Digital, AI and Cyber Security
Cyber Security
Incident Response and Recovery
Run a security incident from detection to recovery, including the decisions that have to be made under pressure.
- Duration
- 3 days
- Contact hours
- 18
- Level
- Advanced
- Fee from
- US$1,200
Overview
Incident response is a management problem as much as a technical one. This programme runs delegates through detection, containment, eradication and recovery, and through the decisions that surround them: when to disconnect, who to tell, what to say, and when to involve law enforcement or a regulator.
Who should attend
Security and IT staff, incident managers, and executives who would be involved in a major incident.
What you will be able to do
- Run the phases of incident response in the right order.
- Make containment decisions that balance evidence against ongoing harm.
- Meet notification obligations without over disclosing.
- Recover in a way that does not restore the compromise.
How it is taught
Short input, then work, across 3 days of roughly 6 teaching hours each. Exercises run on situations delegates bring rather than on a case study written for a different organisation. Cohorts are capped so that everybody is asked something.
Available as classroom, live online, in house.
Programme outline
Day 1
Detection and containment
- Recognising an incident
- Triage and severity
- Containment against evidence preservation
- Communication in the first hour
Day 2
Investigation and notification
- Scoping the compromise
- Evidence handling
- Regulatory and contractual notification
- What to say publicly
Day 3
Recovery and after
- Eradication and validated recovery
- Restoring without restoring the compromise
- Post incident review
- Turning findings into controls
What you leave with
- An incident response plan with defined roles.
- A containment decision guide.
- A notification checklist with timings.
- A recovery validation approach.
Dates and fees
| Dates | Location | Format | Fee |
|---|---|---|---|
| 23 to 25 November 2026 | Port Louis, Mauritius | Classroom | US$1,200 |
| 30 November 2026 to 2 December 2026 | Nicosia, Cyprus | Classroom | US$1,200 |
| 7 to 9 December 2026 | Cairo, Egypt | Classroom | US$1,200 |
| 14 to 16 December 2026 | Dubai, United Arab Emirates | Classroom | US$1,200 |
Fees are per delegate and cover tuition, all programme materials and the certificate. Travel, accommodation and visas are arranged by the delegate. Registration closes two weeks before a programme starts.
Certificate
A GATI certificate recording what was attended, issued after the programme has run and attendance has been taken. Attending at least 80 per cent of the days earns a certificate of completion; attending less earns a certificate of attendance stating exactly what was attended. Every certificate carries a code that anybody can check against GATI's own record.
It records participation. and GATI does not claim one it does not hold.