starweaver-logo
LOG INGET STARTED
LOG INGET STARTED
  • Browse
  • Doing

  • On Air
  • Channels
  • Career Paths
  • LEARNING

  • Courses
  • Certifications
  • Curriculum
  • Test Prep
  • CONNECTING

  • How It Works
  • Community
  • Techbytes
  • Podcasts
  • Leaderboards
  • SUPPORT

  • Support & FAQs
  • Starweaver for Business
  • Starweaver for Campus
  • Teach with Starweaver
footer-brand-logo
  • COMPANY
  • About Us
  • Support and Knowledge Base
  • Policies & Terms
  • Contact
  • CONTENT
  • Courses
  • Certifications
  • Journeys
  • Test Prep
  • Meet the Gurus
  • Techbytes
  • FOR ORGANIZATIONS
  • Starweaver for Business
  • Starweaver for Campus
  • Catalogue
  • Pricing
  • Private Classes
  • PARTNER WITH US
  • Instructors & Teachers
  • Books, Writing & Publishing
  • FOLLOW US
    • facebook
    • twitter
    • linkedin
    • pinterest
    • instagram
    • youtube
Our trademarks include Starweaver®, Make genius happen™, Education you can bank on®, People are your most important assets!®, Body of Knowledge™, StarLabs™, LiveLabs™, Journeys™
© Starweaver Group, Inc. All Rights Reserved.
  1. Courses
  2. >
  3. Incident Response Frameworks

Incident Response Frameworks

Learn to plan, implement, and manage cybersecurity incident response using NIST, SANS, and ISO frameworks. Build a customized, testable response plan to detect, contain, and recover from cyber incidents effectively in real-world environments.

Brett Moffett
Brett Moffett
Cybersecurity | intermediate | 9 hours |   Published: Oct 2025

    Discussions

Overview

STUDENTS*
RECOMMEND*

This course includes:

  • On-demand videos
  • Practice assessments
  • Multiple hands-on learning activities
  • Exposure to a real-world project
  • 100% self-paced learning opportunities
  • Certification of completion

What happens when your organization is under cyber-attack, and you're the one who must respond? 

In today's digital battlefield, cyber incidents are not a matter of if, but when. Whether it's ransomware, phishing, or insider threats, the ability to respond swiftly and effectively can mean the difference between containment and catastrophe. 

This course is designed to equip you with the tools, strategies, and confidence to implement and use industry best practice for cybersecurity incident response to create an incident response process that anyone can follow.  

We'll explore the most widely adopted industry frameworks (NIST and SANS) and learn how to apply them in real-world scenarios as well as integrate them into your existing IT Service Management solution. Through expert guidance and real-world examples, you'll gain a detailed understanding of how to build response plans, coordinate teams, and recovering from attacks. 

Whether you're an aspiring cybersecurity professional, an IT support manager, or a team member looking to sharpen your response skills, this course will prepare you to act decisively when it matters most. 

Join us and take the first step toward becoming your organisation's frontline defender. 

Skills You Will Gain

NIST
SANS
ITSM Major Incident Planning
ITIL Incident Management

Learning Outcomes (At The End Of This Program, You Will Be Able To...)

  • Describe the fundamentals of a cybersecurity major incident response process. 
  • Explain key industry frameworks (NIST and SANS). 
  • Develop your own cybersecurity major incident response plan. 
  • Test, measure, and improve your cybersecurity major incident management process. 

Prerequisites

Basic understanding of IT Service Management, ITIL pillars (Incident, Problem, Change, Request), business IT support, and common cybersecurity events.

Who Should Attend

Cybersecurity engineers. Service Desk Analysts. Service Desk Managers. IT Managers. 

Curriculum

Instructors

*Where courses have been offered multiple times, the “# Students” includes all students who have enrolled. The “%Recommended” shown is also based on this data.
1Chapter 1: What is Incident Management and Why is it Important?
2Chapter 2: Importance of a Mature IT Service Management Solution
3Chapter 3: Justifying the Effort and Cost
4Chapter 4: SANS Framework: 6-Step Process
5Chapter 5: NIST SP 800-61r3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
6Chapter 6: Documentation Management Frameworks
7Chapter 7: Defining a Major Incident
8Chapter 8: Building a Cyber Incident Response Plan (CIRP)
9Chapter 9: Post Implementation Review Process
10Chapter 10: Implementing the Process
11Chapter 11: Testing the Plan
12Chapter 12: Review, Maintain, and Improve

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 00: Welcome and Course Goals

Segment 01: Key Terminology and Acronyms

Segment 02: IT Service Management

Segment 03: Importance of an IT Service Management solution

What is Incident Management and Why is it Important?

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 13: SANS Institute-s Incident Response (IR) framework

Segment 14: Preparation and Identification

Segment 15: Containment and Eradication

Segment 16: Recovery and Lessons Learned

Segment 17: Third-PartySupply Chain Incident Management

SANS Framework: 6-Step Process

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 04: What defines a mature IT Service Management (ITSM) solution

Segment 05: Importance of Preparation and Planning

Segment 06: ITIL Incident_ Major Incident_ and Problem Management

Importance of a Mature IT Service Management Solution

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 07: Cost Savings from Preventing Cyber Attacks

Segment 08: Non-monetary impact on the business

Segment 09: Understanding ROI for Cybersecurity Investments

Segment 10: Reading- What Is IT Service Management? (And Its Importance)

Segment 11: Hands-On-Learning: Mapping Out an Incident Management Process

Justifying the Effort and Cost

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 18: What is NIST SP 800-61

Segment 19: Preparation

Segment 20: Incident Response

Segment 21: Lessons Learned

NIST SP 800-61r3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management

Brett Moffett

Brett Moffett

Brett brings over 30 years of experience across both government and private sectors, having worked in a wide variety of IT environments. With his extensive background, there are few IT challenges he hasn't encountered. His goal is to serve as a trusted advisor for businesses of all sizes, offering a fresh and honest perspective on the evolving challenges of today’s connected digital landscape. He is dedicated to delivering easy-to-understand, actionable solutions. From his wealth of experience, Brett knows how to maximize a business’s IT investments. He specializes in areas such as customer experience, support, self-service, cybersecurity, policies, procedures, and automation. With a unique ability to translate complex technical concepts into everyday business language, Brett ensures that users can focus on their work while keeping their business profitable and secure.
VIEW MY CHANNEL

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 43: Simulating an Incident

Segment 44: Advanced Simulations

Segment 45: Measuring Simulation Success

Testing the Plan

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 31: Planning for Identification Phase

Segment 32: Planning for Response

Segment 33: Planning for Lessons Learned

Building a Cyber Incident Response Plan (CIRP)

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 22: Document Management Standards

Segment 23: Creation_ Storage and tracking of document

Segment 24: Monitoring and Maintenance processes and procedure

Segment 25: Reading -

Segment 26: Hands-On-Learning: Determine the Best Templates and Management Products to Use

Documentation Management Frameworks

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 40: Making the Process Available

Segment 41: Communicating the Process

Segment 42: Training Staff

Implementing the Process

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 34: Cost Savings from Preventing Cyber Attacks

Segment 35: Non-Monetary Impact on the Business

Segment 36: Understanding ROI for Cybersecurity Investments

Segment 37: Reading - What Is IT Service Management? (And Its Importance)

Segment 38: Hands-On-Learning: Investigate Post Implementation Review Templates

Post Implementation Review Process

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 46: Continuous Process Improvement

Segment 47: Creating a Review Schedule

Segment 48: System Architecture Involvement

Segment 49: Reading - Learn about quality

Segment 50: Hands-On-Learning: Build Out First Draft of a Cyber Incident Response Plan

Segment 51: Outro-Course Wrap-up Video

Segment 53: Project: Implement a cyber security incident response plan

Review, Maintain, and Improve

You need to enroll in this course to access the curriculum. Click 'Enroll' to get started!

Segment 28: CIRP Templates

Segment 29: Gathering the Right People for the Team

Segment 30: Defining the Trigger for a Major Incident Process

Defining a Major Incident