This program is the complete federal incident investigation credential. Participants run a federal incident response program from governance and readiness through detection, containment, recovery, and lessons learned, then specialize in the investigative craft: the forensic process that makes findings defensible, and the malware analysis that explains what actually happened. The sequence is deliberate: response teaches what to do under time pressure, forensics teaches how to prove it afterwards, and malware analysis teaches how to answer the question everyone asks first, which is what the thing did. It prepares participants for federal incident responder, digital forensic examiner, and SOC investigator roles, and toward the GIAC GCIH and GCFE credentials. The program aligns to NIST SP 800-61 Rev 3, SP 800-86, and SP 800-83, to CISA reporting obligations, and to the CSF 2.0 Functions.
Target Audience
This course is for Federal Incident Responders, SOC Analysts moving into investigation work, ISSOs and ISSMs who own incident handling, and contractor staff supporting federal incident response programs.
Courses in this Certificate Program
This is the recommended order, but some courses may be taken in a different order.
Federal Incident Response for Agency Practitioners Course
This course gives federal incident response practitioners the operational grounding to detect, contain, and recover from cybersecurity incidents while satisfying FISMA, US-CERT, and OMB mandatory requirements. Participants build working skill across the full NIST SP 800-61 Rev. 3 incident response lifecycle — preparation, detection and analysis, containment, eradication and recovery, and post-incident review.
- Governance and the legal and policy basis for federal IR (FISMA, NIST SP 800-61 Rev. 3, OMB, CISA).
- Detecting and classifying incidents with NCISS and the federal incident categories.
- Determining which mandatory reporting obligations apply and meeting the deadlines.
- Containment, eradication, and recovery carried out without compromising evidence.
- Post-incident reviews that drive real program improvement.
- Tabletop exercise design and facilitation, including a MSEL.
- Working a simulated incident from detection through to the after-action report.
Digital Forensics and Incident Investigation for Federal Employees Course
Conduct defensible digital forensics and incident investigations using the NIST SP 800-86 forensic process — Collection, Examination, Analysis, and Reporting. Participants work through IOC investigation, chain of custody, and the federal legal and oversight framework, then bring it together in a full capstone investigation.
- The NIST SP 800-86 forensic process, tied back to the NIST SP 800-61 IR lifecycle.
- The legal and policy foundations for federal digital evidence, including when a matter goes to OIG, counsel, or law enforcement.
- Evidence collected and preserved in order of volatility — memory, disk, network, cloud — free of contamination.
- IOC investigation across host, network, and behavioral data to fix scope and build a timeline.
- Reconstruct timelines and correlate artifacts, with a clear sense of what forensic evidence can and cannot prove.
- Hold a defensible chain of custody and write findings for technical, executive, and legal readers.
Malware Analysis Fundamentals (Intermediate) Course
Work through both static analysis (examining files without running them) and dynamic analysis (interpreting behavior from sandbox and monitoring reports), and build the judgment to know which technique fits each situation. Following NIST SP 800-83 Rev. 1, the course brings in the tools analysts rely on — disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen — with a federal thread on sample sensitivity and data handling throughout.
- Static analysis technique: triage, string and metadata extraction, YARA, and basic disassembly
- Reading dynamic analysis output (sandboxing, monitoring, network simulation) and evasive behavior from example reports
- Capturing network IOCs and correlating them with threat intel and MITRE ATT&CK
- Using FLARE-VM, REMnux, and CISA Malware Next-Gen appropriately, as against public multi-scanners
- Writing a CISA-MAR-style report for technical and leadership readers
- Tracking one sample from triage through to the finished report
What You'll Learn at a Glance
- Take a federal incident from first detection through to closure and reportin
- Meet CISA and FISMA notification obligations under time pressure
- Collect and examine digital evidence in a defensible, repeatable way
- Determine what a piece of malware did without needing to execute it
- Produce investigation artifacts that hold up to scrutiny
