This 16-hour course provides guidance on building and executing a robust cybersecurity incident recovery program, covering both pre- and post-incident stages. It bridges IT and emergency management to help government, critical infrastructure, and private-sector personnel effectively respond to and recover from cyber disruptions.
Through interactive discussion and practical exercises, participants will learn best practices and tactical strategies for restoring operations following a cyber-attack. By the end of this course, you’ll be equipped to strengthen organizational resilience, manage cyber incidents more effectively, and build an action plan for continued readiness.
As part of a Department of Homeland Security/Federal Emergency Management Agency (DHS/FEMA) cooperative agreement training program, this course is available at no direct cost to state, county, and local government agencies.
Key Topics Include:
- Understanding essential cyber terminology and the cyber incident life cycle
- Recognizing threat levels and exploring emergency management practices
- Examining the recovery continuum and government’s role in cybersecurity
- Integrating cyber into the Incident Command System (ICS)
- Leveraging federal resources and key programmatic elements that drive successful recovery
- Learning how to plan, organize, equip, train, and exercise for cyber incidents
- Implementing short-term and long-term recovery actions
- Building a cyber incident recovery action plan tailored to your organization’s needs
Suggested Audience
- Government and private sector IT staff
- Local administrators and upper-level management personnel
- System administration
- Risk management personnel
- Local government administration
- Emergency management coordinators
Upon successful completion, you will be able to:
- Describe fundamental concepts and resources related to cyber incident recovery.
- Examine recovery preparedness for cybersecurity incidents.
- Examine tactical, short-term and strategic, long-term recovery operations for cybersecurity incidents.
- Produce a cyber incident recovery action plan based on the scenario information provided.
Enrollment Requirements
Participants must be U.S. citizens. A FEMA Student ID is required to register for and participate in any training provided by FEMA agencies. All FEMA training providers, registration systems, and enrollment procedures are required to use this FEMA SID, which can be obtained at the following website: https://cdp.dhs.gov/femasidopens in a new tab; or with TEEX assistance upon arrival for class.