SIRS study guide
SIRS · Work through your exam, one topic at a time.
The SIRS credential is aimed at security practitioners who own or support the incident response lifecycle - SOC analysts moving beyond triage, CSIRT members, and IT or risk staff who sit on an incident bridge. It tests whether you can run a structured response rather than recite tool commands: recognising where you are in the lifecycle, scoping an intrusion under time pressure, choosing containment that does not destroy evidence, and closing out an incident with findings that change the organisation. The SIRS study guide has 7 sections and about 3,076 words.
01Incident Response Fundamentals and Frameworks
The fundamentals domain tests whether you can define incident response precisely, place any activity inside a recognised lifecycle, and explain why the chosen framework shapes every later decision. Expect questions that contrast frameworks, ask where a task belongs, or test vocabulary such as event versus incident.
457 words, about 2 min02Incident Response Preparation and Planning
Preparation is the only phase where you control the clock, and the exam tests whether you can name the artefacts a mature programme produces before an incident ever occurs. An approved incident response policy stating scope, authority, and the team's mandate.
436 words, about 2 min03Detection and Analysis
This domain tests triage discipline: how you move from a raw signal to a validated, scoped, documented incident without destroying what you will later need. A precursor signals that an attack may occur - a vulnerability disclosure, a threat-intel warning, a newly published exploit.
435 words, about 2 min04Containment, Eradication, and Recovery
Here the exam checks judgment under pressure: choosing containment that stops the spread without destroying evidence or the business, and knowing the criteria that let you move on. Options range from soft (monitoring, blocking a domain, forcing password resets) to hard (network isolation, disabling accounts, shutting a network segment).
437 words, about 2 min05Post-Incident Activity and Lessons Learned
This domain tests whether you can convert an incident into durable improvement - and prove it. Questions focus on timing, participants, metrics, and what a defensible lessons-learned process produces.
436 words, about 2 min06Communication, Coordination, and Reporting
Communication failures end more careers than malware does. This domain tests stakeholder mapping, message discipline, and the coordination mechanics that keep notifications accurate and timely.
420 words, about 2 min07Legal, Regulatory, and Ethical Considerations
Incident response decisions have legal consequences, and the exam expects you to recognise obligations without pretending to give legal advice. Maintain chain of custody : log every transfer of a device or image, use write blockers, hash images at acquisition, and store copies securely.
455 words, about 2 min