Skip to content

Certified Incident Handler (ECIH)

Official EC-Council Online Course including i-Labs and exam



Enquire to get more info on pricing
Finance options

Finance options available

Study method
Online, self-paced
50 hours
Access to content
1 year
EC-Council Certified Incident Handler (ECIH)
Professional certification What's this?

3 students enquired about this course

Add to basket or enquire


The Certified Incident Handler (ECIH) course is a specialist program that caters for mid-level to high-level cybersecurity professionals. The program provides a method-driven course that uses a holistic approach to cover vast concepts concerning organisational incident handling and response.


EC-Council Certified Incident Handler (ECIH)

Awarded by EC-Council


Purpose of the ECIH credential is to:

Provide a structured approach for performing the incident handling and response (IH&R) process.

The Certified Incident Handler course will teach students to do the following:

  • Handle and respond to different types of cybersecurity incidents in a systematic way
  • Ensure an organisation can identify, contain and recover from an attack
  • Reinstate regular operations of the organisation as early as possible
  • Mitigate any negative impact on businesses from an attack
  • Draft security policies
  • Minimise the loss and after-effects breach of the incident

The skills taught in the ECIH program are desired by cybersecurity professionals from around the world and are highly respected by employers.

Course Outline

  • Introduction to Incident Handling and Response
  • Incident Handling and Response Process
  • Forensic Readiness and First Response
  • Handling and Responding to Malware Incidents
  • Handling and Responding to Email Security Incidents
  • Handling and Responding to Network Security Incidents
  • Handling and Responding to Web Application Security Incidents
  • Handling and Responding to Cloud Security Incidents
  • Handling and Responding to Insider Threats

This will all prepare you for the official Certified Incident Handler exam which is included within the package.

Who is this course for?

The ECIH course is ideal for computer forensic analysts, forensic examiners and security analysts.


It is advised that you have at least one year of experience in the cybersecurity domain or have completed official training from an accredited provider.

Career path

The Certified Incident Handler course is suitable for anyone looking to work in any of the following positions:

  • Risk Assessment Administrators
  • System Engineers
  • Cyber Forensic Investigators
  • SOC Analyst
  • Vulnerability Assessment Auditors

Questions and answers


Currently there are no reviews for this course. Be the first to leave a review.


What does study method mean?

Study method describes the format in which the course will be delivered. At courses are delivered in a number of ways, including online courses, where the course content can be accessed online remotely, and classroom courses, where courses are delivered in person at a classroom venue.

What are CPD hours/points?

CPD stands for Continuing Professional Development. If you work in certain professions or for certain companies, your employer may require you to complete a number of CPD hours or points, per year. You can find a range of CPD courses on, many of which can be completed online.

What is a ‘regulated qualification’?

A regulated qualification is delivered by a learning institution which is regulated by a government body. In England, the government body which regulates courses is Ofqual. Ofqual regulated qualifications sit on the Regulated Qualifications Framework (RQF), which can help students understand how different qualifications in different fields compare to each other. The framework also helps students to understand what qualifications they need to progress towards a higher learning goal, such as a university degree or equivalent higher education award.

What is an ‘endorsed’ course?

An endorsed course is a skills based course which has been checked over and approved by an independent awarding body. Endorsed courses are not regulated so do not result in a qualification - however, the student can usually purchase a certificate showing the awarding body’s logo if they wish. Certain awarding bodies - such as Quality Licence Scheme and TQUK - have developed endorsement schemes as a way to help students select the best skills based courses for them.