• Online, Instructor-Led
Course Description

This two-day course is designed to teach non-technical support staff how to respond to an incident and how to work with investigators during an incident response event. This course includes a series of hands-on exercises that highlight all phases of the investigation life cycle. Participants will learn how to respond to a detected incident, describe the incident to stakeholders, differentiate among different evidence acquisition methods, understand how investigators investigate, evaluate different remediation methods, and review an investigative report. By the end of this course, participants will be able to actively provide non-technical support to an investigation by understanding the full scope of incident response processes and procedures.

Learning Objectives

After completing this course, learners should be able to: • Determine how to respond to an incident immediately after initial notification • Summarize an incident for relaying to a trusted partner • Choose an investigation plan most suited to investigate your organization’s incident • Choose a remediation plan most suited to investigate your organization’s incident • Evaluate an investigative report for quality • Summarize the events described in an incident report

Framework Connections

The materials within this course focus on the Knowledge Skills and Abilities (KSAs) identified within the Specialty Areas listed below. Click to view Specialty Area details within the interactive National Cybersecurity Workforce Framework.