Managing and Preparing for Cyber Incidents

BCM-IT 2 Days £1,050.00 (+ VAT)

Course Overview/Dates

Over the last few years the number of cyber incidents has grown, affecting organisations large and small. High profile incidents such as Sony, Talk Talk, and the Petya and NHS ransomware attacks, have had a major impact on the operations and reputation of the organisations.

What's included?

  • Course slides and notes
  • Lunch and refreshments
  • Certificate of attendance

Course Dates

Dates Number of days Location Price
Mon 2 Mar 2020
London, UK £1,050.00 Book Reserve
Course tutor: Charlie Maclean-Bristol MA (Hons), PgD, FBCI, FEPS, CBCI
Venue: etc.venues - The Hatton
Mon 7 Sep 2020
London, UK £1,050.00 Book Reserve
Course tutor: Charlie Maclean-Bristol MA (Hons), PgD, FBCI, FEPS, CBCI
Venue: etc.venues - The Hatton
Back to top

Details & Programme

This training course is not a technical response, but looks at the actions organisations can take to prepare themselves, and how they should manage a cyber incident, including very importantly, how to manage communications associated with the incident. It will also look at the types of cyber attacks, the cyber landscape and how to exercise your cyber response plan.

Delegates will learn how to prepare their organisation, how to develop an effective response and how to manage an incident should it occur.

This course was initially delivered over one day, however due to overwhelming student feedback, it has been expanded to a two day course. The course is based on good practice from a variety of government and private organisations.

Day 1

StartFinishSubject AreaDetail
09000940Introductions and introductory exercise
09401120Module 1: Cyber Threats and LandscapeDefinitions
Number of different case studies
Different types of cyber threats
Who are the threat actors?
What are the threat vectors?
Cyber incident impacts
Threats to different industries
11351155Cyber video and discussion
11551240Module 2: Prepare - Understanding your vulnerabilities and risksUnderstanding your organisation’s vulnerabilities
Questions to ask to understand your information security culture, cyber preparation and awareness
Incident reporting helpline
Measuring cyber preparation and maturity
Understanding what you have to lose when conducting a cyber data risk assessment
13251455Module 3: Prepare - Developing a cyber incident response frameworkReviewing and developing your cyber policy and guidance
Developing a cyber incident response team
Developing scenario responses
Developing decision and scenario based playbooks
Third party support insurance and cyber intelligence
14551555Module 4: Prepare - Awareness and Cyber ExercisesPrompting staff awareness
Cyber exercise scenarios
Styles of exercises
Exercising at different levels within the organisation
Making exercises realistic
Hints and tips for successful exercises
15551630Review of the day

Day 2

StartFinishSubject AreaDetail
09000930Review of day one
09301015Module 5: Respond - Overview of incident management and technical cyber response Incident response overview - what are we trying to achieve?
Difference between a cyber and a 'normal' incident
10151045Technical Cyber Response React, Respond, Resolve framework for managing incidents
Identifying the cyber incident
Triaging incidents
Cyber impact assessment
Kill Chains and Diamond Model
Forensics, investigations and third-party response
11001200Module 6: Respond - Executive Incident Management Situational awareness and OODA loop
Use of situation - direction - action
Incident decision making
Information management
Setting of incident objectives
Statutory and regulatory reporting including GDPR requirements
12001230Module 7: Respond - Crisis Communications and Reputation ManagementCommunications case study
Communications pre-incident preparation
Managing your organisation's communications with customers, stakeholders and the media
Stakeholder information requirements
Developing a communications strategy
Cyber attack 'victim or villain'
13151415Communications continued
14151445Module 8: Recovery - Using existing BC plans to recover operationsUse of existing business continuity plans, DR and crisis plans to help lessen the impact of the incident
14451530Final response exercise
15301630Course Review
PDF Download a PDF of the course details >
Back to top

Course Benefits

Completing this course will enable you to:

  • Understand the different types of cyber attack and cyber incident landscape
  • Look at the preparation which can be carried out prior to a cyber incident occurring
  • Create a cyber playbook
  • Identify the responses and issues associated with responding to a cyber attack
  • Plan and run a cyber exercise
Back to top

Who Should Attend?

  • BC and resilience managers
  • IT managers
  • Members of crisis management teams or those responsible for crisis management
Back to top


Charlie Maclean-Bristol

Charlie Maclean-Bristol


Back to top

In-house Options

Please contact the BC Training team on 01253 542650 or email, should you wish to discuss options for delivering this course in-house at your organisation.

Back to top


etc.venues - The Hatton


etc.venues - The Hatton
51-53 Hatton Garden

+44 (0) 20 7242 4123

Back to top

Sign-up to our weekly bulletin

Twitter feed

The Case Against Situational Crisis Communication Theory

Following Charlie's previous bulletin 'Crisis communications, a dark art?' about how you can develop a crisis response strategy from Timothy Coombs' Situational Crisis Communications Theory (SCCT), this week's guest author Jim Preen makes his case against SCCT.

17 January 2020

“The session was engaging and impactful throughout the day, brought to life by James [McAlister] who presented with extensive credibility, challenge and honesty.”

Simon Mould
Cornwall Fire and Rescue Service
View further testimonials