AI Academy
NIS2 RESPONDE — Incident Management and Notification
Classify, escalate, notify, recover, close and prove: the process that turns a technical alert into a defensible response.
Course overview
Training for everyone involved in managing cybersecurity incidents: from classification and escalation to notification, recovery, closure and post-incident review. Participants work through significance criteria, notification deadlines, communications and evidence, using the NIS2 Essential Toolkit — Incident Management and, where useful, Cybersecure. It follows Portugal’s Cybersecurity Legal Framework, Regulation 756/2026 and QNRCS 2.0. It is not a technical SOC or forensics course.
What you will learn
- Distinguish an event, an incident and a significant incident.
- Apply declaration, categorisation, priority and escalation criteria.
- Organise facts, hypotheses and the timeline under uncertainty.
- Prepare, validate and evidence notifications within the deadlines.
- Justify containment, recovery and closure decisions.
- Run the post-incident review and organise the evidence required.
Programme
- Session 1Classify and escalate
- Session 2Notify and communicate
- Session 3Recover, close and evidence
Course information
November 2026- Dates
- 10, 17 and 24 November 2026
- Schedule
- 14:30–17:30, Lisbon time
- Duration
- 9 h
- Format
- Online (in Portuguese)
- Trainer
- Henrique Necho
- Fee
- AEP members: €495 · Others: €550
10% group discount from 3 registrations (cannot be combined with other discounts).
Register on the AEP websiteRegistration and payment are handled by AEP — Associação Empresarial de Portugal.
In an incident, deciding well matters as much as deciding fast — and being able to prove it afterwards.
Ready to build the skills your role now demands?
AI Academy programmes combine clear frameworks, real cases and practical sessions. Talk to us about the right course for you or your team.