Law, Military Science and Security Safety in Society

Incident Response and Management Procedures Training

SAQA US 253988 | NQF 5 | Credits 6 | Duration 3 Days
From $967 per delegate

Description

This course equips learners with the knowledge and skills to effectively attend to incidents in the workplace. It covers the procedures for identifying, reporting, and managing incidents to minimize harm and prevent recurrence. Learners will understand their role in incident response and the importance of compliance with organizational policies.

Learning Outcomes

  • Demonstrate understanding of incident types, causes, and the incident management process.
  • Apply procedures for reporting and recording incidents according to organizational requirements.
  • Evaluate the immediate response actions required to secure the scene and ensure safety.
  • Analyze incident data to identify trends and recommend preventive measures.
  • Implement post-incident procedures including debriefing and documentation.
  • Demonstrate effective communication during incident response situations.

Target Audience

This course is designed for employees, supervisors, and safety representatives who may be required to respond to incidents as part of their duties. It is suitable for individuals working in any sector where incident response procedures are applicable.

Prerequisites

None — open enrollment.

Course Outline

Day 1: Foundations of Incident Response and Management

Objectives:
• Understand the incident response lifecycle and its phases.
• Identify key stakeholders and their roles in incident management.
• Recognise different types of security incidents and their potential impact.
• Establish criteria for incident classification and prioritisation.

Topics:
• Introduction to incident response: definitions, goals, and importance.
• The incident response lifecycle: preparation, detection, containment, eradication, recovery, and lessons learned.
• Roles and responsibilities: incident response team (IRT), management, legal, PR, and IT.
• Types of incidents: malware, data breaches, denial of service, insider threats, and physical security incidents.
• Incident classification and prioritisation based on severity, impact, and urgency.
• Overview of relevant legislation, regulations, and standards (e.g., POPIA, ISO 27035).
• Communication channels and escalation procedures.
• Introduction to incident response tools and technologies.

Day 2: Detection, Analysis, and Containment

Objectives:
• Apply techniques for detecting and analysing security incidents.
• Perform initial triage and containment to limit damage.
• Gather and preserve digital evidence for forensic analysis.
• Document incident details and maintain chain of custody.

Topics:
• Detection methods: intrusion detection systems (IDS), security information and event management (SIEM), log analysis, and user reports.
• Incident analysis: determining scope, root cause, and indicators of compromise (IOCs).
• Triage and prioritisation of incidents.
• Containment strategies: short-term vs. long-term containment, isolation, and system shutdown.
• Evidence collection and preservation: imaging, hashing, and chain of custody procedures.
• Legal and regulatory considerations for evidence handling.
• Documentation and incident tracking: incident reports, timelines, and communication logs.
• Coordination with internal and external stakeholders during containment.

Day 3: Eradication, Recovery, and Post-Incident Activities

Objectives:
• Execute eradication procedures to remove threats from systems.
• Restore systems and operations to normal state through recovery plans.
• Conduct post-incident reviews to identify lessons learned.
• Develop and update incident response plans and procedures based on findings.

Topics:
• Eradication techniques: removing malware, patching vulnerabilities, and changing credentials.
• Recovery planning: system restoration, data recovery, and validation of normal operations.
• Post-incident review: root cause analysis, lessons learned, and improvement recommendations.
• Updating incident response plans, playbooks, and policies.
• Reporting to management, regulators, and affected parties.
• Continuous monitoring and follow-up actions.
• Building a culture of security awareness and proactive threat hunting.
• Final assessment and course wrap-up.

Practicals

9 hours of practicals To be conducted online or on-campus or in-house
Overview

The practicals provide hands-on experience in detecting, containing, eradicating, and recovering from simulated security incidents. Learners will apply the incident response lifecycle using industry tools and techniques, reinforcing theoretical knowledge through realistic scenarios.

Practical Activities
  • Incident Detection and Triage — Learners use SIEM and log analysis tools to identify and triage simulated security alerts, then classify incidents based on severity. (3h)
  • Containment and Evidence Collection — Learners perform short-term containment on a compromised system, collect forensic evidence (memory, disk images), and maintain chain of custody. (3h)
  • Eradication, Recovery, and Post-Incident Review — Learners eradicate malware from affected systems, restore services from backups, and conduct a post-incident review to identify improvements. (3h)

Summatives

Each delegate is assessed continuously throughout the course via daily exercises, scored practical assignments, and a final summative test at the end.

Practical Assignments — 30%

Practical assignments are observed and scored against a rubric during the practical sessions. Each delegate's practical mark is averaged into a single 100% score and contributes 30% to the final total.

Daily Exercises — 20%

Every training day ends with a multiple-choice exercise scored out of 100%. The scores from each daily exercise are averaged across the duration of the course to produce a Daily Average mark, which contributes 20% to the final total.

Final Test — 50%

On the last day a final summative test is written. It is a multiple-choice paper with multiple-answer questions: each question may have more than one correct option, and a single wrong selection on a question marks the entire question wrong — no partial credit. The final test is scored out of 100% and contributes 50% to the overall mark.

Final Total
Component Out of Weight
Practical Assignments (rubric-scored) 100% 30%
Daily Average (multiple choice) 100% 20%
Final Test (multi-answer multiple choice) 100% 50%
Final Total 100%

All marks are recorded on the AATICD LMS and visible to each learner under their account.

Certificate

Certificate of Completion

Awarded to delegates who achieve an overall mark of 50% or higher on the Final Total (Practicals 30% + Daily Average 20% + Final Test 50%).

How it works
  • Certificates are auto-generated on the AATICD LMS as soon as the marks pass the 50% threshold.
  • Each certificate is a branded PDF with the delegate's name, the course title, the unit standard ID, NQF level, credits, and the date of issue.
  • You can download or print your certificate from your LMS dashboard at any time after issue — there's no reissue fee and no expiry date.
  • If you scored under 50% you can sit the final test again at the next scheduled session at no extra cost.
Where to find it

Sign in to the LMS, open your dashboard, and your certificates appear under My Certificates. Each entry has a View / Download button and a print option.

Training Discounts

Group discounts apply automatically — the more delegates you enrol, the greater the saving. Discounts are calculated at 3% per 5 delegates, scaling up to 40% off for 100+ delegates.

Delegates Discount
5 3% off
10 6% off
15 9% off
20 12% off
25 15% off
30 18% off
50 30% off
75 35% off
100 40% off

3% discount per 5 delegates, up to 40% off for 100+ delegates. Contact us for a custom group quote.

Upcoming Training Sessions
Online training — attend live sessions from anywhere via our virtual classroom.
Start End Delivery Season Price Action
Mon 07 Sep 2026 Wed 09 Sep 2026 Virtual Spring 2026 $967 Register
Wed 30 Sep 2026 Fri 02 Oct 2026 Virtual Spring 2026 $967 Register
Tue 20 Oct 2026 Thu 22 Oct 2026 Virtual Spring 2026 $967 Register
Mon 07 Dec 2026 Wed 09 Dec 2026 Virtual Summer 2026 $967 Register
Wed 13 Jan 2027 Fri 15 Jan 2027 Virtual Summer 2026 $967 Register
Tue 16 Feb 2027 Thu 18 Feb 2027 Virtual Summer 2026 $967 Register
Mon 01 Mar 2027 Wed 03 Mar 2027 Virtual Autumn 2027 $967 Register
Wed 10 Mar 2027 Fri 12 Mar 2027 Virtual Autumn 2027 $967 Register
Tue 16 Mar 2027 Thu 18 Mar 2027 Virtual Autumn 2027 $967 Register
Mon 07 Jun 2027 Wed 09 Jun 2027 Virtual Winter 2027 $967 Register
Wed 30 Jun 2027 Fri 02 Jul 2027 Virtual Winter 2027 $967 Register
Tue 20 Jul 2027 Thu 22 Jul 2027 Virtual Winter 2027 $967 Register
Mon 06 Sep 2027 Wed 08 Sep 2027 Virtual Spring 2027 $967 Register
Wed 29 Sep 2027 Fri 01 Oct 2027 Virtual Spring 2027 $967 Register
Tue 19 Oct 2027 Thu 21 Oct 2027 Virtual Spring 2027 $967 Register
Mon 06 Dec 2027 Wed 08 Dec 2027 Virtual Summer 2027 $967 Register
Wed 29 Dec 2027 Fri 31 Dec 2027 Virtual Summer 2027 $967 Register
Tue 18 Jan 2028 Thu 20 Jan 2028 Virtual Summer 2027 $967 Register
On-Campus training — face-to-face sessions at our training venues across Africa and beyond.
Showing all 492 sessions across 26 venues
Start End Venue Season Price Action
Mon 10 Aug 2026 Wed 12 Aug 2026 Abu Dhabi, UAE Winter 2026 $4,552 Register
Mon 10 Aug 2026 Wed 12 Aug 2026 Cape Town, South Africa Winter 2026 $2,392 Register
Tue 11 Aug 2026 Thu 13 Aug 2026 Durban, South Africa Winter 2026 $2,230 Register
Tue 11 Aug 2026 Thu 13 Aug 2026 Dubai, UAE Winter 2026 $4,552 Register
Wed 12 Aug 2026 Fri 14 Aug 2026 Pretoria, South Africa Winter 2026 $1,447 Register
In-House training — we bring the trainer to your organisation, tailored to your team.
Start End Delivery Season Price Action
Tue 15 Sep 2026 Thu 17 Sep 2026 Your Premises Spring 2026 $1,258 Register
Mon 05 Oct 2026 Wed 07 Oct 2026 Your Premises Spring 2026 $1,258 Register
Wed 28 Oct 2026 Fri 30 Oct 2026 Your Premises Spring 2026 $1,258 Register
Tue 15 Dec 2026 Thu 17 Dec 2026 Your Premises Summer 2026 $1,258 Register
Mon 18 Jan 2027 Wed 20 Jan 2027 Your Premises Summer 2026 $1,258 Register
Wed 24 Feb 2027 Fri 26 Feb 2027 Your Premises Summer 2026 $1,258 Register
Tue 09 Mar 2027 Thu 11 Mar 2027 Your Premises Autumn 2027 $1,258 Register
Mon 15 Mar 2027 Wed 17 Mar 2027 Your Premises Autumn 2027 $1,258 Register
Wed 24 Mar 2027 Fri 26 Mar 2027 Your Premises Autumn 2027 $1,258 Register
Tue 15 Jun 2027 Thu 17 Jun 2027 Your Premises Winter 2027 $1,258 Register
Mon 05 Jul 2027 Wed 07 Jul 2027 Your Premises Winter 2027 $1,258 Register
Wed 28 Jul 2027 Fri 30 Jul 2027 Your Premises Winter 2027 $1,258 Register
Tue 14 Sep 2027 Thu 16 Sep 2027 Your Premises Spring 2027 $1,258 Register
Mon 04 Oct 2027 Wed 06 Oct 2027 Your Premises Spring 2027 $1,258 Register
Wed 27 Oct 2027 Fri 29 Oct 2027 Your Premises Spring 2027 $1,258 Register
Tue 14 Dec 2027 Thu 16 Dec 2027 Your Premises Summer 2027 $1,258 Register
Mon 03 Jan 2028 Wed 05 Jan 2028 Your Premises Summer 2027 $1,258 Register
Wed 26 Jan 2028 Fri 28 Jan 2028 Your Premises Summer 2027 $1,258 Register
Training Discounts
Delegates Discount
5 3% off
10 6% off
15 9% off
20 12% off
25 15% off
30 18% off
50 30% off
75 35% off
100 40% off

3% off per 5 delegates, up to 40% for 100+

View Sessions & Register Get A Quote Download Course Brochure
Have an account?

Sign in to track your applications and manage your cart.

Related Courses

Other Law, Military Science and Security courses at NQF level 5 learners on this page also viewed.

Browse the full Law, Military Science and Security category for law, military science and security training programmes.
GET A QUOTE / APPLY COURSE CATALOGUE