ISO/IEC 27035 Lead Incident Manager

Learning objectives

• Understand the core concepts of information security incident management as defined by ISO/IEC 27035
• Design and implement a compliant information security incident management process
• Lead an incident response team (CSIRT/CERT) and manage crisis communications
• Assess, classify and prioritise security incidents based on their impact and criticality
• Apply digital evidence collection and computer forensics techniques
• Produce incident reports, lessons-learned reviews and continuous improvement plans
• Prepare for the PECB Certified ISO/IEC 27035 Lead Incident Manager exam

Target audience

• CISO / Security managers
• SOC analysts
• CSIRT / CERT members
• Cybersecurity consultants
• Risk managers
• IT auditors

Prerequisites

• Basic knowledge of information security
• Familiarity with IT risk management recommended
• Knowledge of ISO/IEC 27001 is an advantage
• IT or cybersecurity experience advised

Training programme

Day 1 : Introduction to information security incident management

ISO/IEC 27035 standard: structure and scope · Incident lifecycle · Governance and incident management policy · Regulatory framework (GDPR, NIS2, DORA)

Day 2 : Incident preparation and detection

Setting up a CSIRT/CERT · Security incident classification · Detection tools (SIEM, EDR, IDS) · Escalation procedures and RACI matrices

Day 3 : Incident response and containment

Incident response process: isolation, eradication, recovery · Digital evidence collection · Computer forensics · Coordination with internal and external stakeholders

Day 4 : Crisis communication and legal obligations

Internal and external crisis communication · Notification to authorities (DPA, ANSSI, national CERTs) · Media relations management · Crisis simulation exercises