IICTI Certified Security Incident Management Auditor (SIM)

Holders demonstrate that they can apply and evaluate incident management governance and control framework mapping, audit programme planning and risk-based audit methodology, regulatory incident obligations and reporting compliance and detection, triage and classification capability assessment, plus 8 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Security Incident Management Auditor (SIM).

Who it is for: Professionals working, or preparing to work, in audit, risk & governance roles.

1. 01Incident management governance and control framework mapping11% of the exam

   • Evaluate the design of an incident management governance framework against applicable standards and organisational risk.
   • Scope: ISO/IEC 27001:2022 Annex A 5.24 to 5.28 and 6.8, ISO/IEC 27035-1/-2:2023, NIST SP 800-61 Rev. 3 and CSF 2.0 Respond/Recover, roles, policy hierarchy, risk appetite and board oversight.
2. 02Audit programme planning and risk-based audit methodology9% of the exam

   • Design risk-based audit programmes and engagement plans for security incident management.
   • Scope: ISO 19011:2018 and ISO/IEC 27007, audit universe and risk-based scoping, audit criteria and sampling, independence and competence of auditors, ISO/IEC 27006 certification audit considerations.
3. 03Regulatory incident obligations and reporting compliance7% of the exam

   • Evaluate whether incident classification and notification processes meet regulatory timelines and content requirements.
   • Scope: NIS2 Article 23 staged reporting (24h/72h/one month), DORA major ICT incident classification and reporting, GDPR Articles 33/34 breach notification, sectoral and national CSIRT requirements.
4. 04Detection, triage and classification capability assessment9% of the exam

   • Evaluate the effectiveness and coverage of detection and triage capabilities against the threat profile.
   • Scope: SOC operating models, detection coverage mapped to MITRE ATT&CK, use-case lifecycle, alert triage and escalation criteria, severity and impact classification schemes, SIEM/SOAR and MDR service governance.
5. 05Auditing containment, eradication and recovery execution7% of the exam

   • Evaluate the adequacy and execution of containment, eradication and recovery actions in real incidents.
   • Scope: Response playbooks and decision authority, containment strategies and trade-offs, eradication verification, recovery and restoration criteria, ransomware and extortion decision governance.
6. 06Digital evidence handling and forensic readiness9% of the exam

   • Evaluate forensic readiness and the integrity of evidence handling against recognised standards.
   • Scope: ISO/IEC 27037, 27041, 27042 and 27043, chain of custody, forensic readiness planning, log retention and integrity, evidence admissibility, legal hold and coordination with law enforcement.
7. 07Incident records, metrics and performance measurement10% of the exam

   • Evaluate incident metrics and records for reliability and their usefulness for management decisions.
   • Scope: Incident register completeness and quality, MTTD/MTTR/MTTC and dwell time, ISO/IEC 27004 measurement, KPI/KRI design, trend analysis and reporting to management and the board.
8. 08Third-party, cloud and supply-chain incident management6% of the exam

   • Evaluate how incident management obligations and coordination are governed across third parties and cloud providers.
   • Scope: Supplier incident notification clauses, shared-responsibility models, MSSP and cloud provider coordination, ISO/IEC 27036, DORA ICT third-party risk requirements and supply-chain compromise scenarios.
9. 09Crisis management, communications and business continuity integration7% of the exam

   • Evaluate the integration of incident response with crisis management and business continuity arrangements.
   • Scope: ISO 22361 crisis management, ISO 22301 linkage, escalation to crisis teams, internal and external communications, stakeholder and media handling, executive decision-making under uncertainty.
10. 10Exercises, post-incident review and lessons-learned effectiveness9% of the exam

    • Evaluate whether exercises and post-incident reviews drive verified, sustained improvement.
    • Scope: Tabletop and live exercise design and evaluation, blameless post-incident reviews, root-cause analysis techniques, corrective action tracking, ISO/IEC 27001 Clause 10 continual improvement.
11. 11Audit evidence, findings and reporting11% of the exam

    • Lead the formulation of evidence-based audit conclusions and reports that drive accountable remediation.
    • Scope: Sufficiency and appropriateness of evidence, interviews, observation and technical sampling, nonconformity grading, root-cause based findings, audit reports, follow-up audits and corrective action verification.
12. 12Auditing automation, SOAR and AI in incident response5% of the exam

    • Evaluate the controls, reliability and accountability of automated and AI-assisted incident response.
    • Scope: SOAR playbook governance and change control, automated containment risks, AI-assisted triage and its validation, EU AI Act and ISO/IEC 42001 considerations, tooling integrity and logging of automated actions.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner