This course provides current and future managers of computer security incident response teams (CSIRTs) with a pragmatic view of the issues that they will face in operating an effective team. The course provides insight into the work that incident management staff and managers may be expected to handle.

The course also provides prospective or current managers with an overview of the incident handling process and the types of tools and infrastructure needed to be effective. Technical issues are discussed from a management perspective.

Topics include hiring staff, identifying critical information, publishing information, establishing effective working relationships, working with law enforcement, evaluating incident management services and operations, building service capacity, and the importance of pre-established policies and procedures.