CRIE study plan
CRIE · Give each week a clear focus.
8 weeks · About 6 hours per week
Incident Response Fundamentals and Frameworks & Containment, Eradication, and Recovery
Map the phases of a recognized incident response lifecycle to a written outline from memory
Distinguish the roles of the incident commander, lead investigator, and communications lead in a table
Sequence containment, eradication, and recovery activities for a simulated data-exfiltration scenario
Draft a one-page decision tree for choosing isolation strategy based on blast radius
Your checkpoint
A two-page lifecycle-and-roles reference sheet plus a containment decision tree, self-quizzed to 90% accuracy
Containment, Eradication, and Recovery & Preparation and Incident Response Planning
Compare network, host, and account containment techniques and state one tradeoff for each
Write eradication acceptance criteria for malware on an endpoint and for a compromised service account
Build a recovery validation checklist covering integrity, monitoring, and stakeholder signoff
Translate a prepared response plan into a pre-approved action list for the top three incident types
Your checkpoint
A containment/eradication/recovery playbook for two incident types with explicit entry and exit criteria
Preparation and Incident Response Planning & Detection and Identification
Draft a preparation checklist covering tooling, access, contact trees, and out-of-band comms
Define detection sources and what each one would reveal for a credential-theft case
Write triage questions that separate a true positive from a benign trigger
Specify severity classification rules with at least three tiers and escalation triggers
Your checkpoint
A preparation checklist and a triage/severity rubric covering three incident categories
Detection and Identification & Evidence Handling and Forensic Analysis
Explain how to establish and preserve the order of volatility when collecting volatile data
Describe chain-of-custody documentation requirements and one common failure mode
Outline a forensic imaging workflow with hashing and verification steps
Identify which artifacts support a timeline for a host-based intrusion
Your checkpoint
A forensic collection and chain-of-custody procedure with a sample evidence log and hashing verification step
Evidence Handling and Forensic Analysis & Communication, Coordination, and Reporting
Construct a defensible timeline from at least three artifact sources and note conflicts
Draft internal and external notification templates with required content fields
Identify regulatory and contractual reporting triggers and their deadlines in a comparison table
Practice a 5-minute executive briefing that states impact, status, and next decision
Your checkpoint
A 24-hour incident timeline narrative plus a communications package with internal and external templates
Containment, Eradication, and Recovery & Communication, Coordination, and Reporting
Run a tabletop exercise covering detection through recovery with at least two injects
Document decisions made during the exercise and where coordination broke down
Revise the containment playbook based on exercise findings
Draft a status-update cadence plan for a multi-day incident
Your checkpoint
A tabletop after-action summary with three concrete playbook revisions applied
Post-Incident Activities and Lessons Learned & Incident Response Fundamentals and Frameworks
Write a post-incident review agenda and facilitation questions that avoid blame
Convert findings into root-cause statements and corrective actions with owners and dates
Define metrics that measure response performance across incidents
Reconcile the framework you studied in week 1 against lessons learned from the exercise
Your checkpoint
A post-incident review report template plus a lessons-learned register with owners and due dates
Incident Response Fundamentals and Frameworks & Preparation and Incident Response Planning & Detection and Identification & Containment, Eradication, and Recovery & Evidence Handling and Forensic Analysis & Communication, Coordination, and Reporting & Post-Incident Activities and Lessons Learned
Complete a timed mixed-domain practice set and log every missed question by domain
Re-teach the three weakest domain areas using your own notes only
Rehearse the containment decision tree and forensic workflow without reference materials
Verify each domain's key terms are defined in your own words
Your checkpoint
A scored practice exam with a remediation log showing each weak area closed or re-scheduled
Milestones
Week 2: Can state containment, eradication, and recovery exit criteria for two incident types without notes
Week 4: Can explain order of volatility and chain-of-custody requirements aloud in under three minutes
Week 6: Tabletop exercise completed with written after-action findings and at least three playbook revisions
Week 8: Practice exam score at target threshold with a remediation log showing weak domains addressed