LDR553: Cyber Incident Management
About This Course
This course equips you to play a leading role in cyber incident management, whether as an incident commander, a manager, a team member, or a stakeholder who needs to guide and support the response.
You will gain a comprehensive understanding of the immediate, short, and medium-term issues an organization might encounter. Beyond familiarizing yourself with the terminology, you will grasp preparatory actions at different stages to stay ahead of the situation. LDR553 is designed for efficient management of diverse incidents, with a primary focus on cyber, but you can apply the methodology, concepts, and guidance to various regular major and critical incidents.
Cyber Incident Management (IM) sits above Incident Response (IR) and manages incidents that get too big for the Security Operations Center (SOC) and IR. These tend to be the more impactful or larger scale incidents that IR is not staffed to handle, as these incidents require significant liaison with internal and external partners to coordinate the investigation, forensics, planning, recovery, and remediation, and to brief the corporate comms, C-level staff and board as needed.
What You'll Learn
- Run briefings under pressure with minimal prep and deliver real impact
- Lead meetings when the team is stressed, the facts are incomplete, and execs are impatient
- Build and test your own GenAI tools to draft briefs, simulate reactions, and organize chaos
- Survive a supply chain breach with minimal 3rd party support
- Distinguish between technical facts, assumptions, and noise during incident response
- Use the CIMTK framework to prioritize tasks and drive progress
- Track attacker behavior, infrastructure risk, and team readiness in real time
Entry Requirements
Participants should be proficient in written and spoken English. Please refer to our website for more details on the content taught:
https://www.sans.org/cyber-security-courses/cyber-incident-management-training
There are no minimum entry requirements for years of experience in the domain, education level or age group; but participants should possess the relevant prerequisite skills mentioned above.