Incident Response and Forensics

1. Understand the role and composite parts of Incident Response as a business function and how CERTS operate

1. Explain the people, structures, processes and tools involved in Computer Incident Responses
2. Discuss the different roles within a Computer Emergency Response Team and their importance

‍

2.  Understand aligned task/task forces for Business Continuity, Disaster Recovery and Crisis Management

1. Explain the terms BC, DR and CM
2. Analyse the standards, protocols and concepts underpinning BC, DR and CR and their application within organisations

‍

3.  Understand how major computer incidents are formally investigated

1. Explain the processes, people and tools used in a planned and structured major incident investigation
2. Analyse how evidence is contained, analysed, processed and deployed in a major cyber-related investigation

‍

4.  Understand laws and guidance in relation to the conduct of planned and structured major incident investigations

1. Examine how relevant laws and professional practice are applied to computer incident investigations

• The assessment strategy for this course is designed to test all the learning outcomes.
• Learners must demonstrate successful achievement of all learning outcomes to pass the course.

• The assessment criteria for a pass will be presented with the summative exercise.
• Further information and guidance on the assessment will be made available through the tutor.

To pass the unit a 40% overall grade must be achieved.