Incident Response and Recovery

Incident response is a management problem as much as a technical one. This programme runs delegates through detection, containment, eradication and recovery, and through the decisions that surround them: when to disconnect, who to tell, what to say, and when to involve law enforcement or a regulator.

It runs 7 times over the published calendar, in 6 cities and live online. Every date is the same programme with the same content and the same certificate.

• Run the phases of incident response in the right order.
• Make containment decisions that balance evidence against ongoing harm.
• Meet notification obligations without over disclosing.
• Recover in a way that does not restore the compromise.

Security and IT staff, incident managers, and executives who would be involved in a major incident.

Short input, then work. Across 3 days of roughly 6 teaching hours each, the balance sits deliberately with the second: a programme where the trainer talks for six hours produces notes rather than capability.

• Your own material

  Exercises run on situations delegates bring, not on a case study written for a different organisation in a different decade.

• A capped cohort

  Small enough that everybody is asked something. Executive programmes are capped tighter still.

• Practice under scrutiny

  The difficult conversation, the challenged assumption, the decision defended out loud. Judgement is not built by watching.

• Something to take back

  Each day ends with a thing you can use on Monday rather than a slide deck you will not reopen.

• An incident response plan with defined roles.
• A containment decision guide.
• A notification checklist with timings.
• A recovery validation approach.

A GATI certificate recording what you attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended.

Every certificate carries a code that anybody can check against GATI's own record, which is what makes it worth holding. It records participation. This site will not imply one it does not have.