Pre-University Cyber Security Education: A Global Comparison of National Curricula

Objectives. There is growing recognition of the importance of cyber security education (including online safety and privacy) at pre-university level (i.e., up to age 18). Previous studies have focused on the cyber security curricula of single countries in isolation, or Computer Science when comparing multiple countries. In light of this gap in the literature, the aim of this study was to compare the curricula of 12 countries, in particular focusing on the similarities and differences. The research questions that guided our study were: (1) What are the similarities and differences in cyber security education curricula across countries? (2) What approaches do countries take to including cyber security education in their curricula? Study Method. We undertook desk research of the education programs of 12 countries, i.e., Australia, Canada, the Netherlands, New Zealand, Norway, Singapore, South Africa, the UK (England, Northern Ireland, Scotland, and Wales) and the USA, in order to compare their cyber security curriculum or framework at the national level. We undertook desk research to source curricula and also undertook a content analysis to discover patterns in the content covered in the curricula. Findings. The main findings include the following. Four approaches to the coverage and organization of cyber security education were observed: covered in a single technical subject only, covered in a single non-technical subject only, covered in one technical and one non-technical subject, and covered in all or a range of subjects. We also identified three approaches to cyber security education mandates: a lack of mandate, a mandate where regions can opt in or out, and a mandate with prescribed requirements although schools still have the freedom to pick-and-chose the requirements to implement and at what extent, according to local resources and capabilities. Conclusions. Policymakers can benefit from the findings and recommendations of this study to make decisions towards a more comprehensive coverage of cyber security in pre-university education, including technical and sociotechnical aspects along a range of subjects.