18T19:46:59+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-11-18T10:19:24+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2025-11-16T17:37:14+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"246266755798959161136358587144530262371","date":"2025-10-31T16:44:39+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"71512658361579960805734476426136189564","date":"2025-10-31T13:58:45+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2025-10-31T13:57:22+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2025-10-31T13:29:58+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2025-10-31T09:04:44+00:00","index":"","fulltext":""},{"type":"submitted","content":"International Journal of Information Security","date":"2025-10-30T10:53:54+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"international-journal-of-information-security","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"ijis","sideBox":"Learn more about [International Journal of Information Security](http://link.springer.com/journal/10207)","snPcode":"10207","submissionUrl":"https://submission.nature.com/new-submission/10207/3","title":"International Journal of Information Security","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"em","reportingPortfolio":"Springer Hybrid","inReviewEnabled":true,"inReviewRevisionsEnabled":false}}],"origin":"","ownerIdentity":"8e211fdb-e77e-4cca-abc2-9efb4ded2164","owner":[],"postedDate":"November 12th, 2025","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"published-in-journal","subjectAreas":[],"tags":[],"updatedAt":"2026-02-09T16:08:48+00:00","versionOfRecord":{"articleIdentity":"rs-7988565","link":"https://doi.org/10.1007/s10207-025-01202-0","journal":{"identity":"international-journal-of-information-security","isVorOnly":false,"title":"International Journal of Information Security"},"publishedOn":"2026-02-05 15:59:54","publishedOnDateReadable":"February 5th, 2026"},"versionCreatedAt":"2025-11-12 14:44:59","video":"","vorDoi":"10.1007/s10207-025-01202-0","vorDoiUrl":"https://doi.org/10.1007/s10207-025-01202-0","workflowStages":[]},"version":"v1","identity":"rs-7988565","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-7988565","identity":"rs-7988565","version":["v1"]},"buildId":"8U1c8b4HqxoKbykW_rLl7","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}