Security arrangements around cyber incident response and recovery are tested by adversaries, not by auditors. Most security failures involving response and recovery exploit a process gap rather than a technical one. It is designed for mixed groups, so that this strand of corporate security practice is examined from more than one functional angle. The most reliable predictor of sound cyber incident response and recovery is whether anyone reviews it when nothing has gone wrong. Participants take away a working set of documents supporting the corporate security practice capability, ready to be adapted internally. Cases are chosen to expose the trade-offs in response and recovery rather than to illustrate ideal conditions. The programme is built to be used, and every section of cyber incident response and recovery it covers ends in something applicable. Buying a tool rarely fixes response and recovery; the underlying capability has to be built internally first. The final module sets out how progress on this area of corporate security practice will be evidenced six months later.
Expected Learning Outcomes
✓
Align cyber incident response and recovery with the wider objectives of the protected site rather than optimising it in isolation.
✓
Assess the current state of response and recovery against a structured set of criteria rather than impressions.
✓
Build the investigation capability and evidence handling for cyber incident response and recovery.
✓
Verify that improvements to response and recovery have held six months after they were introduced.
✓
Identify vulnerabilities in cyber incident response and recovery and rank them by consequence.
✓
Design surveillance coverage for response and recovery that supports investigation.
✓
Protect information and intellectual property within cyber incident response and recovery.
Who Should Attend
✓
Contract managers overseeing outsourced security in cyber incident response and recovery.
✓
Facility and site managers accountable for protection of response and recovery.
✓
Officers preparing reports on cyber incident response and recovery for boards or oversight committees.
✓
Human resources staff handling vetting and insider risk in response and recovery.
✓
Business partners who must understand cyber incident response and recovery well enough to challenge it.
✓
Guard force supervisors delivering response and recovery.
