Digital Forensics & Incident Response Certificate Program (Self-Paced)
IDCYSE.DFI.SP

Self-paced online training with expert support Certificate with 3 courses

Work a federal incident from the one-hour CISA notification through forensic analysis to a defensible report, at your own pace.

$2,499 36 clock hours Live Support Start anytime

This program includes

  • 36 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Access to class recordings (30 days)
  • Verified digital certificate of completion
  • Learn at an accredited institution
  • Credits: 3.6 CEUs

Working on the detection and monitoring side instead? See the Cyber Defense and SOC Analyst Certificate Program.

This certificate program is self-paced. For live online or in-person instruction, take Cyber Defense & SOC Analyst Certificate Program.

This program is the complete federal incident investigation credential. Participants run a federal incident response program from governance and readiness through detection, containment, recovery, and lessons learned, then specialize in the investigative craft: the forensic process that makes findings defensible, and the malware analysis that explains what actually happened.

The sequence is deliberate: response teaches what to do under time pressure, forensics teaches how to prove it afterwards, and malware analysis teaches how to answer the question everyone asks first, which is what the thing did. It prepares participants for federal incident responder, digital forensic examiner, and SOC investigator roles, and toward the GIAC GCIH and GCFE credentials. The program aligns to NIST SP 800-61 Rev 3, SP 800-86, and SP 800-83, to CISA reporting obligations, and to the CSF 2.0 Functions.

Courses in this Certificate Program

This is the recommended order, but some courses may be taken in a different order.

Download Syllabus PDF

Unit 1 12 Hours

Federal Incident Response for Agency Practitioners Course (Self-Paced)

This course equips federal incident response practitioners with the operational knowledge to detect, contain, and recover from cybersecurity incidents while meeting FISMA, US-CERT, and OMB mandatory requirements. Participants develop practical skills across the full NIST SP 800-61 Rev. 3 incident response lifecycle, from preparation, detection and analysis, containment, eradication and recovery, and post-incident review.

  • Governance and legal/policy basis for federal IR (FISMA, NIST SP 800-61 Rev. 3, OMB, CISA).
  • Detect and classify incidents using NCISS and federal incident categories.
  • Identify which mandatory reporting obligations apply and meet the deadlines.
  • Contain, eradicate, and recover while preserving evidence.
  • Run post-incident reviews that drive program improvement.
  • Design and facilitate tabletop exercises (including a MSEL).
  • Walk a simulated incident from detection to after-action report.

Unit 2 12 Hours

Digital Forensics and Incident Investigation for Federal Employees Course (Self-Paced)

Learn to conduct defensible digital forensics and incident investigations using the NIST SP 800-86 forensic process—Collection, Examination, Analysis, and Reporting. You'll master IOC investigation, chain of custody, and the federal legal and oversight framework, then put it all together in a full capstone investigation.

  • Apply the NIST SP 800-86 forensic process and connect it to the NIST SP 800-61 IR lifecycle.
  • Recognize the legal/policy foundations for federal digital evidence, and know when to refer to OIG/counsel/law enforcement.
  • Collect and preserve evidence by order of volatility (memory, disk, network, cloud) without contaminating it.
  • Investigate IOCs across host/network/behavioral data to establish scope and build a timeline.
  • Reconstruct timelines and correlate artifacts, understanding the limits of what forensic evidence can prove.
  • Maintain a defensible chain of custody and write findings for technical, executive, and legal audiences.

Unit 3 12 Hours

Malware Analysis Fundamentals (Intermediate) Course (Self-Paced)

Learn both static analysis (examining files without running them) and dynamic analysis (interpreting behavior from sandbox and monitoring reports), and build the judgment to know which technique fits each situation. Following NIST SP 800-83 Rev. 1, the course works in the real tools analysts rely on—disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen—with a federal thread on sample sensitivity and data handling throughout.

  • Static analysis: triage, string/metadata extraction, YARA, basic disassembly
  • Interpret dynamic analysis (sandboxing, monitoring, network simulation) and evasive behavior from example reports
  • Capture and correlate network IOCs with threat intel and MITRE ATT&CK
  • Use FLARE-VM, REMnux, and CISA Malware Next-Gen appropriately (vs. public multi-scanners)
  • Write a CISA-MAR-style report for technical and leadership audiences
  • Follow a sample end-to-end through a worked example
A group of adult learners sits in a classroom, smiling and engaged in a government training session.
A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.
A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Related Courses: Compare to the Digital Forensics & Incident Response Certificate Program (Self-Paced)

These related courses share skills and topics with the Digital Forensics & Incident Response Certificate Program (Self-Paced). Select up to two and tap Compare selected courses to view a side-by-side comparison.

  • Federal Incident Response for Agency Practitioners Course (Self-Paced)
    12 hours $1,049

    Run a federal incident response program end to end, organized the way NIST now organizes it: from governance and readiness, through detection and the one-hour CISA notification clock, to recovery and continuous improvement.

  • Digital Forensics and Incident Investigation for Federal Employees Course (Self-Paced)
    12 hours $1,049

    Learn to conduct defensible digital forensics and incident investigations using the NIST SP 800-86 forensic process—Collection, Examination, Analysis, and Reporting. You'll master IOC investigation, chain of custody, and the federal legal and oversight framework, then put it all together in a full capstone investigation.

  • Malware Analysis Fundamentals (Intermediate) Course (Self-Paced)
    12 hours $1,049

    Learn both static analysis (examining files without running them) and dynamic analysis (interpreting behavior from sandbox and monitoring reports), and build the judgment to know which technique fits each situation. Following NIST SP 800-83 Rev. 1, the course works in the real tools analysts rely on—disassemblers, sandboxes, YARA, network capture, and CISA's Malware Next-Gen—with a federal thread on sample sensitivity and data handling throughout.