Postgraduate Diploma in Incident Response and Tabletop Exercises
Online 800 h Postgraduate Diploma in Incident Response and Tabletop Exercises. 8 modules covering NIST SP 800-61 Rev. 3 (incident response), ISO/IEC 27035-1 (security incident management) and Velociraptor. Assigned tutor and open enrolment.
Take the controls.
Run a real engineering trade-off from this field. Move the sliders, watch the model react in real time and beat the challenge.
What you will be able to do
Describe the incident management lifecycle.
Prepare playbooks, roles and response capabilities.
Analyse indicators of compromise and prioritise incidents.
Apply containment, eradication and recovery strategies.
Preserve digital evidence with a chain of custody.
Design tabletop exercises with objectives and injects.
Conduct exercises and extract actionable lessons learned.
Who it's for
- Incident response analyst who wants to specialise in Incident Response and Tabletop Exercises.
- CSIRT manager who wants to specialise in Incident Response and Tabletop Exercises.
- Digital forensic analyst who wants to specialise in Incident Response and Tabletop Exercises.
- Crisis exercise designer who wants to specialise in Incident Response and Tabletop Exercises.
- Business continuity manager who wants to specialise in Incident Response and Tabletop Exercises.
- SOC analyst who wants to specialise in Incident Response and Tabletop Exercises.
- Engineering or science graduates looking to enter the energy sector.
What you'll work with
- NIST SP 800-61 Rev. 3 (incident response)
- ISO/IEC 27035-1 (security incident management)
- NIST SP 800-84 (testing, training and exercises for IT plans)
- ISO/IEC 27037 (identification and preservation of digital evidence)
- ISO 22398 (security and resilience exercises)
- Directive (EU) 2022/2555 (NIS2)
- ISO 22301 (business continuity)
8 modules · 800 h
1.1Concepts of event, alert and incident1.2NIST SP 800-61 lifecycle1.3ISO/IEC 27035 standard1.4Particularities of OT incidents1.5Classification and severity1.6CSIRT team roles1.7Coordination with INCIBE-CERT and CCN-CERT1.8NIS2 notification obligations1.9Internal and external communication1.10Case study: analysis of the Colonial Pipeline incident
2.1Incident response plan2.2Playbooks by incident type2.3Up-to-date inventory and diagrams2.4Response and forensic tools2.5Log retention2.6Response contracts with third parties2.7Cyber insurance and its requirements2.8Team training2.9Out-of-band communication channels2.10Workshop: drafting a ransomware playbook
3.1Detection sources and SIEM3.2Alert triage3.3Indicators of compromise3.4MITRE ATT&CK and ATT&CK for ICS frameworks3.5Log analysis and timeline3.6Network traffic analysis3.7Basic malware analysis3.8Scope determination3.9Analysis documentation3.10Practice: building a timeline
4.1Containment strategies4.2Isolation of segments and systems4.3Evidence preservation4.4Eradication and cleaning4.5Restoration from backups4.6Validation before reconnection4.7Manual operation of OT processes4.8Prioritisation of critical services4.9Continuity under ISO 223014.10Case study: recovery after ransomware
5.1Chain of custody5.2Memory and disk acquisition5.3Forensics of Windows and Linux systems5.4Forensics of industrial controllers5.5Tools: Volatility and KAPE5.6Artefact analysis5.7Legal requirements for evidence5.8ISO/IEC 27037 standard5.9Expert report5.10Laboratory: memory acquisition and analysis
6.1Types of exercise: tabletop, functional and full-scale6.2HSEEP guidance and CISA methodology6.3Exercise objectives and scope6.4Scenario design6.5Injects and timeline6.6Roles: facilitator, players and observers6.7Involvement of management and communications6.8Combined IT-OT crisis scenarios6.9CISA Tabletop Exercise packages6.10Workshop: designing a tabletop scenario
7.1Running and facilitating the exercise7.2Time and contingency management7.3Note-taking and observation7.4Hot wash debrief7.5After-action report (AAR)7.6Improvement plan and follow-up7.7Preparedness metrics7.8Sector exercises such as Cyber Europe7.9Annual exercise cycle7.10Practice: facilitating a simulated exercise
8.1Organisational context and assets8.2Analysis of relevant threats8.3Incident response plan8.4Selected playbooks8.5Tabletop exercise design8.6Inject script8.7Evaluation and improvement plan8.8Exercise calendar8.9Report and presentation8.10Final review with the tutor
How you'll learn
100% online training on the SEIUM campus, with downloadable material, recorded classes and assigned technical tutor. No fixed timetables: students progress at their own pace within the intake, which makes it possible to combine study with work.
Each module combines theory, guided reading of the original standard and applied exercises. The working software is Velociraptor, Volatility, Autopsy, TheHive, Wireshark, in free, academic or evaluation versions. Practice sessions are based on real tabletop exercise procedures, with scenarios involving ransomware, memory and disk forensic analysis, and crisis communication simulations. Assessment is continuous across modules, plus the final integrative project.
Build it end to end
Your final project follows the real engineering workflow, step by step, reviewed by your tutor.
Describe the incident management lifecycle.
Prepare playbooks, roles and response capabilities.
Analyse indicators of compromise and prioritise incidents.
Apply containment, eradication and recovery strategies.
Preserve digital evidence with a chain of custody.
Where this takes you
Requirements
- Prior technical training or professional experience in the sector. A university degree is not required.
- Internet connection and a computer capable of running the programme's software.
- Sufficient Spanish to follow technical regulatory texts.
Ready to start?
Send your application today. Our admissions team replies within 72 hours with your study plan and funding options.
Frequently asked questions
The programme totals 800 hours spread over 6 to 8 months. That is between 10 and 15 hours per week on average, compatible with a full-time job.
The programme uses Velociraptor, Volatility, Autopsy, TheHive and Wireshark. Free, academic or evaluation versions are used, and the tutor indicates the free alternative where one exists.
A SEIUM own diploma upon passing the continuous assessment and the integrative project. This is in-house training, not an official qualification from the Ministry.
Yes. Modules passed in a course or postgraduate diploma in the same area can be credited towards the advanced programme. Check the credit transfer policy when you enrol.
Related programmes
Postgraduate Diploma in Relay Coordination and Characteristic Curves
Online Postgraduate Diploma of 800 h in Relay Coordination and Characteristic Curves. 8 modules covering IEC 60255-151 (overcurrent protection), IEEE C37.112 (inverse-time curves) and ETAP. Assigned…
Postgraduate Diploma in Electrical Design and Layout of PV Plants
800-hour online Postgraduate Diploma in Electrical Design and Layout of PV Plants. 8 modules covering IEC 62548 (design requirements for PV arrays), IEC 60364-7-712 (photovoltaic installations)…
Postgraduate Diploma in HPC Depot Design and Peak Management
Online postgraduate diploma of 800 hours in HPC depot design and peak management, structured in 8 modules covering fleet electrification, high-power chargers, depot design, demand simulation,…
More in Energy and Networks
All Energy and Networks programmes → · How to apply · Fees & financing · Scholarships