Selected range of Scoping activities relating to Containment incident handling Remediation includes but not limited Lesson-based hardening to: Reporting Documents that Guide to Integrating Forensic Techniques into Incident Response (NIST support the SP800‐86) organisation to collect forensic data for incident responses includes but not limited to: Data evidence and Evidence collection order collection forensic Data integrity activities includes but Data preservation not limited to: Volatile data collection Incident tracking Vocabulary for Event Incident description Recording and Incident Discovery and response Sharing (VERIS) Impact assessment schema categories includes but not limited to: EVIDENCE GUIDE The evidence provides advice on assessment and must be read in conjunction with the Performance Criteria, Required Skills and Knowledge, the Range Statement and the Assessment section in Section B of the accreditation submission. Critical aspects for To be considered competent in this unit assessors must be satisfied the assessment and candidate can demonstrate the achievement of all of the elements of the evidence required to competency to the level defined by the associated performance criteria assess competency in Specifically they must be able to: this unit classify threats and demonstrate how threats occur; prepare the organisation to deal with incident responses; compose processes for data and event analysis; analyse data and detect intrusions; apply models and processes to incidents; Evidence should show competency working in a realistic environment and Context of and specific a variety of conditions. The candidate will have access to all tools, resources for equipment, materials and documentation required. The candidate will be assessment permitted to refer to any relevant workplace procedures, product and manufacturing specifications, codes, standards, manuals and reference materials. This unit may be assessed on the job, off the job or a combination of both.
Selected range of activities relating to incident handling includes but not limited to: Scoping Containment Remediation Lesson-based hardening Reporting Documents that support the organisation to collect forensic data for incident responses includes but not limited to: Guide to Integrating Forensic Techniques into Incident Response (NIST SP800‐86) Data evidence and collection forensic activities includes but not limited to: Evidence collection order Data integrity Data preservation Volatile data collection Vocabulary for Event Recording and Incident Sharing (VERIS) schema categories includes but not limited to: Incident tracking Incident description Discovery and response Impact assessment EVIDENCE GUIDE The evidence provides advice on assessment and must be read in conjunction with the Performance Criteria, Required Skills and Knowledge, the Range Statement and the Assessment section in Section B of the accreditation submission. Critical aspects for assessment and evidence required to assess competency in this unit To be considered competent in this unit assessors must be satisfied the candidate can demonstrate the achievement of all of the elements of the competency to the level defined by the associated performance criteria Specifically they must be able to: classify threats and demonstrate how threats occur; prepare the organisation to deal with incident responses; compose processes for data and event analysis; analyse data and detect intrusions; apply models and processes to incidents; Context of and specific resources for assessment Evidence should show competency working in a realistic environment and a variety of conditions. The candidate will have access to all tools, equipment, materials and documentation required. The candidate will be permitted to refer to any relevant workplace procedures, product and manufacturing specifications, codes, standards, manuals and reference materials. This unit may be assessed on the job, off the job or a combination of both.