Federal Incident Response for Agency Practitioners Course

This course develops the capability to run a federal incident response program from end to end — not simply reacting to a single case, but designing, operating, and steadily improving the program behind it.

The structure follows NIST SP 800-61 Revision 3, which frames incident response against the six NIST Cybersecurity Framework 2.0 Functions instead of the older standalone four-phase model. Govern, Identify, and Protect account for the preparatory work that lowers both the odds and the cost of an incident. Detect, Respond, and Recover account for the reactive work of finding it, containing it, and restoring operations. Improvement returns lessons learned to the preparation side continuously, rather than only once a case closes.

Mandatory federal reporting duties run through the Respond function throughout, because reporting clocks start at detection rather than at closure. The course ends with a full-lifecycle capstone simulation and a tabletop exercise design workshop, worked alongside the instructor, so practitioners leave able to build and facilitate their own exercises back at the agency.

Target Audience

Agency ISSOs, SOC and CSIRC analysts and managers, IT security program managers, staff supporting Authorizing Officials, privacy-office liaisons, and OIG or CISO staff whose work touches incident response.

What You'll Learn at a Glance

• Describe the governance and legal basis for federal incident response — FISMA, NIST SP 800-61 Rev. 3, OMB memoranda, and CISA directives — and explain how the Govern function anchors the program
• Explain how the Identify and Protect functions put readiness in place ahead of any incident
• Detect and classify incidents with NCISS scoring and the federal incident categories
• Carry out containment and eradication while preserving evidence and coordinating across stakeholders
• Determine which mandatory reporting obligations attach to a given incident, and meet the deadlines
• Carry out recovery actions and recovery communications that restore operations
• Run a structured post-incident review and turn the findings into program improvements
• Design and facilitate a tabletop exercise, including scenario design and a Master Scenario Events List (MSEL)
• Walk a simulated incident through the full lifecycle, from detection to after-action report

Course Syllabus

• Module 1. Program Governance and Risk Management Strategy 
• The federal IR landscape, the IR charter and CSIRC/SOC standup, roles and a RACI matrix, program maturity and metrics
• Module 2. Risk-Informed Readiness 
• Asset and risk awareness that tunes an IR program to the agency's real exposure, and the preventive controls and workforce readiness that keep detection and response from being overwhelmed
• Module 3. Detection and Classification
• Detection sources and the 2026 logging baseline, triage and NCISS scoring, determining major-incident status, applied classification exercise
• Module 4. Containment and Eradication 
• Containment strategy, coordinating across on-premises, cloud and OT environments, evidence preservation and chain of custody, root cause analysis and eradication
• Module 5. Incident Reporting, Notification and Communication 
• The one-hour CISA notification, the seven-day congressional notification and annual FISMA reporting, PII and breach-specific notification, and a horizon scan of pending rules
• Module 6. Restoration and Recovery Communication 
• Phased restoration and return-to-operations sign-off, aligning recovery with binding remediation deadlines, and keeping leadership and oversight informed
• Module 7. Post-Incident Review and Lessons Learned
• After-action methodology, root-cause-to-control mapping, closing the loop back into governance and readiness
• Module 8. Tabletop Exercise Design
• Exercise design fundamentals and MSELs, building realistic scenarios, facilitation and evaluation, and a design workshop
• Module 9. Capstone Simulation and Program Self-Assessment 
• A full-lifecycle simulated incident worked through every Function in sequence, then a program self-assessment and 90-day action plan