Commonly Asked Questions About Cybersecurity Clinics

The Consortium

Question: How does the Consortium support new clinics?

Answer: The Consortium is a forum for faculty, students, trainers, and advocates to network and share knowledge, expand the reach of cybersecurity clinics, and lower the barriers for other institutions of higher education to successfully establish their own clinics. We host a monthly conference call for peer learning and sharing among established and new clinics. Members have access to a growing library of collective resources, designed to help new clinics get up and running without recreating the wheel. Consortium lines of effort such as our fundraising and impact & learning committees are also aggregating best practices that will be available to new clinics.

New clinics can establish mentorship relationships with existing clinics, and we host events for clinic students and training workshops for clinic instructors (stay tuned for more information about a clinic-focused pre-conference workshop at the 2024 NICE Conference.) [Note: The Consortium’s mission is to help build the capacity of all cybersecurity clinics, and Consortium members don’t advise new clinics on individual grant applications for opportunities like the Google Cybersecurity Clinics Fund.]

Where to House A Clinic

Q: Does an institution have to have a well-developed Cybersecurity or Computer Science program to launch a cybersecurity clinic program?

A: No. Clinics can be established as part of a degree program that is not directly related to technology, or outside of degree programs (for example, as a student club.) Successful existing clinics are often interdisciplinary and may be housed in business schools, law schools, and other departments. Having a faculty champion and buy-in from departmental and institutional leadership and administration at launch is more important than having a cybersecurity or computer science degree program.

Curriculum

Q: Is there a set curriculum for a cybersecurity clinic?

A: No. Curricula vary across clinics, depending on the emphasis of the clinic and the course requirements in a given institution. However, many clinics have similar modules and learning outcomes. Several Consortium members have shared their syllabi and other course materials with the community. For more information, check out “Teaching Syllabi” on our Resources page, and/or get involved in the Consortium!

Student Recruitment

Q: Can students with no prior cybersecurity experience participate in a cybersecurity clinic?

A: Yes. Several existing clinics allow students from all majors and grade levels to join, regardless of prior experience. Most clinic programs provide initial training to students to make sure everyone has the shared baseline knowledge to participate (see examples from UC Berkeley and MIT ). Students from non-technical majors bring complementary knowledge, and often have transferable skills they do not even realize. An interdisciplinary approach helps to create a well rounded team able to effectively engage with the client and analyze requirements from multiple perspectives.

Q: How do clinics grow the number of students in their clinics?

A: In order to grow the clinic, students across your campus need to be aware of and inspired by the opportunity to participate in the clinic. There are many ways that clinics conduct outreach to students, like campus-wide postering, hosting info sessions for prospective clinic students, and developing partnerships with student affairs/student advising. The best ambassadors to recruit new students to the clinic are often alumni of the clinic who can speak to their experiences providing cybersecurity assistance to organizations in need.

Another common limiting factor is faculty and instructor capacity. Recruiting volunteer mentors is one way that clinic instructors have augmented their capacity to advise students in the clinic and accept more students into the program.

Student Registration

Q: Do clinics accept only currently-enrolled students?

A: Existing member clinics of the Consortium of Cybersecurity Clinics are higher education-based programs, and work with undergraduate (including community college) and graduate students. Some institutions can accept visiting students to the clinic on a case-by-case basis, without requiring formal admission. Check with your institution to find out about concurrent enrollment and visiting student policies.

The cybersecurity clinic model is adaptable to other types of cybersecurity workforce development programs (for example serving non-traditional students, folks returning to the workforce, career changers, or other community members). If you are interested in developing a cybersecurity clinic outside of a university or college, the Consortium welcomes your participation and membership. [Note: there are some opportunities, such as the Google Cybersecurity Clinics Fund, for which only institutions of higher education are eligible.]

Student Support

Q: Do clinics compensate students for work in the clinic? What kinds of student support do clinics offer?

A: It depends. Some clinics are able to support students financially for their work in the clinic, while others provide course credit, and still others function as an extracurricular activity. Each clinic will need to work within its host institution to decide if and how it wants to approach student support. Compensating students at the typical hourly rate of your institution, stipends, paid internships, course credit, and tuition relief (while in the clinic) are all options that have been used successfully. Schools should look internally at the different tax implications for students before selecting an approach.

Student Leadership

Q: Can students participate in creating and leading clinics?

A: Yes. Students bring great perspective and ideas to the design and implementation of a clinic. Some cybersecurity clinics are organized as student organizations, such as the successful Free Cyber Clinic at the University of Nevada, Las Vegas. [Note: there are some opportunities, such as the Google Cybersecurity Clinics Fund, which do not accept applications submitted independently by students and require a faculty or institution lead.]

Budget and Equipment

Q: What kind of equipment and supplies (e.g. hardware, software, or other equipment) should clinics budget for?

A: Clinics often provide laptops and security keys to students specifically for working in the clinic. At a minimum, clinics also need to purchase products and/or services that provide secure data storage and that allow for secure communication and collaboration between the clinic and its clients (for example, encrypted messaging and/or VPN services).

Q: What other guidance can I find on a start-up budget for a cybersecurity clinic?

A: The cost of clinic startup and operations depends on faculty teachers, paid student internships, materials, enrollment, and full-time support staff or TAs. Consortium clinics have found that $300k is a good funding target for the first year, and $100k each year thereafter. Page 11 of the Clinic Development Toolkit has more information on typical line-items in a start-up budget. Note that marketing and outreach may be needed to start-up a clinic and should be considered as you develop your clinic budget.

Clients

Q: How do clinics market their services to potential clients?

A: One successful approach to marketing clinic services is to partner with a community organization that can connect your clinic to organizations in need. Many clinics partner with local hubs that serve as trusted partners, vouching for the quality of the clinic program to potential clients, and finding clients that would most benefit from the free services. For example, clinics have partnered with the Small Business Development Centers in their communities who can help with outreach to small business owners. Other clinics have established partnerships with entities like the United Way. Once the clinic has an established track record, clients also come via word-of-mouth.

Q: Is a “clinic” seen as a time-limited event that happens annually, or an ongoing entity?

A: The university-based cybersecurity clinics in the Consortium are ongoing entities, where students and clients have the opportunity to develop a sustained engagement (i.e. over the course of a term or semester).

Instruction: Virtual vs. In Person

Q: Can clinics run virtually, or do they have to be in person?

A: Instruction and clinic participation can be either in person, virtual (online) or hybrid depending which is considered most effective for the clinic and client. We have seen all of these options work successfully in existing clinics. If the clinic’s clients are local, many clinics make an effort to have students meet with clients in-person.

Risk Management

Q: How do university-based cybersecurity clinics handle liability?

A: Typically, an MOU (sometimes called a Statement of Expectations) is executed between the clinic client and the clinic’s host institution. Clinic directors can work closely with their institution’s legal department or general counsel to work out the specifics of an MOU or other agreement. If you need help getting started, contact cybersecurityclinics@berkeley.edu for templates that have been shared by existing clinics and made available through the Consortium as a resource to the community. Many schools also require students to agree to a code of conduct for working in the clinic. See pages 13-14 of the Clinic Development Toolkit for more information.

Fundraising

Q: Do clinics fundraise?

A: Many clinics are supported at least partially by grants or other philanthropic support. Pages 11 and 12 of the Clinic Development Toolkit cover a range of fundraising strategies and tips including how to identify and approach prospective funders. The Consortium of Cybersecurity Clinics will expand clinic fundraising materials and suggestions on its Resources webpage in 2024 – stay tuned!