Advanced · Self-paced learning
Inquiry This course is not yet bookable.
When an alert suggests a cyber incident, it may initially be unclear what has been confirmed, who can decide and which action should come first. This course addresses the management decisions of the first 120 minutes. Working with a case from your own organisation or a course case, you set an escalation threshold and the initial escalation route. You prepare a situation picture that distinguishes observations, assumptions, open questions and possible consequences.
You then justify two initial leadership decisions, recording decision authority, uncertainty and the next checkpoint. You compare your decisions with two annotated examples. The first considers whether to isolate an affected system immediately or wait briefly: isolation may limit the spread but interrupts a critical service, while waiting requires monitoring and a fixed time for review. The second shows the possible consequences of implementing an instruction late.
You build a first-response package with an escalation checklist, situation template and decision log. Before using it in your organisation, you review it with the responsible roles. The planned self-study course takes about three hours and focuses on management rather than technical incident response.
Your first-response package includes an alerting procedure and escalation checklist, an initial situation picture or report, first actions and a decision log. It helps you prepare your organisation’s first steps.
Experience in a leadership, crisis-team or escalation role. For an organisational case, you need access to escalation, role or emergency-management information. If it is unavailable or confidential, use a course case. Technical incident-response knowledge is not required.
Planned self-study offering of about three hours with brief expert inputs, one continuous case, annotated decision examples and your own revision. You can complete it independently.
Planned learning time: 3 hours
