Building and Optimising Incident Response Playbooks

This NCSC Assured Training - Building and Optimising Incident Response Playbooks,  teaches you how to create NIST SP 800-61 R2 and NIST CSF compatible incident response playbooks to respond to a variety of simple and complex cyber-attacks and data breaches.

Unlike a traditional crisis like an earthquake or flood, a cyber-crisis is often invisible and near impossible to detect in the early stages. In a majority of cyber-attacks, by the time a business detects the attack, it is often too late. The data has been stolen , the media knows about your data-breach and your customers are worried their personal data may be in the hands of criminals.

Benefits of the Certified Playbooks Course

Individual Benefits:

As an individual, after you complete the Playbooks course you will be able to:

• Create basic and advanced cyber incident response playbooks.
• Analyse, improve and optimise existing incident response procedures. 
• Create effective attack scenarios with supporting response playbooks. 
• Run effective cyber incident response workshops to support continuous improvement in cyber resilience processes and procedures. 
• Understand the role of SOAR (Security Orchestration and Response) and the tools that you can use to implement SOAR.

  ---

Organisational Benefits

When run internally, the NCSC Assured Training in Building & Optimising Incident Response Playbooks (Playbooks) workshop brings significant benefits to an organisation including, but not limited to:

• Significantly improving your organisation's speed of response to cyber-attacks.
• Achieve better legal and regulatory compliance and meet respective geographical breach notification requirements.
• When held internally, we conduct a consultative review of your existing response processes, procedures and playbooks.
• Ensure continuity and consistency in both your technical and managerial responses during a regular incident or a cyber crisis.

E-learning & Virtual Classroom: 

The playbooks training is available as an eLearning (also called Self-paced Learning) option and as a virtual classroom training. For the virtual training we use Zoom 

Highlights of the Course

• 12 modules designed specifically to cover this topic. 
• Highly interactive course with several exercises to ensure maximum learning. 
• Bonus content including playbook templates, workflow and more. 
• This is the only course that teaches you how to create playbooks.

Testing Playbooks with Cyber Tabletop Exercises: 

You can combine the Internal Playbooks training with our Cyber Crisis Tabletop Exercise (CCTE)  workshop to formally test your playbooks in a simulated cyber-attack environment. You can find more information on Cyber Crisis Tabletop Exercises here or if you prefer, you can book an appointment with us to discuss this option in more detail. 

Playbooks Learning Objectives:

• Learn what it takes to create, review and optimise cyber incident response playbooks.
• Understand the technology that can underpin the creation, optimisation and automation of playbooks.

• Key components of an incident response playbooks.
• Importance and role of effective playbooks in increasing organisational cyber resilience.
• Importance and role of fit-for-purpose, effective playbooks in increasing compliance with breach notification requirements, like the 72 hours data-breach-notification requirement from the GDPR. 
• Benefits of having a structured, repeatable way to respond to cyber-attacks.
• Benefits of Incident response playbooks and how they impact staff efficiency.
• Benefits of using technological solutions to create, automate and improve playbooks. 

• Create basic and advanced cyber incident response playbooks.
• Work with and contribute to better articulated risk management.
• Host and run ongoing workshops to continually review and improve response playbooks.
• Assess, deploy and implement automation in incident response and playbooks.
• Review and improve existing incident response playbooks.
  
  

Target audience

Feedback and Testimonials for the Playbooks Workshop

Continuing Professional Development

•  (ISC)2 members can claim 8 CPE points after they complete the whole course and obtain the attendance certification.
• ISACA members can claim 8 CPE points after they complete the whole course and obtain the attendance certification.

About the NCSC - National Cyber Security Centre

Launched in October 2016, the NCSC or National Cyber Security Centre is headquartered in London and brings together expertise from CESG (the information assurance arm of GCHQ), the Centre for Cyber Assessment, CERT-UK, and the Centre for Protection of National Infrastructure.

The NCSC Assured training is designed to assure high-quality training courses delivered by experienced training providers. The courses are assessed at two levels, namely, awareness and application.

This course has been certified for the application level of incident response in the areas of Risk Assessment, Business Continuity Planning and Incident Management. The Application level is for anyone looking for in-depth courses for their professional development.

The Chartered Institute of Information Security (CIISec) is the only pure-play information security institution to have been granted Royal Charter status and is dedicated to raising the standard of professionalism in information security. CIISec represents professionalism, integrity and excellence within the information and cybersecurity sector.

The NCSC Assured Training and the Chartered Institute of Information Security's (CIISec) accreditation enables organisations to distinguish between reputable courses and ones that have not been validated using a Government-endorsed assessment process.

Meet the Trainer 

Amar Singh has a long history and experience in data privacy and information security. Amar has served as CISO for various companies, including News International (now News UK), SABMiller, Gala Coral, Euromoney and Elsevier. Amongst various other activities, Amar is a Global Chief Information Security Officer and Trusted Advisor to a number of organisations including a FTSE100 firm, and is chair of the ISACA UK Security Advisory Group. He also founded the not-for-profit cybersecurity service for charities, Give01Day.

Amar has the highest integrity and is trusted by FTSE100 companies with some of the most sensitive commercial information. He has been involved with highly sensitive forensic investigations.

He has the ability to deal with both technically-astute, board-level executives and lead an organisation's information security direction. Apart from his experience and abilities, Amar holds a number of industry-recognised certifications, such as ISO 27001 Certified ISMS Lead Implementer, MoR, CRISC and CISSP certification.

Amar is an industry-acknowledged expert and public speaker and is regularly invited to speak and share his insights by some of the largest and most respected organisations in the world including The BBC, The Economist’s Intelligence Unit, The Financial Times, SC Magazine, InfoSec Magazine, Computer Weekly, The Register and the AlJazeera English Channel.

All trademarks, service marks, trade names, product names, service names and logos appearing on the site, or on printed or digital material are the property of their respective owners, including in Cyber Management Alliance Ltd. Any rights not expressly granted herein are reserved.