This program is the complete federal incident investigation credential. Participants run a federal incident response program from governance and readiness through detection, containment, recovery, and lessons learned, then specialize in the investigative craft: the forensic process that makes findings defensible, and the malware analysis that explains what actually happened. The sequence is deliberate: response teaches what to do under time pressure, forensics teaches how to prove it afterwards, and malware analysis teaches how to answer the question everyone asks first, which is what the thing did. It prepares participants for federal incident responder, digital forensic examiner, and SOC investigator roles, and toward the GIAC GCIH and GCFE credentials. The program aligns to NIST SP 800-61 Rev 3, SP 800-86, and SP 800-83, to CISA reporting obligations, and to the CSF 2.0 Functions.