Incident response: the first hour for an MSP technician
For MSP technicians and service desk level 2/3 staff who already know the first-15-minute actions (contain, preserve, escalate) and now have to keep working the incident for the rest of the first hour alongside a security lead. Covers declaring and triaging the incident, estimating its scope across the customer (and across your own shared tools), keeping an incident log that will stand up later, and communicating on a schedule. Uses NIST SP 800-61 Rev. 3 and CISA's #StopRansomware guidance (US). Notification and reporting duties depend on law, contract and your company's plan: this course is not legal advice and does not grant any certification. Ends with a supervisor-run tabletop exercise.
- Level
- Intermediate
- Length
- About 75 minutes
- Contents
- 4 lessons · final exam
- Status
- Published · updated 10 Oct 2026
Skills you'll practise
- Identify when reported activity meets the criteria for declaring an incident and who should lead it
- Choose a priority for an incident and identify other systems, accounts and customers to check when estimating its scope
- Write incident log entries that record facts, actions, times with zone and who acted, without speculation
- Choose who to update, how and when during the first hour, including out-of-band channels and escalation to an incident response provider
Course outline
- 1.Declaring the incident and naming who leads itLesson · 12 min
- 2.Triage and scope: choosing a priority and checking other systemsLesson · 18 min
- 3.The incident log and evidenceLesson · 15 min
- 4.Communicating, escalating and handing overLesson · 15 min
- 5.Incident response: the first hour for an MSP technician: knowledge checkKnowledge check · 13 questions
- 6.Incident response: the first hour for an MSP technician: practical exerciseKnowledge check · 1 question
- 7.Final exam8 questions · passing it completes the course, so people who already know the material can test out
Sources it draws on
The lessons and questions are written from these references, so learners can go back to the original.
See it with your own jobs and topics
Tell us about your team and we'll walk you through setup, from choosing jobs to your first skills check.