Cyber Training Updates
June - August 2025
Highlights: What’s New?
-
New Course Announcement! The two-day virtual Cloud Incident Response series continues in July and August with two new courses: Azure Incident Detection and Response on July 15-16 and Advanced Azure Incident Response Strategies and Techniques on August 5-6 and August 26-27.
-
New Course Announcement! Join us July 22-23 for our first course in a brand-new Anatomy of an Attack series - “Hunting the Hidden: A Volt Typhoon Adversary Emulation Workshop.” This two-day interactive virtual course with cyber range lab activities will dive deep into Living off the Land Techniques.
-
New Course Announcement! Our Incident Response Triage Series is combined into a five-day in-person (Arlington, VA) course. Join us July 28-Aug 01 for a powerful entry-level Incident Response course “Enterprise Cyber Threat Analysis and Response.”
-
New Course Announcement! “Living off the Land: An Intrusion Technique Overview” is a new entry-level webinar on July 22. Then, join us on August 15 for a cyber range training course “Interactive Training: Living off the Land Strategies for Cyber Defense.”
-
New Course Announcement! On August 16, join us for a one-hour webinar on the CISA tool “Logging Made Easy.”
-
Exciting News! Two new Community spaces have been created for individuals interested in cyber training: the Federal Cyber Defense Skilling Academy and the Cybersecurity Awareness, Training, Education, and Research Community of Interest (CATER COI). For those federal employees who are interested in connecting with others in the cybersecurity training community, visit the CATER COI Community page, where you’ll find meeting notes from past meetings, as well as information on upcoming meetings.
-
Season V of the US Cyber Games kicks off June 5th – June 18th with an exciting virtual event series. Participate in capture-the-flag competitions, hear from keynote speakers and expert cybersecurity panels, win prizes, and other surprises. Register now to stay in the loop, and check out their website for important dates, athlete registration, and coach/ mentor applications.
The purpose of CISA’s Skilling Academy is to provide cybersecurity training for full-time federal employees, promoting collaboration and interactive learning to protect, defend, respond, and reduce risk to our nation’s critical infrastructure from cyber threats.
The Skilling Academy offers two types of trainings:
-
Micro-courses: These condensed, self-paced, 100% virtual trainings are designed to equip students with foundational and specialized cybersecurity skills. Each course emphasizes practical training to ensure that participants gain real-world experience in protecting and defending against cyber threats. The micro-courses range from 40 to 80 hours in duration.
-
Pathways: These offerings are live, virtual, intense, full-time, one to three-month accelerated training offerings. Pathway students are provided with valuable opportunities to practice cybersecurity skills in lab environments, which are led by an online instructor.
Eligibility: All full-time federal employees, in any job series and any grade or grade equivalent for non-General Schedule (GS) employees, are eligible to apply to CISA's Federal Cyber Defense Skilling Academy. Government contractors are not permitted to participate.
Participation in the Skilling Academy is prioritized for individuals from departments and agencies within the Federal Civilian Executive Branch. Applications from other federal government entities are welcome and will be considered based on course availability and program requirement.
Micro-Courses
|
|
Micro-Course Title & Session Number
|
Length
|
Course Start & End Date
|
Applications Close Date*
|
|
Intro to Pen-Testing - Session 3
|
1 week (40 hours)
|
6/23/2025-6/27/2025
|
6/6/2025 (5pm EST)
|
|
Intro to Forensic Analysis – Session 3
|
2 weeks (80 hours)
|
7/14/2025-7/25/2025
|
6/27/2025 (5pm EST)
|
|
Basics of Threat Analysis - Session 3
|
2 weeks (80 hours)
|
7/28/2025-8/8/2025
|
7/11/2025 (5pm EST)
|
|
Introduction to Incident Detect/Respond/Handling - Session 3
|
2 weeks (80 hours)
|
8/18/2025-8/29/2025
|
8/1/2025 (5pm EST)
|
Pathway Courses
|
|
Pathway Title & Session Number
|
Length
|
Course Start & End Date
|
Applications Close Date*
|
|
System Security Analysis -Session 2
|
4 weeks
|
6/23/2025–7/18/2025
|
6/6/2025 (5pm EST)
|
|
Defensive Cybersecurity -Session 2
|
12 weeks
|
6/23/2025–9/26/2025
|
6/6/2025 (5pm EST)
|
|
Incident Response - Session 2
|
4 weeks
|
7/14/2025–8/8/2025
|
6/27/2025 (5pm EST)
|
|
Vulnerability Analysis -Session 2
|
4 weeks
|
8/4/2025–8/29/2025
|
7/18/2025 (5pm EST)
|
|
Digital Forensics - Session 2
|
4 weeks
|
8/4/2025 - 8/29/2025
|
7/18/2025 (5pm EST)
|
|
AI/ML Pathway - Session 3
|
4 weeks
|
8/25/2025- 9/19/2025
|
8/8/2025 (5pm EST)
|
*The application window will close when each micro-course reaches 30 applicants, which may be sooner than the application close date.
More courses and additional dates for the listed courses are available. For more information and instructions on how to apply, send an email to SkillingAcademy@cisa.dhs.gov
This series provides training assistance to cyber incident responders to help them prepare for, identify, assess, mitigate and report cyber events. This series includes 100-level one-hour webinars for a general audience and 200-level virtual training courses with cyber range lab activities where participants can learn and practice investigation, remediation, and incident response skills. The course audience are government employees and contractors at all levels - federal, state, local, tribal, and territorial, as well as educational and critical infrastructure partners. For more information, email cyberinsights@mail.cisa.dhs.gov
Events
|
|
Date
|
Course Code
|
Registration Opens
|
Course
|
Hours
|
|
6/09/2025
|
IR119
|
5/09/2025
|
Integrating Cyber Threat
|
1
|
|
6/10/2025
|
IR219
|
5/10/2025
|
Integrating Cyber Threat (Cyber Range Training)
|
4
|
|
6/10/2025
|
IR208
|
5/10/2025
|
Understanding Indicators of Compromise (Cyber Range Training)
|
4
|
|
6/11/2025
6/12/2025
|
IR219
|
5/11/2025
|
Integrating Cyber Threat Cyber Range Training)
|
8
|
|
6/17/2025
6/18/2025
|
IRC221
|
5/17/2025
|
Azure Incident Detection and Response (Cyber Range Training)
|
16
|
|
6/18/2025
|
SS131
|
5/18/2025
|
(Topic) AI
|
1
|
|
6/24/2025
|
IR211
|
5/24/2025
|
Using the CISA Incident Response Playbook at your Organization (Lab Course)
|
4
|
|
7/2/2025
|
IR108
|
06/02/2025
|
Understanding Indicators of Compromise
|
1
|
|
7/15/2025-7/16/2025
|
IRC221
|
6/15/2025
|
Azure Incident Detection and Response
|
16
|
|
7/22/2025-7/23/2025
|
IR223
|
6/22/2025
|
Anatomy of an Attack Series - Hunting the Hidden: A Volt Typhoon Adversary Emulation Workshop - NEW
|
16
|
|
7/28/2025-8/1/2025
|
IR225
|
6/28/2025
|
Enterprise Cyber Threat Analysis and Response 5-Day Course (In-person) - NEW
|
8
|
|
8/5/2025-8/6/2025
|
IRC222
|
7/5/2025
|
Advanced Azure IR Strategies and Techniques - NEW
|
16
|
|
8/7/2025
|
IR211
|
7/7/2025
|
Using the CISA Incident Response Playbook at your Organization
|
4
|
|
8/12/2025
|
IR208
|
7/12/2025
|
Understanding Indicators of Compromise
|
4
|
|
8/26/2025-8/27/2025
|
IRC222
|
7/5/2025
|
Advanced Azure IR Strategies and Techniques - NEW
|
16
|
To learn more or register visit: IR Training | CISA
This training series provides training assistance to cyber practitioners so they can enable secure systems by strengthening their cyber defenses against vulnerabilities, weaknesses, and threats. This series includes 100-level one-hour webinars for a general audience and 200-level virtual training courses with cyber range lab activities. The course audience are government employees and contractors at all levels - federal, state, local, tribal, and territorial - as well as educational and critical infrastructure partners. For more information, email cyberinsights@mail.cisa.dhs.gov
Events
|
|
Date
|
Course Code
|
Registration Opens
|
Course
|
Hours
|
|
6/26/2025
|
SS113
|
5/26/2025
|
Implementing SaaS security Guidelines
|
1
|
|
7/10/2025
|
SS204
|
6/10/2025
|
Defending Internet Accessible Systems
|
4
|
|
7/17/2025
|
SS213
|
6/17/2025
|
Implementing SaaS Guidelines
|
4
|
|
7/22/2025
|
SS130
|
6/22/2025
|
Living off the Land (LoTL): An Intrusion Technique Overview - NEW
|
1
|
|
7/24/2025
|
SS206
|
6/24/2025
|
Preventing DNS Infrastructure Tampering
|
4
|
|
7/29/2025
|
SS210
|
6/29/2025
|
Interactive Training: Introduction to Log Management with Cyber Range
|
4
|
|
8/15/2025
|
SS230
|
7/15/2025
|
Interactive Training: Living off the Land (LoTL) Strategies for Cyber Defense - NEW
|
4
|
|
8/19/2025
|
SS132
|
7/19/2025
|
Introduction to the CISA Logging Made Easy (LME) Solution Webinar - NEW
|
1
|
|
8/21/2025
|
SS205
|
7/21/2025
|
Preventing Web and Email Server Attacks
|
4
|
|
8/28/2025
|
SS110
|
7/28/2025
|
Introduction to Log Management
|
1
|
To learn more or register visit: IR Training | CISA
We provide instructor led, hands-on CDM Dashboard training for Federal Civilian Executive Branch (FCEB) employees and contractors in a virtual cyber range training environment. The virtual and in-person training events enhance the dynamic CDM approach to fortifying the cybersecurity of government networks and systems. These courses are designed for personnel at agencies participating in the CDM program who monitor, manage, or oversee controls on their information systems such as ISSOs, CDM POCs, ISSMs and those reporting metrics.
These CDM trainings enable participating FCEB agencies to improve their networks and defend against cyber adversaries. The CDM training provides detailed class discussion with real world simulated computer labs using a cyber virtual learning environment. The training will teach participants the basics of CDM and how to use the CDM Dashboard capabilities to help mitigate agency threats. We will also offer various CDM resources and external references.
Currently, the courses use version ES 6.4 of the CDM Dashboard within the cyber virtual training range (CVLE). The current content focuses on the most recent version of the dashboard, including FISMA Automation, HVA reporting, CyHy (Cyber Hygiene) and SCuBA (Secure Cloud Business Applications), and other dashboard capabilities. Current CDM courses are offered at the 100-level (Introductory) and 200-level (Intermediate).
Events
|
|
Date
|
Course Code
|
Registration Opens
|
Course
|
Hours
|
|
6/3/2025
|
CDM203
|
4/28/2025
|
System Security Analyst
|
4
|
|
6/12/2025
|
CDM220
|
4/30/2025
|
CDM220 - CDM & Federal Mandates - How to Use the CDM Dashboard to Enable Automated BOD 22-01 Reporting
|
4
|
|
6/17/2025
|
CDM301
|
5/5/2025
|
Management Overview of CDM and the CDM Agency Dashboard
|
2
|
|
6/25/2025 - 6/26/2025
|
CDM222
|
5/9/2025
|
Using the CDM Agency Dashboard to Advance Cyber Defense
|
12
|
|
7/01/2025
|
CDM141
|
6/01/2025
|
Introduction to the CDM Agency Dashboard
|
4
|
|
7/08/2025
|
CDM203
|
6/08/2025
|
CDM Dashboard Role-Based Training - System Analyst
|
4
|
|
7/15/2025
|
CDM220
|
6/15/2025
|
CDM and Federal Directives
|
2
|
|
7/22/2025 - 7/23/2025
|
CDM111
|
6/22/2025
|
Analyzing Cyber Risk with the CDM Agency Dashboard (in person)
|
16
|
|
7/31/2025
|
CDM330
|
6/30/2025
|
Managing High Value Assets (HVA) Using the CDM Agency Dashboard
|
4
|
|
8/5/2025
|
CDM320
|
7/05/2025
|
Using the CDM Agency Dashboard to Respond to Federal Directives
|
4
|
|
8/14/2025
|
CDM141
|
7/14/2025
|
Introduction to the CDM Agency Dashboard
|
4
|
|
8/20/2025
|
CDM144
|
7/20/2025
|
Vulnerability and Risk Management with the CDM Agency Dashboard
|
4
|
|
8/26/2025
|
CDM142
|
7/26/2025
|
Asset Management with the CDM Agency Dashboard
|
4
|
To learn more or register visit: CDM Training | CISA
We offer free, virtual ICS trainings geared toward Critical Infrastructure owners and operators. The trainings are designed to reduce cybersecurity risks to critical infrastructure and encourage cooperation between CISA and the private sector. Trainings vary in length and run from 8:00 am-5:00 pm MST (10:00 am–7:00 pm EST). All trainings are conducted through Online Training or CISA Virtual Learning Portal (VLP), with the exception of the three- or four-day, in-person courses at Idaho National Labs (INL) in Idaho Falls, ID.
*The ICS300 online course is a prerequisite for attending the in-person ICS301 training hosted by CISA at the Idaho National Laboratory. This ICS300 course focuses on many of the hands-on skills needed to protect and secure Industrial Control Systems and Operational Technology networks. The ICS401 course is available either online (ICS401V) or in-person (ICS401L).
To learn more or sign up, visit: ICS Training Calendar
|
CT Mission
|
CT Vision
|
|
Address today’s cyber workforce challenges through innovative education and training opportunities.
|
Lead and influence national cyber training and education to promote and enable the cyber-ready workforce of tomorrow.
|
Contact Us:
|
