Introduction to Cyber Incident Response

About this course

When a cyber incident happens, the first hours matter enormously. This course introduces the stages of incident response, shows you how to plan roles and contacts in advance, explains how to preserve evidence and guides you through a useful post-incident review. It is general information only and does not replace specialist advice, so use the Australian Cyber Security Centre and your IT provider for support.

What you will be able to do

• You'll be able to explain why a response plan should be prepared before an incident happens
• You'll be able to describe the main stages of incident response in plain terms
• You'll be able to set out roles, contacts and escalation paths in a practical plan
• You'll be able to preserve evidence and run a useful post-incident review

Course outline

1. Why Response Planning Matters

   9 min · Lesson notes, example, action task · 2-question quiz

   In a cyber incident, people often waste precious time deciding who to call and what to do. A simple response plan written in advance lets everyone act calmly and quickly.
2. Stages of Incident Response

   11 min · Lesson notes, example, action task · 2-question quiz

   Incident response generally moves through preparation, detection, containment, eradication, recovery and lessons learned. Knowing the stages helps you act in the right order.
3. Roles and Contacts

   11 min · Lesson notes, example, action task · 2-question quiz

   A clear list of roles and contacts makes response faster. Everyone should know who leads, who does the technical work, who communicates and when to escalate.
4. Preserving Evidence

   11 min · Lesson notes, example, action task · 2-question quiz

   Evidence helps you understand what happened and may be needed for insurance, legal or regulatory purposes. Preserve it carefully without disturbing the systems more than necessary.
5. Post-Incident Reviews

   11 min · Lesson notes, example, action task · 2-question quiz

   A post-incident review turns an incident into a lesson. It asks what happened, what worked, what didn't and what should change. A blame-free review leads to better results.
6. Tools you'll need

   6 min · Lesson notes, example, action task · 2-question quiz

   Incident response can be run with documents, shared contact lists and built-in security features. Specialist tools add monitoring and case management as the organisation grows.
7. Careers & next steps

   6 min · Lesson notes, example, action task · 2-question quiz

   Incident response knowledge is used in cyber security, IT operations and risk roles. This lesson sets out typical paths and how to check what the work is worth.
8. Final quiz and certificate

   10 questions, pass mark 8 of 10. Pass to get your Reesby Academy certificate with a verification link.