Cyber Incident Response Management Foundation Training Course

Module 1 – What is incident response management?

• Key definitions and legal requirements that underpin incident response.
• The incident reporting requirements of the GDPR, Europrivacy™, the PCI DSS (Payment Card Industry Data Security Standard), the EU NIS2 (Network and Information Systems) Directive and UK NIS Regulations and DORA (the EU Digital Operational Resilience Act).
• The role and benefits of risk management.

Module 2 – Cyber risk

• Cyber pathways: predicting an attacker’s route through your network beyond the gateway firewall, using frameworks like MITRE’s ATT&CK for assessment.
• The components of the cyber kill chain using the seven-stage Lockheed Martin model, common cyber threats and common threat actors.
• Targets, agents and vectors.
• Common vulnerabilities and CVSS (common vulnerability scoring system) levels.

Module 3 – The incident response team

• The structure, role and responsibilities of the incident response team.
• Business continuity.

Module 4 – The incident response process

• Deciding which standard to use and how to report in line with relevant regulations.
• The three phases of the CREST incident response process: prepare, respond, follow-up.
• The role of digital forensics in gathering evidence.

Module 5 – The incident response plan

• How to monitor and review your plans.
• The steps required to formulate, test and evaluate an incident response plan.
• How to define the scope of a business impact analysis, understanding the role it plays in the creation and management of a cyber incident response management plan.

Module 6 – Incident response scenarios

• Which incident response techniques to apply in common risk scenarios.
• Incident response preparation.
• Prepare, respond and follow-up exercises.

Course statistics

Course duration and times

Live Online GMT/BST

Day 1: 9:30 am – 5:00 pm