Security operations shift supervision
A supervisor-level course on running a security operations shift: the supervisor’s place in CSF 2.0 and the FIRST CSIRT services model, triage and escalation, incident command during the shift, the distinct NIS2 and CRA reporting clocks, and coaching a team with metrics that actually improve the work. Five modules, each with a worked example, and a 10-question final quiz. Based on cited public frameworks and official pages. Not an accredited qualification.
What you will learn
- Explain and apply: Place the shift supervisor in the CSF 2.0 functions and the FIRST CSIRT services model, including the limits of the role’s authority.
- Explain and apply: Run triage, escalation and shift handover so detection and response work as a system, not as a pile of tickets.
- Explain and apply: Command an incident during the shift using the SP 800-61 Rev. 3 model (Detect, Respond, Recover), with a clear decision log.
- Explain and apply: Distinguish the NIS2 and CRA reporting clocks and trigger the right notification path on time.
- Explain and apply: Coach the team, manage fatigue and report operational metrics that feed continuous improvement.
modules
- The supervisor’s place on the shift
- Triage, escalation and handover
- Incident command during the shift
- Two reporting clocks: NIS2 and the CRA
- Coaching, fatigue and useful metrics
Operational and supervisory education only. It is not legal advice, not a substitute for your organisation’s incident or regulatory procedures, and not an accredited qualification. Legal duties depend on whether the organisation is in scope of each regime and on national transposition. Standards and official pages are summarised as read on the access date; check effective dates and local rules. Figures in worked examples are illustrative.