CIPR-AI: Cyber Incident Planning & Response Course for the AI Era

• Mind Map: Comprehensive exercise on planning for a Cyber-attack
• Process Workflows: Creating an Incident Response Strategy
• Process Workflows: Selecting Threat Actors
• Process Workflows: Creating a Breach Readiness Framework
• Process Workflows: Responding to an Incident
• Defending against the Cyber Kill Chain
• Visibility: Identifying your Crown Jewels
• Visibility: Identifying Critical Log Data
• Worksheet: Identifying Privileged Threat Actors
• Worksheet: Defining & Base-lining 'Normal'

This module starts by emphasising the importance of asking the question - WHY? Why would an attacker attack your organisation? It delves briefly into the psychology of attacks and builds the foundation for Module 2. In addition, this module introduces the core concept of resiliency in the context of cyber. The module offers:

• A mind-map that will help you answer this question and also understand what the attacker intends to do with your crown jewels.
• Explanation of the “whys” with relevant real-world examples.
• A definition of the ‘Security Fallacy’ and how to work around it.
• An understanding into why merely denying entry to criminals isn’t enough.

New for 2026: resilience as NIST now frames it, with incident response as part of governance and risk management, led from the top.

For full details on this and other modules click here.

Threat actors may sound daunting but fear not. After asking the question, “Why” in the first module, this cyber threat actor section discusses the importance of asking - WHO could damage your critical assets and consequently destroy your business. This section explains the importance of knowing details about your attacker(s) who could target your business. This module offers:

• An introduction to threat actors, intent and attributes.
• Threat actors in detail.
• The TAL or threat actor library and its purpose.
• Building the Threat Actor Profile.

New for 2026: AI-enabled attackers, criminals who rent ransomware tools, and fake remote IT workers added to your list of likely attackers.

For full details on this and other modules click here.

Another key concept in the Cyber Incident Planning & Response course, Define Normal introduces the important idea of baselining or defining an organisational normal and explains its importance in building a cyber resilient business. It goes without saying, unless you can define and understand what’s normal for your digital network, it will be almost impossible to rapidly detect the abnormal. In this module, you will learn:

• The importance and relevance of this concept, with examples.
• How to define ‘normal’ for your organisation based on the nature of your business, scale, operational model etc.
• Applying 'Define Normal' in an organisational context.
• Understanding and building the organisational baseline.

New for 2026: knowing what normal looks like now covers cloud apps, user accounts and AI agents (AI tools that take actions on their own), not just networks.

For full details on this and other modules click here.

Cyber criminals follow a process and have their own easy-to-follow attack methodology. In this module (also known as the cyber-attack process), we disclose the specific workflows that the majority of advanced and/or smart criminals utilise when they attack organisations and nation-states.

In these four modules, you will learn:

• The different phases of attack methodologies.
• Analysis of the Cyber Kill Chain (Lockheed Martin).
• The importance of knowing the process flows that can help in the understanding of specific threat models and methodologies.
• Strategies to counter the Cyber Kill Chain.

New for 2026: real attacks mapped to MITRE ATT&CK (a public catalogue of attacker techniques), and AI attacks to MITRE ATLAS (its AI equivalent), alongside the Cyber Kill Chain.

For full details on this and other modules click here.

In this module, we introduce an important strategy - the concept that every business must focus on if it wants to increase its breach response and preparedness. The notion that if you stand in a dark room you are blind and oblivious to the surroundings may seem obvious, but this very fact is ignored and overlooked by organisations when planning and strategising on breach-readiness. In this module, students learn:

• What is visibility and why it's so important as a strategic item in a cyber resiliency strategy.
• The key and core concepts and terminology to better understand its overall impact on resilience.
• The importance of log data and its relationship and importance to cyber resilience.
• The primary requirements for increasing visibility in an organisation.

New for 2026: which logs you need when the attack is in Microsoft 365, another cloud app or an AI agent, and how long to keep them.

For full details on this and other modules click here.

The pivotal moment, the ‘golden hour’ and many other important concepts and strategies are discussed in this section.

• Module 6a deep dives into the ‘golden hour’, its relevance in incident response and its overall importance in the whole incident management lifecycle. This particular module goes deeper into the important aspects of the golden hour, discusses the importance of taxonomy and communications along with introducing and explaining the critical phase of triage and its role in incident response.
• Module 6b & 6c discuss standards and workflows on incident management introducing several different terms and approaches on optimising existing processes and procedures while maintaining alignment with the various standards and touch on the key benefits of incident response playbooks.
• Module 6d takes the student through an exhaustive thought process on creating an effective and fit-for-purpose incident response plan with a comprehensive exercise utilising a mind-map based approach.

New for 2026: rebuilt on NIST SP 800-61 Rev 3. The familiar response steps now link to the six NIST CSF 2.0 functions, and you learn which reporting deadlines start in the first hour.

For full details on this and other modules click here.

Building a great cybersecurity team also involves walking the tightrope between having a great internal team and liaising with external experts wherever necessary. In this module on Building the Team, students will learn:

• Identifying the stakeholders, the 'who' and 'what functions' should be included in the core cyber incident management team.
• Key skills and traits that are essential in members of an effective cyber incident response team.
• Why contextual experience is more important than technical knowledge when building an incident response team.
• The importance of encouraging a culture of speaking up in the team, regardless of seniority or experience.

New for 2026: board and director responsibilities from the UK's Cyber Governance Code of Practice (2025), and who can switch off an AI system.

For full details on this and other modules click here.

Forensics and evidence are often overlooked in cyber incident management. Many IT professionals don't have enough experience in handling evidence the right way. Dealing with a cyber-attack requires the ability to ensure chain of custody and ensure the evidence is captured, protected and processed in a way that it can be presented in court without anyone being able to challenge the integrity of that evidence. Delving further into this subject, in this module, we cover:

• Introduction to forensics principles.
• Why organisations must sensitise their employees about the regulatory requirement to protect evidence and ensure its forensic integrity.
• What is a forensics policy, how it can be created and what should its key constituents be?

New for 2026: evidence from cloud and AI tools, including what people typed into AI tools (prompts), actions taken by AI agents, and audit logs.

For the full details on this and other modules click here.

The actions that an organisation takes before, during and after an incident can have legal and or financial repercussions. It is imperative, therefore, that the management, IT and Security teams understand the regulations and standards that apply to them and have a well-defined set of policies to cover these regulations. In this module, we cover:

• The legal, financial or reputational impact that a business can suffer on account of incorrect actions.
• A look at some common regulations and standards that businesses should be aware of.
• What is a breach notification and how is it defined in the GDPR?
• The fines that GDPR stipulates on businesses that are in breach of its regulations.

New for 2026: a "Which rules apply to you?" exercise that leads into Day 2.

For full details on this and other modules click here.

It goes without saying that technology plays an extremely crucial role in all aspects of cyber incident response and management. The challenge is that most organisations have a messy and complex technology stack. A huge part of the objective of cyber incident planning and response is to evaluate your technology stack and ensure that it is optimised and ready for a cyber-attack. In this module, students will learn:

• The common mistakes organisations make while buying technology and building a technology stack.
• The problems a disorganised and incoherent technology stack can create for the business in case of an incident.
• Understanding the technologies that underpin an effective breach-ready organisation.
• Analysis of core technology requirements.

New for 2026: where AI genuinely helps detection and response, and where it adds risk.

For full details on this and other modules click here.

This module focuses on the communications challenges that arise during cyber incidents and crises. It examines internal stakeholder communications, customer and supplier notifications, regulatory communications and media engagement. The module highlights the importance of:

• Delivering timely, accurate and transparent communications
• Crisis communications that support effective incident management
• Maintaining stakeholder trust during a crisis
• Protecting organisational reputation during and after a cyber incident

New for 2026: deepfakes in a crisis, verifying statements, and communicating when email and Microsoft Teams are compromised.

CIPR-AI is the 2026 edition of our NCSC Assured Cyber Incident Planning & Response course. Every module has been updated for 2026, the course is aligned to NIST SP 800-61 Rev 3 and the NIST Cybersecurity Framework 2.0, and there are three new modules: AI Incident Response; Ransomware Incident Response; Identity, SaaS and Third-Party Incidents. Every new topic is taught through interactive exercises.

Yes. CIPR-AI is built on the NCSC Assured Cyber Incident Planning & Response course, assessed and certified by APMG International under the NCSC Assured Training scheme. Day 1 Modules 1–11 are the NCSC Assured core and are covered by the optional APMG examination. Day 2 (the three new modules and Regulated Incident Response) and the 2026 modules and updates are CMA additions and are not examined.

Yes. The AI Incident Response module covers deepfake fraud, attacks on the AI tools you use and hijacked AI agents, and the reporting that follows: UK GDPR personal data breaches, sector rules such as NIS2 and DORA, and the EU AI Act where it applies to you. Most organisations use AI rather than build it. Under the EU AI Act, the companies that build high-risk AI systems must report serious incidents; organisations that use them must tell the provider and the authorities. After the EU's 2026 changes to the AI Act, these duties apply from 2 December 2027 for most systems. You practise the decisions in a live exercise.

Yes. Day 2 covers DORA, NIS2, UK and EU GDPR, ISO/IEC 27001:2022 and the UK Cyber Assessment Framework, plus the UK NIS Regulations 2018, the FCA and PRA incident reporting rules that apply from 18 March 2027, and Swiss reporting duties to BACS, FINMA and the FDPIC. You practise meeting several reporting deadlines at once on one incident.

Yes. The Bill is before Parliament and is not yet law. We show what it proposes, including a 24-hour initial notice and a 72-hour full report, against today's NIS rules, so your plans are ready when it becomes law. We will update the content when the final text is published.

No. Existing clients and past CIPR delegates can purchase Day 2 only without repeating Day 1. The first three modules are AI Incident Response, Ransomware Incident Response, and Identity, SaaS and Third-Party Incidents, followed by Regulated Incident Response and case studies. There is no half-day option. See "Past CIPR delegates: upgrade to CIPR-AI" above.

Cyber Incident Planning and Response Training is a cybersecurity course that teaches organisations how to prepare for, manage and recover from cyberattacks and data breaches. It covers incident response frameworks, threat detection, response procedures and cyber resilience best practices.

This course is suitable for CISOs, security managers, IT professionals, incident response teams, compliance officers, business leaders and non-technical managers involved in cyber incident management and organisational resilience. No advanced technical knowledge is required.

Participants learn how to implement incident response frameworks, identify and manage cyber threats, improve detection and response capabilities, develop response strategies, understand regulatory requirements, and coordinate effective communication during a cyber incident.

Yes. The course offers an optional examination through APMG International. Upon successful completion, participants can earn a recognised certification demonstrating their knowledge of cyber incident planning and response.

The CIPR course can be delivered privately for your team, either in-house or as a dedicated virtual class, with scheduling arranged around your organisation’s availability. Private delivery lets you train multiple staff together and tailor the discussion to your own environment and risks. To arrange it, book a discovery call or contact the CM-Alliance team, who will help you confirm dates, format and numbers.

NCSC Assured training is independently assessed by APMG International, an accreditation body, against the NCSC's standard, so you can be confident it meets a recognised quality benchmark. Courses like CIPR improve readiness by teaching a structured, repeatable approach to incident response — based on the NIST framework — that reduces the time taken to detect and respond to attacks, clarifies roles and decision-making under pressure, and aligns technical and non-technical staff around a common plan before a real incident occurs.

Effective training combines a proven framework with real-world application. The CIPR course is built on NIST SP 800-61 Rev 3 and ISO/IEC 27001:2022 objectives, is delivered by a practising Chief Information Security Officer (CISO) with decades of incident response experience, and uses realistic, scenario-based discussion rather than theory alone. Because it has no technical pre-requisites, entire teams — technical and non-technical — can learn together and leave with strategies they can apply immediately.

The CIPR course is available in three formats: self-paced eLearning with immediate online access; scheduled live virtual classroom sessions led by an expert facilitator; and private or in-house delivery for organisations that want to train a group together. An optional examination and certification through APMG International is available with each format.

The course teaches you how to apply NIST SP 800-61 Rev 3 and how to meet the objectives of the ISO/IEC 27001:2022 incident management controls (5.24–5.28 and 6.8), mapping recognised international standards to practical, day-to-day incident response. By giving your team a structured approach to preparation, detection, response and recovery, it helps raise your overall incident response maturity and provides evidence that your organisation actively tests and improves its capabilities.