SIRS study plan
SIRS · Give each week a clear focus.
8 weeks · About 7 hours per week
Incident Response Fundamentals and Frameworks & Detection and Analysis
Define the six phases of the incident response lifecycle and map each phase to the actions a responder performs in it
Compare at least three published IR frameworks (for example NIST SP 800-61, ISO/IEC 27035, SANS PICERL) and list where they diverge on phase boundaries and terminology
Build a one-page vocabulary sheet that distinguishes event, alert, incident, breach, and true positive versus false positive
Explain how detection and analysis feed containment decisions, citing the handoff point between the two phases
Your checkpoint
A two-page lifecycle comparison table plus a 20-term glossary, self-quizzed to 90% accuracy
Detection and Analysis
Categorize common log and telemetry sources (endpoint EDR, network flow, DNS, authentication, cloud audit) by what each can and cannot reveal
Trace a simulated intrusion through a timeline of artifacts and identify the earliest reliable detection point
Apply triage criteria to rank a queue of ten alerts by severity and justify each ranking in one sentence
Describe how indicators of compromise differ from indicators of attack and when each drives scoping decisions
Your checkpoint
A written triage worksheet scoring ten sample alerts with severity, rationale, and recommended next action
Detection and Analysis & Containment, Eradication, and Recovery
Perform incident scoping by identifying affected hosts, accounts, and data from a supplied evidence summary
Select containment strategy (isolate host, disable account, segment network, block indicator) for four scenarios and state the tradeoff of each choice
Distinguish eradication from recovery and list the evidence required before declaring each complete
Draft containment criteria that balance business continuity against attacker persistence risk
Your checkpoint
A containment decision matrix covering four scenarios with chosen action, justification, and rollback condition
Containment, Eradication, and Recovery & Incident Response Preparation and Planning
Sequence recovery steps for a ransomware scenario, including validation of backups and integrity checks before restoration
Identify preparation gaps that would slow containment, such as missing asset inventory, unclear authority, or absent playbooks
Write a playbook outline for one incident type with triggers, roles, decision points, and escalation paths
Explain how tabletop exercises and lessons learned feed back into preparation artifacts
Your checkpoint
A complete playbook outline for one incident type plus a gap list of five preparation weaknesses with proposed fixes
Incident Response Preparation and Planning & Post-Incident Activity and Lessons Learned
Assemble the contents of an incident response plan: scope, roles, communication tree, escalation thresholds, and authority to act
Design a tabletop exercise scenario with objectives, injects, and success criteria
Conduct a post-incident review and separate root cause from contributing factors
Convert lessons learned into specific, owned, dated remediation actions rather than general recommendations
Your checkpoint
A tabletop exercise design document with injects and a post-incident report template containing root cause and action items
Communication, Coordination, and Reporting & Incident Response Fundamentals and Frameworks
Draft internal and external notification templates for technical, executive, and customer audiences, adjusting detail and tone for each
Define escalation triggers and timing for notifying leadership, legal, and regulators
Explain the responder's coordination role with legal counsel, PR, and law enforcement during an active incident
Describe how communication failures create secondary harm and how status cadence prevents them
Your checkpoint
A communication package with three audience-specific templates and an escalation matrix showing who is notified, when, and by whom
Legal, Regulatory, and Ethical Considerations & Communication, Coordination, and Reporting
Identify the regulatory and contractual notification obligations that commonly apply to a data breach and the factors that determine whether they are triggered
Explain evidence handling requirements that preserve admissibility, including chain of custody and documented collection
Distinguish the responder's duty to preserve evidence from the duty to restore operations quickly
Describe ethical constraints on monitoring, data handling, and disclosure during an investigation
Your checkpoint
A legal and regulatory obligations checklist mapping trigger conditions to notification recipients and deadlines
Incident Response Fundamentals and Frameworks & Detection and Analysis & Containment, Eradication, and Recovery & Post-Incident Activity and Lessons Learned & Communication, Coordination, and Reporting & Legal, Regulatory, and Ethical Considerations
Integrate all domains by walking one end-to-end scenario from detection through lessons learned
Identify personal weak areas by scoring a timed mixed-domain practice set and ranking missed objectives
Rehearse explaining containment and notification decisions aloud to build exam-speed recall
Finalize a one-page quick-reference sheet of frameworks, phase handoffs, and notification triggers
Your checkpoint
A scored timed practice set with a written remediation plan for the three weakest objectives and a completed quick-reference sheet
Milestones
Week 2: Can classify a novel alert by severity and name the telemetry source that would confirm or refute it, without notes
Week 4: Can state a containment decision and its tradeoff for any scenario in under two minutes, and produce a playbook outline from memory structure
Week 6: Can name the correct audience, channel, and timing for three different notification scenarios and justify each choice
Week 8: Scores at least 80% on a timed mixed-domain practice set and has a written plan for every missed objective