Overview

This course develops the capability to run a federal incident response program from end to end — not simply reacting to a single case, but designing, operating, and steadily improving the program behind it. The structure follows NIST SP 800-61 Revision 3, which frames incident response against the six NIST Cybersecurity Framework 2.0 Functions instead of the older standalone four-phase model. Govern, Identify, and Protect account for the preparatory work that lowers both the odds and the cost of an incident. Detect, Respond, and Recover account for the reactive work of finding it, containing it, and restoring operations. Improvement returns lessons learned to the preparation side continuously, rather than only once a case closes.

Mandatory federal reporting duties run through the Respond function throughout, because reporting clocks start at detection rather than at closure. The course ends with a full-lifecycle capstone simulation and a tabletop exercise design workshop, worked alongside the instructor, so practitioners leave able to build and facilitate their own exercises back at the agency.

Syllabus

Module 1. Program Governance and Risk Management Strategy

The federal IR landscape, the IR charter and CSIRC/SOC standup, roles and a RACI matrix, program maturity and metrics

Module 2. Risk-Informed Readiness

Asset and risk awareness that tunes an IR program to the agency's real exposure, and the preventive controls and workforce readiness that keep detection and response from being overwhelmed

Module 3. Detection and Classification

Detection sources and the 2026 logging baseline, triage and NCISS scoring, determining major-incident status, applied classification exercise

Module 4. Containment and Eradication

Containment strategy, coordinating across on-premises, cloud and OT environments, evidence preservation and chain of custody, root cause analysis and eradication

Module 5. Incident Reporting, Notification and Communication

The one-hour CISA notification, the seven-day congressional notification and annual FISMA reporting, PII and breach-specific notification, and a horizon scan of pending rules

Module 6. Restoration and Recovery Communication

Phased restoration and return-to-operations sign-off, aligning recovery with binding remediation deadlines, and keeping leadership and oversight informed