Dell Infrastructure Security D-IS-S-23

Security

Demonstrate your ability to implement the NIST Cybersecurity Framework — addressing risks, attack vectors, and cybersecurity outcomes through the lens of People, Process, and Technology across Identify, Protect, Detect, Respond, and Recover functions.

NIST CSF Risk Management Asset Inventory Business Impact Analysis BCP / DRP Incident Response Threat Detection Continuous Monitoring Access Control Security Controls Vulnerability Management Cyber Recovery

What You Will Learn

Six NIST Security Modules

Master the NIST Cybersecurity Framework in depth — from architecture and asset identification through protection, detection, incident response, and business recovery planning.

Module 01

NIST Framework Overview

›NIST CSF architecture — Framework Core (Functions/Categories/Subcategories/Informative References), Tiers (1-Partial to 4-Adaptive), and Profiles
›Framework Core functions — Identify, Protect, Detect, Respond, Recover — and how they map to the full security lifecycle
›Category layer topics — Asset Management, Business Environment, Governance, Risk Assessment, Risk Management Strategy
›Framework Tiers explained — Tier 1 Partial (reactive), Tier 2 Risk Informed, Tier 3 Repeatable, Tier 4 Adaptive (proactive)
›Current Profile vs Target Profile — gap analysis methodology and roadmap creation for improving cybersecurity posture

Module 02

NIST Framework: Identify Function

›Asset definition — hardware, software, data, people, facilities — and determining which assets require protection and at what classification level
›Continuously updated inventory — the "who/what/why" of asset discovery, CMDB management, and automated inventory tooling
›Discovery and inventory supporting Disaster Recovery, Incident Response, Communications, and Business Impact Analysis planning
›Inventory classification controls — sensitivity labels, data ownership assignment, criticality tiers, and access control pre-requisites
›KPIs for inventory management — asset coverage percentage, inventory staleness rate, unmanaged device count, and shadow IT detection metrics

Module 03

NIST Framework: Protect Function

›Baseline configuration — creating, documenting, and enforcing a secure configuration baseline for all infrastructure components
›Business Impact Analysis (BIA) as the foundation of the protect function — identifying critical systems and acceptable downtime thresholds
›Business Continuity Plan (BCP) structure — scope, recovery strategies, alternate site planning, and BCP testing cadence
›Maintenance and access control subcategory controls — patching cadence, change management, MFA, least privilege, and privileged access workstations
›Awareness training controls — phishing simulation, security awareness programmes, role-based training, and tracking completion rates
›Data security and protective technology controls — DLP, encryption at rest/in-transit, network segmentation, and endpoint protection platforms

Module 04

NIST Framework: Detect Function

›Anatomy of a breach — reconnaissance, initial access, lateral movement, privilege escalation, data exfiltration, and how to interrupt the kill chain
›Detection methods — SIEM log correlation, EDR/XDR telemetry, NDR network traffic analysis, honeypots, and threat hunting
›Continuous monitoring — 24/7 SOC operations, SIEM use case tuning, alert fatigue reduction, and detection coverage measurement
›Detection and analysis subcategories — anomaly detection, security event log analysis, vulnerability scan integration, and threat intelligence feeds
›Detection metrics — mean time to detect (MTTD), false positive rate, detection coverage gap, and MITRE ATT&CK technique coverage

Module 05

NIST Framework: Respond Function

›Quantifying the extent of a security breach — blast radius analysis, impacted asset inventory, data classification affected, and regulatory notification thresholds
›Breach containment strategies — network isolation, account lockout, endpoint quarantine, and emergency firewall rule deployment
›Incident Response Plan construction — preparation, identification, containment, eradication, recovery, and lessons-learned phases
›Communications Plan — internal stakeholder notification, executive escalation, regulator notification (GDPR 72hr, HIPAA), and public communications strategy
›After-action review — root cause analysis, timeline reconstruction, control gap identification, and IR playbook update procedures

Module 06

NIST Framework: Recover Function

›Disaster Recovery Plan (DRP) implementation — RTO/RPO targets, warm/hot/cold site selection, failover testing, and DR runbook maintenance
›BCP supporting timely recovery — crisis management team activation, alternate work arrangements, and supply chain continuity planning
›Return to "business as usual" requirements — system validation checklists, data integrity verification, and staged service restoration
›Business impact assessment — quantifying financial, operational, and reputational damage; cyber insurance claim preparation
›Reputation and revenue recovery — stakeholder communications, media response, customer notification, and trust restoration initiatives

Full Curriculum

6-Module D-IS-S-23 Programme

Complete infrastructure security curriculum — from NIST framework architecture through all five CSF functions with practical implementation guidance for People, Process, and Technology.

›NIST CSF Framework Core — five Functions (Identify, Protect, Detect, Respond, Recover), Categories, Subcategories, and Informative References (ISO 27001, CIS Controls, COBIT)
›Framework Tiers — Tier 1 Partial (ad-hoc, reactive), Tier 2 Risk Informed (aware but inconsistent), Tier 3 Repeatable (policy-driven), Tier 4 Adaptive (proactive, continuously improving)
›Category layer topics — Asset Management (ID.AM), Business Environment (ID.BE), Governance (ID.GV), Risk Assessment (ID.RA), Risk Management Strategy (ID.RM)
›Current Profile — documenting existing cybersecurity outcomes; Target Profile — desired state; Gap Analysis — prioritised remediation roadmap
›Alignment of NIST CSF to regulatory requirements — HIPAA, PCI-DSS, SOC 2, GDPR — and using the framework for vendor risk management

›Asset inventory scope — hardware assets (servers, endpoints, IoT), software assets (applications, OS), data assets (PII, IP, financial), and service dependencies
›Continuous inventory tooling — CMDB integration, active discovery (network scanners), passive discovery (DHCP/DNS analysis), and shadow IT detection
›Business environment mapping — critical service dependencies, third-party integrations, supply chain risk, and organisational function mapping
›Risk assessment process — threat source identification, vulnerability cataloguing, likelihood determination, impact analysis, and risk scoring matrix
›KPIs and reporting — asset coverage percentage (target: 100%), inventory staleness alerts, unmanaged device count, and quarterly risk register reviews

›Baseline configuration management — CIS Benchmarks, STIG application, golden image hardening, and automated drift detection using SCM tools
›BIA methodology — MTD (Maximum Tolerable Downtime), MBCO (Minimum Business Continuity Objective), WRT (Work Recovery Time), and RTO/RPO definition
›BCP structure — crisis management team roles, alternate processing sites (hot/warm/cold), communication trees, and BCP exercise schedule (tabletop/simulation)
›Access control subcategories — identity lifecycle management, MFA enforcement, privileged access workstations (PAW), just-in-time access, and access reviews
›Data security controls — data classification labelling, DLP policy enforcement, tokenisation, encryption key management (HSM), and secure data disposal procedures

›Breach anatomy — reconnaissance (OSINT/phishing), initial access (credential stuffing/exploit), lateral movement (pass-the-hash/WMI), exfiltration (DNS tunnelling/HTTPS)
›SIEM deployment — log source onboarding, use case library (brute force, beaconing, data staging), alert severity tiers, and SOAR playbook automation
›Endpoint detection — EDR agent rollout, behavioural analysis, process injection detection, and threat hunting using MITRE ATT&CK framework techniques
›Network detection — NDR baselining, east-west traffic analysis, encrypted traffic analysis (ETA), and DNS anomaly detection for C2 beaconing
›Continuous monitoring programme — 24/7 SOC operations model, Tier 1/2/3 analyst workflow, shift handover documentation, and MTTD/MTTR dashboards

›Breach scope quantification — impacted asset list, affected data classifications, regulatory notification obligations (GDPR Art. 33: 72hr, CCPA, HIPAA 60-day)
›Containment playbooks — network isolation procedures (VLAN quarantine, firewall ACL), endpoint quarantine, account lockout/reset, and credential rotation
›Incident Response Plan phases — Preparation (IRP documentation, tabletops), Identification, Containment, Eradication, Recovery, and Lessons Learned (PICERL)
›Communications Plan execution — internal escalation chain (CISO/CTO/CEO), regulator notification templates, legal counsel engagement, and PR spokesperson briefing
›After-action review — 5-Why root cause analysis, attack timeline reconstruction using SIEM, control gap documentation, and updated detection rule deployment

›DRP implementation — technology recovery runbooks, failover testing (planned vs unplanned), DR drill frequency, and post-test gap remediation
›BCP recovery phases — crisis management team activation checklist, incident command structure, alternate site activation, and service restoration priority order
›Business-as-usual return criteria — system integrity validation checklists, data consistency checks, application smoke tests, and phased user re-onboarding
›Business impact quantification — direct financial loss (revenue, ransom, recovery cost), indirect cost (regulatory fines, litigation), and cyber insurance claim documentation
›Reputation recovery — breach notification letters (plain-language, legally reviewed), media statement preparation, customer credit monitoring offers, and long-term trust rebuilding initiatives

Live Training

Live Instructor

Mon–Fri · Weekend batches

Recording

Live class recording included

30 Days

1.5 hrs/day weekday · 3 hrs weekend

Course Materials

Study notes and resources

Tech Support

Call / WhatsApp support

Working Hours

Mon–Fri · 9 AM – 6 PM

Enroll Now Download Brochure

Have Questions?

Chat with our Dell-certified security trainers instantly.

WhatsApp Us

Dell Infrastructure

Security

Six NIST Security Modules

6-Module D-IS-S-23 Programme

Ready to Secure Your Infrastructure?