Skip to main content
Skills course

Incident Response and Disaster Recovery

Learn to run an incident from detection to recovery and get the business back: the plan and playbooks, analysis, containment, disaster recovery and continuity, evidence, and reporting deadlines.

  • Format Online, self-paced
  • Scope 7 modules and a capstone
  • Duration About 8 h
  • Cost Quote on request

About this course

The course covers the incident response lifecycle, preparation, detection and analysis, containment, eradication and recovery, and then disaster recovery and continuity: recovery objectives, backups you can actually restore from, keeping critical services running during an outage, and a recovery playbook that is exercised. Common incidents are worked step by step, and communication and reporting cover customers, regulators and insurers. The capstone is a playbook, a recovery plan and a tabletop debrief.

  • Practice on real tasks and an applied assignment
  • Graded final assessment

A certificate that lists the skills is issued when the final assessment is passed and the applied assignment is submitted.

Content

  1. Module 1

    The Incident Response Lifecycle

  2. Module 2

    Preparation

  3. Module 3

    Detection and Analysis

  4. Module 4

    Containment, Eradication and Recovery

  5. Module 5

    Disaster Recovery and Continuity

  6. Module 6

    Common Incidents, Worked Step by Step

  7. Module 7

    Communication and Reporting

  8. Module 8

    Capstone: A Playbook, a Recovery Plan and a Tabletop Debrief

Apply it in a workshop

A half-day with an expert, live online or in person, that puts this course to work on your team's own cases. The course is the pre-work; the workshop is where it gets applied.

Who it is for

  • IT, operations and leadership staff in the incident plan
  • Incident-response career-changers

Fee and registration

Quote on request

Price Tell us which Skills courses and how many learners, and we send you a quote. Larger orders get volume pricing, and there is no minimum purchase.
Quoted on request
What a license covers Any license can be used on any Skills course: you choose the course when you assign it to a named learner.
One learner on one Skills course
What you need Skills course licenses sit on top of user licenses: a learner has to be a user on the platform.
A TechClass subscription
Access A license is used when it is assigned, whether or not the learner finishes. Unused licenses stay valid for 12 months from purchase.
12 months from assignment

How to get started

  1. Request a quote

    Tell us the Skills courses and the number of learners. We come back with a quote for the licenses and can walk you through the courses in a demo.

  2. Add your people

    Every learner needs a user license on TechClass. Skills course licenses are added on top.

  3. Assign a license to each learner

    Your admin assigns a license from the pool to each named learner on this course. The learner then has 12 months to complete it, at their own pace.

Education organizations and continuous learning departments: a plan of their own, paid per completion and with learner support, is in preparation. Contact us to discuss your program.

Request a quote
Questions, answered

Incident Response and Disaster Recovery FAQ

Per learner, per course. You buy Skills course licenses as a pool, on top of your user licenses, and your admin assigns one to a named learner on whichever Skills course they need. A license is used when it is assigned, whether or not the learner finishes.

Skills course licenses are quoted on request. Tell us which courses and how many learners you have in mind, and we send you a quote. Larger orders get volume pricing, and there is no minimum purchase.

Yes, with one license for each course. Licenses come from the same pool, so any license can be assigned to any Skills course, and all the licenses in one order count towards the volume price.

About 8 hours of guided learning, in modules, at the learner's own pace. Access lasts 12 months from the day the license is assigned.

Yes. A certificate that lists the skills is issued when the final assessment is passed and the applied assignment has been submitted.

A piece of real work that puts the skills to use. An employee does it on their own job and team; a learner without a suitable workplace does it on a provided case company. The learner checks it against a rubric, and a manager can review it.

No. Every Skills course stands on its own and restates what it relies on, so a learner can start with it directly.

The course is the same for companies and education organizations. A plan for continuous learning departments, paid per completion and with learner support, is in preparation.

English, at this stage.

Cybersecurity

Interested in Incident Response and Disaster Recovery?

Learn to run an incident from detection to recovery and get the business back: the plan and playbooks, analysis, containment, disaster recovery and continuity, evidence, and reporting deadlines.

Full table of contents

Incident Response and Disaster Recovery

8 modules · 28 sections

Module 1 The Incident Response Lifecycle

  1. 1.1 Preparation, detection and analysis, containment, eradication and recovery, lessons learned (NIST SP 800-61)
  2. 1.2 Roles and responsibilities
  3. 1.3 Severity levels, and when an event becomes an incident
  4. 1.4 The legal, insurance and regulatory actors in an incident

Module 2 Preparation

  1. 2.1 The incident response plan
  2. 2.2 Playbooks
  3. 2.3 Contacts and tools
  4. 2.4 Exercises: tabletops and drills

Module 3 Detection and Analysis

  1. 3.1 Scoping an incident
  2. 3.2 Handling evidence
  3. 3.3 Timelines: reconstructing what happened
  4. 3.4 Working with external responders and providers

Module 4 Containment, Eradication and Recovery

  1. 4.1 Containment choices and their trade-offs
  2. 4.2 Eradication, and verifying the attacker is gone
  3. 4.3 Restoring from backups
  4. 4.4 Returning to normal operations, and monitoring afterwards

Module 5 Disaster Recovery and Continuity

  1. 5.1 Recovery objectives: how fast, and how much data loss is acceptable
  2. 5.2 Backups you can actually restore from, and testing them
  3. 5.3 Keeping critical services running during an outage
  4. 5.4 The recovery playbook, and exercising it

Module 6 Common Incidents, Worked Step by Step

  1. 6.1 Ransomware
  2. 6.2 Business email compromise and payment fraud
  3. 6.3 A compromised account
  4. 6.4 A personal-data breach

Module 7 Communication and Reporting

  1. 7.1 Internal and customer communication
  2. 7.2 Regulatory reporting: under NIS2 Art. 23, an early warning within 24 hours, a notification within 72 hours and a final report within one month; under the GDPR, personal-data breaches within 72 hours
  3. 7.3 Insurers, law enforcement and ransom demands
  4. 7.4 Lessons learned and the post-incident report

Module 8 Capstone: A Playbook, a Recovery Plan and a Tabletop Debrief