- Overview of incident handling and response
- Understanding the role and responsibilities of an Incident Handler
- Legal and regulatory considerations
EC-Council Certification Training Course
EC-Council ECIH: Certified Incident Handler Certification Training Course
Learn to manage and respond to security incidents effectively with Accumentum’s ECIH: Certified Incident Handler Certification Training Course.
Course focus: Incident handling and response fundamentals, the incident handling lifecycle, identifying and analyzing security incidents, containment strategies, eradication and recovery, post-incident activities, advanced incident handling techniques, and ECIH exam preparation.
Course Overview
Manage and respond to security incidents across the organization.
The EC-Council Certified Incident Handler (ECIH) Certification Training Course at Accumentum is designed to equip IT professionals with the skills and knowledge required to effectively manage and respond to security incidents in an organization.
This comprehensive course covers a wide range of incident handling techniques, tools, and best practices. Participants will learn to identify, assess, and respond to various security incidents, preparing them to become proficient Incident Handlers and achieve the ECIH certification.
Course Objectives
Build ECIH certification readiness and practical incident response capability.
01
Understand Incident Handling Fundamentals
Understand the fundamentals of incident handling and response.
02
Build a Response Plan
Learn to develop and implement an effective incident handling and response plan.
03
Identify and Analyze Incidents
Gain expertise in identifying and analyzing different types of security incidents.
04
Contain, Eradicate, and Recover
Master the techniques for containing, eradicating, and recovering from incidents.
05
Prepare for the ECIH Certification
Prepare for the EC-Council Certified Incident Handler (ECIH) certification exam.
Who Should Attend
- IT professionals and security officers responsible for incident management and response.
- System administrators and network engineers involved in security operations.
- Security consultants and advisors looking to enhance their incident handling skills.
- Anyone interested in becoming a certified Incident Handler and advancing their career in cybersecurity.
Prerequisites
- Basic understanding of information security concepts and practices.
- Familiarity with network and system administration is beneficial but not required.
Pathway Map
The ECIH training course follows the full incident handling lifecycle.
The curriculum moves from incident handling and response fundamentals through the response process, identification and analysis, containment, eradication and recovery, post-incident activities, advanced techniques, and ECIH exam preparation.
Course Content
- Developing an incident handling and response plan
- Incident handling lifecycle: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned
- Documenting and reporting incident handling activities
- Techniques for identifying different types of security incidents
- Analyzing incident indicators and patterns
- Using threat intelligence and analysis tools
- Techniques for containing incidents to prevent further damage
- Implementing immediate response actions
- Coordinating with internal and external stakeholders
- Techniques for eradicating threats from the environment
- Ensuring complete removal of malicious artifacts
- Implementing recovery procedures to restore normal operations
- Conducting post-incident reviews and analysis
- Documenting lessons learned and best practices
- Improving incident handling and response processes
- Handling complex incidents such as APTs and insider threats
- Integrating threat intelligence into incident response
- Developing and managing an incident response team
- Exam format and structure
- Key concepts and terminology
- Practice questions and tips for success
Course Features
Designed for practical incident response training and ECIH exam preparation.
Interactive Learning
Participate in training sessions, discussions, and hands-on labs with experienced instructors
Comprehensive Study Materials
Access extensive resources, including e-books, video lectures, and practice exams.
Real-World Applications
Engage in practical exercises and case studies to apply incident handling techniques.
Certification Preparation
Receive guidance and tips to successfully pass the ECIH certification exam.
Certification Exam
Prepare for the official EC-Council ECIH certification exam.
ECIH Exam Readiness
Accumentum’s ECIH Training Course prepares learners to identify, assess, contain, eradicate, and recover from security incidents.
Upon completing the course, you will be prepared to take the EC-Council Certified Incident Handler (ECIH) certification exam. Achieving this certification validates your skills in incident handling and response, significantly enhancing your career opportunities in cybersecurity.
Course Outline
Every ECIH module EC-Council lists.
EC-Council publishes 10 modules for ECIH. Our course follows the same sequence and adds review and practice to each one.
Modules 1 to 5
- 1. Introduction to Incident Handling and Response
- 2. Incident Handling and Response Process
- 3. First Response
- 4. Handling and Responding to Malware Incidents
- 5. Handling and Responding to Email Security Incidents
Modules 6 to 10
- 6. Handling and Responding to Network Security Incidents
- 7. Handling and Responding to Web Application Security Incidents
- 8. Handling and Responding to Cloud Security Incidents
- 9. Handling and Responding to Insider Threats
- 10. Handling and Responding to Endpoint Security Incidents
Exam Facts
How the ECIH exam works.
Exam: 100 multiple choice questions in 3 hours, through the EC-Council exam portal.
Career Outlook
Where ECIH can take you.
EC-Council points ECIH holders toward incident handler and incident responder roles, plus cyber forensic investigator, CSIRT analyst, digital forensic analyst and SOC analyst.
The U.S. Bureau of Labor Statistics reports that the median annual wage for information security analysts was $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. That figure is a national midpoint. Where you live, how long you've been in the field and who you work for all move the number. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for ECIH training.
Accumentum is an Army CA and Air Force COOL Approved Vendor. If you're serving, start with your education center and read our Army CA and Air Force COOL pages for the steps.
Paying on your own? ECIH prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Questions first? Talk with us or email info@accumentum.net.
Skills
What EC-Council says ECIH teaches.
This is what EC-Council says the ECIH course teaches.
Skills EC-Council lists for ECIH
- Key issues plaguing the information security world.
- Various types of cybersecurity threats, attack vectors, threat actors, and their motives, goals, and objectives of cybersecurity attacks
- Various attack and defense frameworks (Cyber Kill Chain Methodology, MITRE ATT&CK Framework, etc.)
- Fundamentals of information security concepts (vulnerability assessment, risk management, cyber threat intelligence, threat modeling, and threat hunting)
- Fundamentals of incident management (information security incidents, signs and costs of an incident, incident handling and response, and incident response automation and orchestration)
- Different incident handling and response best practices, standards, cybersecurity frameworks, laws, acts, and regulations
- Various steps involved in planning incident handling and response program (planning, recording and assignment, triage, notification, containment, evidence gathering and forensic analysis, eradication, recovery, and post-incident activities)
- Importance of first response and first response procedure (evidence collection, documentation, preservation, packaging, and transportation)
- How to handle and respond to different types of cybersecurity incidents in a systematic way (malware incidents, email security incidents, network security incidents, web application security incidents, cloud security incidents, insider threat-related incidents, and endpoint security incidents)
Roles
Jobs that use ECIH.
The DoD 8140 list comes from the DCWF table EC-Council publishes.
Roles EC-Council names for ECIH
- Incident Handler
- Incident Response Consultant/Associate /Analyst/Engineer/Specialist/Expert/Manager
- CSIRT Analyst/Engineer/Manager
- Information Security Associate/ Analyst/Engineer/Specialist/Manager
- Cyber Defense Security Consultant/Associate/Analyst
- IT Security Operations Center Analyst (SOC Analyst/Engineer)
- Cyber Forensic Investigator/Consultant/Analyst/Manager
- Digital Forensic Analyst
- Cyber Risk Vulnerability Analyst/Manager
- Cyber Intelligence Analyst and Cybersecurity Threat Analyst/Specialist
- Cybersecurity Incident Response Team Lead
- Penetration Tester
DoD 8140 (DCWF) work roles
- 531 Cyber Defense Incident Responder
Practice
How ECIH training works.
EC-Council lists three days and 24 hours of class time for ECIH training, with fifty percent of that time in labs. It says students work with 800+ incident handling and response tools and over 95 labs. The course walks through nine stages: preparation, incident recording and assignment, triage, notification, containment, evidence gathering and forensic analysis, eradication, recovery and post-incident activities.
Here's how we group the modules in class. Modules 1 to 3 cover incident handling basics, the IH&R process and first response. Modules 4 to 6 cover malware, email and network security incidents. Modules 7 to 10 cover web application, cloud, insider threat and endpoint incidents.
The ECIH exam gives you 100 questions in 3 hours, which works out to about 1.8 minutes a question. We time our practice sets to that pace, then go back over every miss so you know why the right answer is right.
Frequently Asked Questions
Understand how Accumentum’s ECIH: Certified Incident Handler Certification Training Course supports certification preparation, hands-on response skills, eligibility, delivery, and career advancement.
The Certified Incident Handler (ECIH) credential from EC-Council validates your skills in incident handling and response, including the ability to identify, assess, and respond to various security incidents.
IT professionals and security officers responsible for incident management and response, system administrators and network engineers in security operations, security consultants and advisors, and anyone interested in becoming a certified Incident Handler.
A basic understanding of information security concepts and practices. Familiarity with network and system administration is beneficial but not required.
The curriculum covers incident handling and response fundamentals, the incident handling and response process, identifying and analyzing security incidents, containment strategies, eradication and recovery, post-incident activities, advanced incident handling techniques, and ECIH exam preparation.
Yes. A dedicated module covers the exam format and structure, key concepts and terminology, and practice questions and tips for success.
Yes. You participate in training sessions, discussions, and hands-on labs with experienced instructors, plus practical exercises and case studies that apply incident handling techniques.
The lifecycle covered in the course is Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned, along with documenting and reporting incident handling activities.
Yes. The course addresses handling complex incidents such as APTs and insider threats, integrating threat intelligence into incident response, and developing and managing an incident response team.
Join the EC-Council ECIH: Certified Incident Handler Certification Training Course at Accumentum by visiting Accumentum’s course registration page for more information and to register.
Achieving this certification validates your skills in incident handling and response, significantly enhancing your career opportunities in cybersecurity.
Exam: 100 multiple choice questions in 3 hours, through the EC-Council exam portal.
EC-Council lists 10 modules, and our course covers each one.
Accumentum is an Army CA and Air Force COOL Approved Vendor. Start with your education center, and we'll help with the rest.
EC-Council says you need at least 1 year of experience working as a cybersecurity professional.
No. EC-Council designed ECIH for mid-level to senior cybersecurity professionals.
Yes. We teach it live online, and EC-Council also offers its own iWeek online option.
Enrollment
Enroll in the ECIH Certification Training Course with Accumentum.
Join the EC-Council ECIH - Certified Incident Handler Certification Training Course at Accumentum and start your journey to becoming a certified Incident Handler.
For more information and to register, visit Accumentum’s course registration page below.
Advance your cybersecurity career with ECIH incident handling training.
Prepare for the EC-Council ECIH certification exam, build hands-on incident response skills, and learn to contain, eradicate, and recover from security incidents.