• Online, Instructor-Led

This two-day course is designed to teach non-technical support staff how to respond to an incident and how to work with investigators during an incident response event. This course includes a series of hands-on exercises that highlight all phases of the investigation life cycle. Participants will learn how to respond to a detected incident, describe the incident to stakeholders, differentiate among different evidence acquisition methods, understand how investigators investigate, evaluate different remediation methods, and review an investigative report. By the end of this course, participants will be able to actively provide non-technical support to an investigation by understanding the full scope of incident response processes and procedures.

Learning Objectives

After completing this course, learners should be able to: • Determine how to respond to an incident immediately after initial notification • Summarize an incident for relaying to a trusted partner • Choose an investigation plan most suited to investigate your organization’s incident • Choose a remediation plan most suited to investigate your organization’s incident • Evaluate an investigative report for quality • Summarize the events described in an incident report

Framework Connections

The materials within this course focus on the NICE Framework Task, Knowledge, and Skill statements identified within the indicated NICE Framework component(s):

Specialty Areas

  • Incident Response

Specialty Areas have been removed from the NICE Framework. With the recent release of the new NICE Framework data, updates to courses are underway. Until this course can be updated, this historical information is provided to give better context as to how it can help you with your cybersecurity goals.