GIAC Cyber Incident Leader

A team that has to figure out who does what during an incident has already lost time. You design the structure, assign roles, set authority, and define how security, IT, legal, HR and communications work together.

• Core and extended incident team roles
• Decision authority and escalation paths
• On-call, handover and shift models
• Working with legal, HR and communications
• Third parties: retainers, forensics and law enforcement
• Documenting the team in a response plan

You build An incident team charter with roles, authority and call tree.

Incident teams burn out, and tired people make mistakes. You plan for wellbeing during long incidents, build training that sticks, and run exercises that test the plan and the people in it.

• Stress, fatigue and recovery in long incidents
• Rotation and workload limits
• Building a training plan for the team
• Tabletop exercises: design and facilitation
• Technical cyber ranges and live exercises
• Turning exercise findings into changes

You build A training and exercise calendar for a year, with one fully scripted tabletop scenario.

You cannot manage what you cannot see. You judge what your team can handle, set response goals, classify the incident, and keep tracking records of tasks and decisions that stay reliable under pressure.

• Assessing team capacity and surge options
• Setting objectives for a response
• Classifying an incident by impact and urgency
• Case management and task tracking
• Decision logs and timelines
• Handing work between shifts without loss

You build An incident tracking template with classification, task board and decision log, tried on a mock case.

Leaders choose what to fix first. You use vulnerability and threat intelligence data to direct patching and hardening, brief teams on current threats, and judge when exposure justifies emergency action.

• Vulnerability management as input to response
• Threat intelligence for leaders: what to ask for
• Prioritizing remediation by exploitation and exposure
• Emergency patching decisions
• Coordinating with IT operations
• Reporting exposure to leadership

You build A remediation priority brief built from a sample vulnerability list and threat reports.

Stolen credentials and malicious email start most incidents. You learn how these attacks are carried out and what they cost, then list the steps a leader directs to contain and recover from each.

• Phishing, spearphishing and business email compromise
• Credential theft and reuse
• Account takeover and its signals
• Containment steps for compromised accounts
• Communicating with users after a credential incident
• Preventive measures worth funding

You build Response playbooks for a phishing campaign and for a compromised executive account.

These attacks hit the whole organization and rarely allow improvisation. You separate each from other threats, describe how they unfold and what they damage, and plan the management steps from first alert to recovery.

• Ransomware stages: access, spread, encryption, extortion
• Backup and recovery decisions during ransomware
• Cloud incidents and provider responsibilities
• Supply chain compromise and vendor notification
• Business impact and prioritizing recovery
• Planning for the worst case

You build A response plan for a ransomware event that includes decision points for leaders.

During an incident, inconsistent messages cause damage of their own. You keep incident data consistent and secure across stakeholders, set the channels people may use, and decide how contact with an attacker is handled and who authorizes it.

• Stakeholder map and update cadence
• A single source of truth for incident facts
• Secure and out-of-band communication
• Handling media and customer questions
• Policy for contact with attackers and extortion demands
• Involving legal counsel and law enforcement

You build A communications plan with message templates, channels and an attacker-contact protocol.

A response that is not documented did not happen, for regulators and for the next team. You record the incident in reports of the right depth for each audience, and meet reporting duties to authorities and customers.

• Technical, management and regulator reports
• Evidence and record keeping
• Notification duties and deadlines
• Preserving privilege in incident documents
• Working with auditors and insurers
• Report review and sign-off

You build An incident report in three versions: technical, executive and regulatory.

An incident ends when the cause is understood and the business is stable. You find root causes, direct recovery, decide when to stand down, and hand work from response to long-term remediation.

• Root cause analysis methods
• Recovery planning and validation
• Criteria for declaring an incident closed
• Handing remediation to owners
• Post-incident review without blame
• Tracking corrective actions to completion

You build A root cause analysis and closure checklist for a sample incident.

A response program should get better each time. You choose measures that reflect real performance, review trends across incidents, and take what you learn into planning, training and tooling.

• Metrics for detection, response and recovery
• Avoiding measures that reward the wrong behavior
• Trend analysis across incidents
• Maturity assessment of the program
• Business cases for improvements
• Reporting program health to leadership

You build A measurement framework and annual improvement plan for an incident program.

Practice the whole role in a single scenario. You organize the team, classify and track the incident, direct containment and communication, report to leadership, and close with a review that changes the plan.

• Receiving the first alert and forming the team
• Classifying and setting goals
• Directing containment and recovery
• Managing communications and decisions
• Closing out with a review and report

You build A facilitated incident simulation with leader’s log, communications and a closing report.