CRIE study guide
CRIE · Work through your exam, one topic at a time.
The CRIE is a professional certification focused on cyber incident response and evidence handling. It is aimed at practitioners who are expected to run or support an incident end to end: SOC analysts moving beyond triage, incident responders, forensic examiners, security engineers, and consultants or team leads who own escalation and recovery decisions. The CRIE study guide has 7 sections and about 1,985 words.
01Incident Response Fundamentals and Frameworks
Incident response (IR) is a disciplined, repeatable process, not improvisation. The core lifecycle you must be able to recite and apply is Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity , commonly associated with NIST SP 800-61.
309 words, about 2 min02Preparation and Incident Response Planning
Preparation is where IR succeeds or fails. A credible program includes a written IR plan (policy, scope, authority, escalation), playbooks/runbooks for common scenarios (ransomware, phishing, insider, DDoS), and communication plans with pre-approved templates and contact trees.
277 words, about 1 min03Detection and Identification
Detection converts telemetry into confirmed incidents. You must understand the major detection sources: SIEM correlation , EDR , IDS/IPS , netflow , DNS logs , authentication logs , and user reports .
289 words, about 1 min04Containment, Eradication, and Recovery
Once an incident is confirmed, containment limits spread. Know the two strategies: short-term containment (isolate host, block IP/domain, disable account, segment network) and long-term containment (rebuild hardened systems, apply temporary fixes, maintain monitoring while eradication proceeds).
286 words, about 1 min05Evidence Handling and Forensic Analysis
Forensic soundness rests on integrity and chain of custody . Candidates must understand order of volatility (RFC 3227): capture CPU/cache and memory, then network state, then disk, then backups/archives - most volatile first.
279 words, about 1 min06Communication, Coordination, and Reporting
Technical skill fails without coordinated communication. You must understand internal (incident commander, executives, legal, HR, IT ops) and external (customers, regulators, law enforcement, partners, media) communication streams, each with defined owners and cadence.
266 words, about 1 min07Post-Incident Activities and Lessons Learned
The final phase converts experience into resilience. A post-incident review (lessons learned) examines what happened, what worked, what failed, and what to change - ideally held soon after resolution while memory is fresh, and documented.
279 words, about 1 min