CREST - Certified Incident Manager



Just 4 Days



Classroom / Online / Hybrid

Next date

Next date:

7/2/2022 (Monday)


On this 4-day accelerated Firebrand course for CREST's Certified Incident Manager (CCIM) exam, you'll learn to determine the path of investigation to be taken in response to a cyber breach. You'll make use of real world experience and the information available to continuously re-evaluate the situation and manage the direction of investigation.

Achieving the Incident Manager certification validates your ability to lead and present all elements of the Incident Response project lifecycle including identification, containment and eradication.

Some of the skills you'll develop and eventually be tested on includes:

  • Client management
  • Containment techniques
  • Project management and time management
  • Evidence handling
  • Threat intelligence, contextualisation attribution and motivation
  • Risk analysis
  • Attack and compromise lifecycle
  • Technical vulnerability root cause identification

Firebrand make use of a unique Lecture | Lab | Review technique. This approach combines both theoretical knowledge with hands-on practical skills. This means you'll learn faster and develop the real-world experience necessary to apply your skills when you return to work.

On this course, you'll be prepared for and sit the CREST Certified Incident Manager (CCIM) examination on day 4. This is covered by your Certification Guarantee.

An Incident Manager's role is expected to be fulfilled by highly experienced personnel that has spent a considerable amount of time working on incident response engagement. You should also have strong and broad technical skills in order to play a key part in understanding the details of a cyber incident.

Four reasons why you should sit your course with Firebrand Training

  1. You'll be trained and certified faster. Learn more on this 4-day accelerated course. You'll get at least 12 hours a day of quality learning time in a distraction-free environment
  2. Your course is all-inclusive. One simple price covers all course materials, exams, accommodation and meals – so you can focus on learning
  3. Pass first time or train again for free. Your expert instructor will deliver our unique accelerated learning methods, allowing you to learn faster and be in the best possible position to pass first time. In the unlikely event that you don't, it's covered by your Certification Guarantee
  4. Study with an award-winning training provider. We've won the Learning and Performance Institute's "Training Company of the Year" three times. Firebrand is your fastest way to learn, with 108.738 students saving more than one million hours since 2001



Throughout this course, you'll cover the following material:

  • Client management
  • Containment techniques
  • Project management and time management
  • Evidence handling
  • Communications
  • Recovery and remediation
  • On-going technical prevention
  • Judgement making and critical reasoning
  • Written skills
  • Third Parties
  • Reporting Agencies
  • Threat intelligence, Contextualisation Attribution and Motivation
  • Industry Best Practice
  • Risk Analysis
  • Attack and compromise lifecycle
  • Legal and Jurisdictional Issues
  • Ethics
  • Technical vulnerability root cause identification
  • Physical threats
  • Insider attacks

Exam Track

On day 4 of this accelerated course, you'll sit the following exams at the Firebrand Training centre, covered by your Certification Guarantee:

Incident Manager Part 1

  • Duration: 3 hours
  • Number of questions: 150
  • Format: Multiple choice and 1 written response

Incident Manager Part 2

  • Duration: 4 hours
  • Number of questions: 3
  • Format: Written responses

What's Included

Your accelerated course includes:

  • Accommodation *
  • Meals, unlimited snacks, beverages, tea and coffee *
  • On-site exams **
  • Exam vouchers **
  • Practice tests **
  • Certification Guarantee ***
  • Courseware
  • Up-to 12 hours of instructor-led training each day
  • 24-hour lab access
  • Digital courseware **
  • * For residential training only. Doesn't apply for online courses
  • ** Some exceptions apply. Please refer to the Exam Track or speak with our experts
  • *** Pass first time or train again free (just pay for accommodation, exams and incidental costs)


While there are no official prerequisites for this course, you should be aware that the role of an Incident Manager requires a large amount of experience working on incident response engagement.

Are you ready to get certified in record time?

We interview all applicants for the course on their technical background, degrees and certifications held, and general suitability. If you get through this screening process, it means you stand a great chance of passing.

Firebrand Training is an immersive training environment. You must be committed to the course. The above prerequisites are guidelines, but many students with less experience have other background or traits that have enabled their success in accelerated training through Firebrand Training.

If you have any doubts as to whether you meet the pre-requisites please call (0)8 52 50 01 66 and speak to one of our enrolment consultants, who can help you with a training plan.


We've currently trained 108.738 students in 12 years. We asked them all to review our Accelerated Learning. Currently,
96,66% have said Firebrand exceeded their expectations:

"Fantastic instructor. Professional, enthusiastic, and knows the subject inside out. An absolute pleasure to learn from. "
J.M.J., Program Planning Professionals Ltd. (8/10/2018 (Monday) to 11/10/2018 (Thursday))

"The instructor we had was very knowledgeable and approachable and willing to delve further into detail (time permitting). Course content was very informative and additional reading material is very helpful so I know where to concentrate my efforts."
Philip Freeman, Xpertex. (8/10/2018 (Monday) to 11/10/2018 (Thursday))

"Excellent training - trainers and venue ideally setup to support your learning needs."
Chris Cobb, Xpertex ltd. (8/10/2018 (Monday) to 11/10/2018 (Thursday))

"Brilliant course which was very comprehensive. Long hours but instructor was also flexible and happy to adapt pace to needs of group/individual. "
J.T.. (20/8/2018 (Monday) to 23/8/2018 (Thursday))

"Excellent facilities and training structure. Long hours but worth investing the time."
William Davies. (20/8/2018 (Monday) to 23/8/2018 (Thursday))

Course Dates

CREST - Certified Incident Manager (CCIM)




Book now

27/9/2021 (Monday)

30/9/2021 (Thursday)

Finished - Leave feedback


7/2/2022 (Monday)

10/2/2022 (Thursday)


Book now

Latest Reviews from our students