IICTI Certified Incident Response Specialist

Holders demonstrate that they can apply and evaluate incident response programme design and readiness, detection engineering and alert triage at scale, digital forensics and evidence handling and enterprise threat hunting and compromise assessment, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Incident Response Specialist.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Incident response programme design and readiness12% of the exam

   • Design an incident response programme and readiness model that aligns with organisational risk and regulatory obligations.
   • Scope: NIST SP 800-61 Rev. 3 aligned with CSF 2.0, ISO/IEC 27035, IR plans and playbooks, retainers, tabletop and purple-team exercises, readiness metrics.
2. 02Detection engineering and alert triage at scale10% of the exam

   • Evaluate detection coverage and design triage workflows that surface true incidents quickly and reliably.
   • Scope: SIEM and XDR correlation, Sigma and YARA rules, MITRE ATT&CK coverage mapping, alert fidelity tuning, SOAR enrichment and triage prioritisation.
3. 03Digital forensics and evidence handling12% of the exam

   • Lead forensically sound evidence collection and analysis that supports both investigation and potential legal action.
   • Scope: Order of volatility, memory and disk acquisition, chain of custody, ISO/IEC 27037 evidence guidance, timeline analysis with Velociraptor, Volatility and Plaso.
4. 04Enterprise threat hunting and compromise assessment6% of the exam

   • Design hypothesis-driven hunts and compromise assessments that uncover undetected adversary activity.
   • Scope: Hypothesis-driven hunting, PEAK framework, EDR telemetry analysis, lateral movement and persistence indicators, compromise assessment methodology.
5. 05Identity and cloud incident investigation8% of the exam

   • Diagnose identity and cloud-plane compromises using provider audit telemetry and determine attacker scope.
   • Scope: Entra ID and Active Directory compromise indicators, token theft and session hijacking, AWS CloudTrail, Azure and GCP audit logs, SaaS and OAuth abuse investigation.
6. 06Ransomware and extortion incident management5% of the exam

   • Lead ransomware response decisions on containment, recovery and extortion governance under time pressure.
   • Scope: Containment and isolation strategies, backup integrity validation, extortion and negotiation governance, sanctions screening (OFAC), law enforcement engagement, recovery sequencing.
7. 07Containment, eradication and recovery strategy12% of the exam

   • Design containment and eradication plans that fully evict adversaries while minimising business disruption.
   • Scope: Scoping and blast-radius analysis, coordinated eviction, credential and Kerberos (KRBTGT) resets, rebuild versus restore decisions, hardening and validation before return to service.
8. 08Malware and artefact analysis for responders4% of the exam

   • Evaluate malicious artefacts at a methodological level to derive indicators and inform response scope.
   • Scope: Static and dynamic triage in sandboxes, IOC and TTP extraction, behavioural analysis, YARA authoring, analysis governance and safe-handling procedures.
9. 09Regulatory notification and legal coordination8% of the exam

   • Evaluate notification obligations and coordinate legal, regulatory and insurer engagement during incidents.
   • Scope: GDPR Art. 33/34, NIS2 24h/72h reporting, DORA major ICT incident reporting, SEC cyber disclosure rules, legal privilege, cyber insurance obligations and evidence preservation.
10. 10Crisis leadership and incident communications7% of the exam

    • Lead major incident command and communications that keep executives, regulators and customers informed and aligned.
    • Scope: Incident command structures, executive and board briefings, crisis communications, stakeholder and customer messaging, responder fatigue and shift management.
11. 11Threat intelligence integration for response7% of the exam

    • Design the use of threat intelligence to accelerate scoping, attribution judgement and defensive decisions.
    • Scope: Diamond model, intelligence requirements, STIX/TAXII sharing, MISP, attribution confidence, ISAC collaboration and intelligence-driven scoping.
12. 12Post-incident review and resilience improvement9% of the exam

    • Lead post-incident reviews that translate root causes into measurable resilience improvements.
    • Scope: Blameless post-incident reviews, root-cause and control-failure analysis, MTTD/MTTR metrics, lessons learned tracking, detection and playbook improvement loops.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner