The Federal Office for Information Security (BSI) offers a personal certification as incident expert. To this end, BSI has created a curriculum for training providers, which serves as the basis for a consistent three-day qualification.

Incident experts can support citizens and small and medium-sized enterprises (SMEs) in incident handling, e.g. in the following contexts:

• Analysis of IT security incidents (via telephone, remote support or on-site),
• Damage containment in the context of an IT security incident,
• Identification of the causes of an IT security incident, and
• Systems recovery after an IT security incident.

The „Leitfaden für die Reaktion auf IT-Sicherheitsvorfälle für Vorfall-Experten“ ("Guideline for the response to IT security incidents for incident experts”, only available in German language) supports incident experts in their activities in the context of the Cyber-Security-Network.
One of the requirements for the personal certification as incident expert is the completion of additional training. Further information on the required training and on training providers can be found here (only available in German language).

After completion of the additional training, it is possible to submit an application for the personal certification as incident expert to BSI. In addition to having taken the training, there are some further admission requirements that need to be fulfilled. For further information on these requirements, please refer to the document “Programm Vorfall-Experten” (“programme incident experts”). This document, as well as the application form, can be found in the box “Further information” below. Please note that these documents are only available in German. Once the application has been submitted, the applicant can take the incident expert exam.

The personal certification is granted when a person has provided all the required proofs and has passed the exam.