Incident Response for an Organisation

課程簡介

An analyst escalates. They say some version of "this is bigger than a ticket". Almost every organisation has written material covering everything up to that sentence and nothing at all covering the ten minutes after it. This segment is those ten minutes, and the four days that follow. Who is allowed to say the word incident, and what it costs them to be wrong. Who is woken at three in the morning, on what number, held on what piece of paper, and what happens when both the accountable executive and her deputy are unreachable. Which clocks start running, who in your organisation answers each one, and why any deadline you memorise on a course is the wrong number for somebody. What you must not write down while it is still running, and the four-part form that replaces it. Then the tabletop, run properly rather than described — a ninety-minute script with six timed injects — and the report that follows, which contains exactly three changes and not eleven. Every lesson produces a document you can put in front of a director. A declaration rule. A leaver-incident checklist with an owner against each of six decisions. A decision log. A role card. A printed call tree with a test date on it. A delegation ladder with thresholds you could apply at 03:00. An obligations table in which every cell holds a document and a role rather than a number. Four notifications written from one fact set. A tabletop design sheet, a filled observer sheet, and a post-incident report with three changes, three owners and three tests. Two cases run through it that are never an analyst's to close: a departing employee who took the client list, and a payment approved outside the process that had already left the account an hour before anybody noticed. One ransomware case runs through modules 2, 3 and 4, and it stops at the decisions — the restore, the recovery point and what a faster recovery tier costs belong to segment R6. Nothing in this segment is legal advice, and it contains no notification deadlines. Disclosure obligations differ by jurisdiction, sector and contract, and they change. Every obligation here is written as a question you answer for your own organisation, with the source named and dated.

1. 01 When It Stops Being a Ticket

   3 堂課程·1h 36m

   Segment C2 is the analyst's half of this subject and it ends at an escalation. This module begins at that sentence. If a lesson here tells you what to type, it has drifted into C2 and you should…

2. 02 The Roles and the Call

   3 堂課程·1h 39m

   Everything in module 1 assumed somebody could be reached. This module is about the machinery of reaching them, and about what the organisation is allowed to do when nobody can be. The ransomware case…

3. 03 The Clock

   3 堂課程·1h 41m

   This module gives you no deadlines. Notification duties differ by jurisdiction, sector, regime and contract, and they change; a number memorised on a course is the wrong number for somebody. What is…

4. 04 The Tabletop and What It Changes

   3 堂課程·2h 47m

   A tabletop is not a test that the plan works. It exists to find where the plan is silent, which is why it is designed so that nobody can win it. The product is a findings list, and the product of the…

常見問題

我將在 Incident Response for an Organisation 中學到什麼？

Who declares an incident, who is woken, who is allowed to speak, which clocks are running, and the tabletop that finds out whether any of it is true. The organisation's half of incident response — the analyst's half is segment C2.

我需要事先具備經驗嗎？

建議在開始 Incident Response for an Organisation 前具備一些先備知識。

Incident Response for an Organisation 需要多長時間？

Incident Response for an Organisation 包含 4 個單元和 12 堂課程。你可以按自己的進度學習。

我如何取得存取權限？

Incident Response for an Organisation 包含在任何付費訂閱方案中。