This two-day course is designed to teach non-technical support staff how to respond to an incident and how to work with investigators during an incident response event. This course includes a series of hands-on exercises that highlight all phases of the investigation life cycle. Participants will learn how to respond to a detected incident, describe the incident to stakeholders, differentiate among different evidence acquisition methods, understand how investigators investigate, evaluate different remediation methods, and review an investigative report. By the end of this course, participants will be able to actively provide non-technical support to an investigation by understanding the full scope of incident response processes and procedures.
Learning Objectives
After completing this course, learners should be able to: • Determine how to respond to an incident immediately after initial notification • Summarize an incident for relaying to a trusted partner • Choose an investigation plan most suited to investigate your organization’s incident • Choose a remediation plan most suited to investigate your organization’s incident • Evaluate an investigative report for quality • Summarize the events described in an incident report
Framework Connections
Specialty Areas
- Incident Response
Feedback
If you would like to provide feedback for this course, please e-mail the NICCS SO at NICCS@hq.dhs.gov.