Course Overview
Confronting major cyberattacks requires strategic leadership capable of making crucial decisions under pressure to protect the organization’s assets and reputation. This specialized course aims to qualify Security Operations Center (SOC) leaders and managers to establish incident management and governance programs, build and lead Computer Security Incident Response Teams (CSIRT), and manage major cyber crises like ransomware. It also covers mastering executive communication skills, handling legal aspects, and conducting executive tabletop exercises to elevate security maturity levels.
Course Objectives
- Establish and govern a comprehensive cyber incident management program and build response plans and Standard Operating Procedures (SOPs & Playbooks) according to national and international standards.
- Efficiently lead incident response teams (CSIRT / SOC), define authorities, and set Key Performance Indicators (KPIs) while managing workload and shift pressures.
- Master tactical leadership during critical crisis hours, conduct Business Impact Assessments (BIA), and make decisive containment and isolation decisions.
- Manage internal communication with senior management, external and media communication, and coordination with regulatory and legal authorities during breaches.
- Design and manage executive Tabletop Exercises and extract lessons learned to enhance SOC maturity.
Target Audience
- Security Operations Center Managers (SOC Managers) and Security Team Leaders.
- Chief Information Security Officers and Information Security Managers (CISOs & InfoSec Managers).
- Cyber Incident and Emergency Response Team Leaders (CSIRT / CERT Leaders).
- Specialists in cyber risk and crisis management and business continuity within organizations.
Course Syllabus
The course modules are divided over 5 days as follows:
Day 1: Governance and Establishment of the Cyber Incident Management Program
- The strategic framework for cyber incident and crisis management and its alignment with organizational objectives.
- Building and developing Incident Response Plans (IRP) and policies.
- Designing Standard Operating Procedures (SOPs & Playbooks) for various types of attacks.
- Compliance with national and international regulatory standards and guidelines (such as NCA controls and the ISO 27035 standard).
Day 2: Building and Leading Response Teams (CSIRT / SOC Leadership)
- Organizational structures for SOC and Emergency Response Teams (CSIRT) and defining responsibilities (RACI Matrix).
- Managing human and technical resources, and organizing shift schedules (24/7 Shift Management).
- Handling workload pressure and preventing Analyst Burnout during prolonged crises.
- Defining Key Performance Indicators and metrics for the security center (SOC KPIs & Metrics such as MTTD and MTTR).
Day 3: Tactical Leadership and Decision Making During Cyber Crises
- Activating the operations room and managing the crisis during the critical early hours (Golden Hours).
- Evaluating the Business Impact Assessment (BIA) and estimating operational and financial risks.
- The methodology of making critical decisions under pressure (such as disconnecting live systems or stopping services).
- Managing major ransomware incidents (Ransomware Crisis Management) and handling negotiations and extortion.
Day 4: Communication Management, Legal Affairs, and External Parties
- Internal communication strategies and executive reporting to top management and the board of directors (C-Level Reporting).
- Managing external communication and Public Relations (PR) and protecting the organization’s media reputation during a breach.
- Coordinating with legislative and regulatory bodies, law enforcement agencies, and cyber insurance companies.
- Legal aspects of cyber incidents, preserving evidence for litigation, and handling data protection obligations.
Day 5: Post-Incident Phase and Tabletop Exercises
- Managing Post-Incident Review meetings and extracting Lessons Learned.
- Translating incident outputs into continuous improvement plans to enhance organizational defenses and SOC Maturity.
- How to design and manage executive Tabletop Exercises (TTX) to test team readiness.
- Practical leadership application: Managing a comprehensive cyber crisis scenario (Tabletop simulation) and evaluating administrative decisions.
Expected Impact on the Trainee
- The ability to build and lead a comprehensive cyber incident and crisis management system compliant with national and global standards.
- Elevating SOC team efficiency and reducing Mean Time to Detect and Respond (MTTD & MTTR) through effective leadership and precise performance metrics.
- Making sound strategic and tactical decisions during major crises that maintain business continuity and minimize financial and operational losses.
- Mastering the management of media, legal, and executive communication files during breach incidents to protect the organization’s reputation and legal standing.
This course serves as the foundational pillar for every security leader aspiring to transition from daily technical management to comprehensive strategic leadership of cyber crises, ensuring organizational readiness and resilience against the most complex threats.
