CURRICULUM: Cybersecurity Leadership LDR553: Cyber Incident Management™ Open in Case of Emergency 5 Day Program 30 CPEs You Will Be Able To ▐ Lead cyber incident response from first hour to close-down using pressure-tested frameworks ▐ Run executive briefings with incomplete information using the 3-Whats approach ▐ Use GenAI GPTs to draft briefs, process intelligence, and manage communications ▐ Manage third-party breaches and vendor silence using the CURTAIN framework ▐ Assess credential theft and identity compromise using TRACE and the 7Rs ▐ Coordinate IR, legal, HR, communications, and external parties without becoming a bottleneck ▐ Manage ransomware, BEC, cloud console attacks, and agentic AI incidents from an IM perspective Who Should Attend ▐ Security managers ▐ Security professionals ▐ Managers ▐ Legal/HR/PR staff NICE Framework Work Roles ▐ Knowledge Manager (OM-KMG-001) ▐ Cyber Legal Advisor (OV-LGA-001) ▐ Privacy Officer/Privacy Compliance Manager (OV-LGA-002) ▐ Information Systems Security Manager (OV- MGT-001) ▐ Communications Security (COMSEC) Manager (OV-MGT-002) ▐ Cyber Policy and Strategy Planner (OV- SPP-002) ▐ Executive Cyber Leadership (OV-EXL-001) 28 Labs GCIL Cyber Incident Leader giac.org/gcil When a major cyber incident hits, technical teams need more than tools and expertise. They need someone to manage information, set direction, coordinate decisions, and keep the organization moving while facts are still incomplete. Cyber Incident Management prepares leaders to step into that role when an incident grows beyond what a SOC or IR team can manage alone. The course focuses on the operational leadership work that keeps a response from breaking down: building the team, managing findings, briefing executives, coordinating with legal, HR, communications, third parties, regulators, and the board, and maintaining control under pressure. Across all five sections, students work through a continuous scenario involving Submarine Studios, a software and games company under attack by external threat actors. The course uses the Cyber Incident Management Toolkit, including frameworks, trackers, and reference cards designed for active incident conditions. GenAI is woven in as a practical support tool for briefings, communications, threat summaries, supplier assurance, and agent incident response while keeping human judgment central. Business Takeaways ▐ Reduce incident duration and business impact through better coordination ▐ Strengthen executive and board briefings with consistent structure ▐ Improve vendor, legal, and regulatory coordination during third-party breaches ▐ Use GenAI in incident management with verification and human-review controls ▐ Build teams that can sustain major incidents over days, not just hours ▐ Apply CIMTK frameworks immediately during real incident conditions ▐ Leave with the full Incident Management Toolkit, including AIM-RADAR and CIMTK cards Syllabus Summary SECTION 1: Understanding the Incident, Building the Team with GenAI, Scoping and Tracking the Impact SECTION 2: Communications, Planning, and Executing Remediations SECTION 3: Training, Leveraging Intelligence, Third-Party Compromise, and Bug Bounties SECTION 4: Cloud, Business Email Compromise, and Credential Theft Attacks SECTION 5: AI for Incidents, Attacker Extortion, Ransomware, and Capstone Exercise “ It’s a perfect course for those leading cyber incidents. I’ve found nothing else that comes close.” —Lee Taylor, Leicestershire Police For detailed course description, visit SANS.ORG/LDR553 Steve Armstrong-Godwin Course Author In-Person WAYS TO TAKE LDR553 Live Online OnDemand