nl en

Cyber Incident Management


Admission requirements

Admission only after intake, please see our website


No organisation can achieve totally assured cybersecurity. Thus, organisations must develop capabilities to effectively identify and respond to cyber incidents, minimizing negative impacts. This course focuses on the theory and practice of cyber incident management at the organizational level. It combines the study of academic perspectives on crisis management and cybersecurity governance with the practice of creating readiness, response and recovery capabilities in organisations. Particular emphasis will be given to the analysis (both theoretical and practical) of the crisis management lifecycle, including readiness plans, cyber incident response, and recovery. Through traditional lectures and practical exercises, students will learn about the analytical and decision-making skills required to respond to cyber incidents and manage cyber crises at the organisational level.

Course objectives

After finishing this course, students will be able to:

  • Debate the differences between cyber crises and other types of crises.

  • Reflect on the role of the Nationaal Cyber Security Centrum and other relevant actors in the Dutch cyber incident response ecosystem.

  • Explain the process of digital forensic investigations.

  • Formulate proposals to deal with system vulnerabilities.

  • Develop an incident response, business continuity, and disaster recovery plan.

  • Design effective communication strategies tailored to the particularities of cyber crisis cases.


On the right-hand side of the programme front page of the E-Prospectus you will find a link to the online timetables.

Mode of instruction

Lectures, seminarstyle, exercises, class discussion and guest lecture(s)

Dr. Cristina del Real, and guest lecturers.

Assessment method

The final grade will consist of one presentation and an exam:

Individual presentation (30% of the final grade).
Presentation will be held during a plenary online session.

A written assignment (70% of the final grade)

Only assessments with the weight of 30% and lower are compensable. This means that one does not have to pass an assessment if it weighs 30% or less in order to pass the course, if the average of all assessments combined is at least a 5.5. In addition, assignments weighing up to and including 30% cannot be re-taken, meaning that if one failed an assessment of 30% or less one is not allowed to redo it and that assessment must be compensated by the other assessment(s).

The re-sit will take the same forms

Reading list

Compulsory literature and literature for further consultation will be announced via Brightspace


No registration is required for lectures and exams.


Dr. Cristina del Real

M.I.Warner, study coordinator


For more information see the website see our website