Incident management governance
You build the governance side of incident response: policy, roles, classification, escalation, legal notification, evidence and records, lessons learned and incident metrics.
Level 301 · 16 lessons · 15 practice labs
Lessons
Framework
- Incident management standards: ISO/IEC 27035, NIST SP 800-61
- The governance model: CSIRT, crisis team, management
- Incident roles and RACI
- Quick task: a CSIRT charter
Classification and escalation
- Events, incidents and breaches
- The severity matrix
- Escalation paths and decision rights
- Quick task: classify and escalate ten tickets
Obligations
- A map of regulatory notification duties
- Contractual notifications: customers and insurers
- Evidence preservation and legal hold
- Incident records and the decision log
- Quick task: work out an incident's notification clocks
Improvement
- Post-incident review and a blameless culture
- Incident metrics: time to detect, respond and close
- Capstone: the governance file for a data breach
Practice labs
- Match the standard's phases: Match twelve activities to the phases of ISO/IEC 27035 and NIST SP 800-61.
- A RACI for incident roles: Prepare a RACI across the response team, crisis team and management for detection, classification, containment, communication and closure.
- A CSIRT charter: Write a charter for Yakamoz Telekom covering mission, authority, services, operating hours and reporting line.
- Event, incident or breach: Classify fifteen records as event, security incident or data breach.
- Design a severity matrix: Write a four-level severity matrix with impact and spread criteria and a response time target per level.
- Classify and escalate ten tickets: Grade ten tickets against the severity matrix and write to whom and how fast each is escalated.
- Match the decision to its authority: Match ten decisions such as shutting a system, telling customers and going to the police to the authorised role.
- Find the break in the escalation path: In an incident timeline, find where escalation stalled and the cause in the procedure.
- An out-of-hours escalation scheme: Write an out-of-hours scheme with the on-call rota, deputies, a no-answer rule and delegation of authority.
- A map of notification duties: Place six duties in a table with recipient, deadline and trigger.
- Work out an incident's notification clocks: From a data breach timeline, calculate the regulator, customer contract and insurer notification deadlines.
- A legal hold notice and decision log: Write a hold notice stating the records to preserve for an incident and build a dated decision log from the minutes.
- Calculate the incident metrics: Calculate mean time to detect, respond and close from twenty incident records.
- Write a blameless review: Rewrite a post-incident report that blames a person so it focuses on system and process causes.
- The governance file for a data breach: From prepared records, compile a file with classification, escalation, notifications, decision log and improvement actions and name the missing document.
About this course
You build the governance side of incident response: policy, roles, classification, escalation, legal notification, evidence and records, lessons learned and incident metrics.
What you will learn
- Framework
- Classification and escalation
- Obligations
- Improvement
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.