Cyber Training Bulletin: July - September 2025

Cyber Training Updates

July - September 2025

Federal Cyber Defense Skilling Academy

The purpose of CISA’s Skilling Academy is to provide cybersecurity training for full-time federal employees, promoting collaboration and interactive learning to protect, defend, respond, and reduce risk to our nation’s critical infrastructure from cyber threats.  

The Skilling Academy offers two types of trainings: 

• Micro-courses: These condensed, self-paced, 100% virtual trainings are designed to equip students with foundational and specialized cybersecurity skills. Each course emphasizes practical training to ensure that participants gain real-world experience in protecting and defending against cyber threats. The micro-courses range from 40 to 80 hours in duration. 
• Pathways: These offerings are live, virtual, intense, full-time, one to three-month accelerated training offerings. Pathway students are provided with valuable opportunities to practice cybersecurity skills in lab environments, which are led by an online instructor. 

Eligibility: All full-time federal employees, in any job series and any grade or grade equivalent for non-General Schedule (GS) employees, are eligible to apply to CISA's Federal Cyber Defense Skilling Academy. Government contractors are not permitted to participate. 

Participation in the Skilling Academy is prioritized for individuals from departments and agencies within the Federal Civilian Executive Branch. Applications from other federal government entities are welcome and will be considered based on course availability and program requirement. 

*The application window will close when each micro-course reaches 30 applicants, which may be sooner than the application close date. 

More courses and additional dates for the listed courses are available. For more information and instructions on how to apply, send an email to SkillingAcademy@mail.cisa.dhs.gov

Incident Response (IR) 

This series provides training assistance to cyber incident responders to help them prepare for, identify, assess, mitigate and report cyber events. This series includes 100-level one-hour webinars for a general audience and 200-level virtual training courses with cyber range lab activities where participants can learn and practice investigation, remediation, and incident response skills. The course audience are government employees and contractors at all levels - federal, state, local, tribal, and territorial, as well as educational and critical infrastructure partners. For more information, email cyberinsights@mail.cisa.dhs.gov

To learn more or register visit: IR Training | CISA

Eligible Audience: Open to federal and supporting contractors, state, local, tribal, and territorial, and critical infrastructure partners.

Securing Systems

This training series provides training assistance to cyber practitioners so they can enable secure systems by strengthening their cyber defenses against vulnerabilities, weaknesses, and threats. This series includes 100-level one-hour webinars for a general audience and 200-level virtual training courses with cyber range lab activities. The course audience are government employees and contractors at all levels - federal, state, local, tribal, and territorial - as well as educational and critical infrastructure partners. For more information, email cyberinsights@mail.cisa.dhs.gov

To learn more or register visit: IR Training | CISA

Eligible Audience: Open to federal and supporting contractors, state, local, tribal, and territorial, and critical infrastructure partners.

Continuous Diagnostics and Mitigation (CDM) training

We provide instructor led, hands-on CDM Dashboard training for Federal Civilian Executive Branch (FCEB) employees and contractors in a virtual cyber range training environment. The virtual and in-person training events enhance the dynamic CDM approach to fortifying the cybersecurity of government networks and systems. These courses are designed for personnel at agencies participating in the CDM program who monitor, manage, or oversee controls on their information systems such as ISSOs, CDM POCs, ISSMs and those reporting metrics.

These CDM trainings enable participating FCEB agencies to improve their networks and defend against cyber adversaries. The CDM training provides detailed class discussion with real world simulated computer labs using a cyber virtual learning environment. The training will teach participants the basics of CDM and how to use the CDM Dashboard capabilities to help mitigate agency threats. We will also offer various CDM resources and external references.

Currently, the courses use version ES 6.4 of the CDM Dashboard within the cyber virtual training range (CVLE). The current content focuses on the most recent version of the dashboard, including FISMA Automation, HVA reporting, CyHy (Cyber Hygiene) and SCuBA (Secure Cloud Business Applications), and other dashboard capabilities. Current CDM courses are offered at the 100-level (Introductory) and 200-level (Intermediate).

To learn more or register visit: CDM Training | CISA

Eligible Audience: Open to federal employees and supporting contractors

Industrial Control Systems (ICS) training 

We offer free, virtual ICS trainings geared toward Critical Infrastructure owners and operators. The trainings are designed to reduce cybersecurity risks to critical infrastructure and encourage cooperation between CISA and the private sector. Trainings vary in length and run from 8:00 am-5:00 pm MT (10:00 am–7:00 pm ET). All trainings are conducted through Online Training or CISA Virtual Learning Portal (VLP), with the exception of the three- or four-day, in-person courses at Idaho National Labs (INL) in Idaho Falls, ID.

*The ICS300 online course is a prerequisite for attending the in-person ICS301 training hosted by CISA at the Idaho National Laboratory. This ICS300 course focuses on many of the hands-on skills needed to protect and secure Industrial Control Systems and Operational Technology networks. The ICS401 course is available either online (ICS401V) or in-person (ICS401L). 

 To learn more or sign up, visit: ICS Training Calendar

Eligible Audience: Primary audience is critical infrastructure partners, however, federal, state, local, tribal, and territorial employees with critical infrastructure responsibilities are also eligible

Skilling Continuation Labs (SCLs)

CISA is now offering Skilling Continuation Labs (SCLs), which are part of CISA’s ongoing goal to better equip the cyber workforce with the skills needed to defend our country against cyber threats. This new series of hands-on training opportunities cover specific cyber topics and use cases that are tied to CISA guidance and publications. (All Resources & Tools | CISA). These labs are standalone training sessions and are not part of a curriculum, allowing the learner to focus solely on the topic of interest, minimizing training time as the labs strengthen the role of the cyber workforce!  

The SCLs cover:

• Network Segmentation – associated with CISA’s Securing Network Infrastructure Devices guidance, this topic is crucial to defending cyber threats as these devices are ideal targets for malicious cyber actors
• Enhanced Security with DNS – leveraging CISA’s Encrypted Domain Name System (DNS) Implementation Guidance and the Protective Domain Name System Resolver, this topic is part of the vital effort to advance and strengthen zero trust cybersecurity across agencies
• Living Off the Land Attacks – using CISA’s techniques, in cooperation with the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI), this lab provides threat detection information and mitigations applicable to LOTL activities, regardless of threat actor covering malware attacks and how effective logging can detect them. 
• Automated Defenses – using CISA’s best practices for denial-of-service attacks, this lab covers the concept of automated defenses, demonstrating endpoint detection and response (EDR). It shows how to mitigate denial of service attacks using firewall throttling techniques and the use of honeypots. 
• XZ Utils – A Case Study on Supply Chain Trust – applying CISA’s XZ Utils Vulnerability prevention method, this lab applies supply chain trust, using SBOMs to manage vulnerabilities in open source software. A “software bill of materials” (SBOM) has emerged as a key building block in software security and software supply chain risk management. This lab guides the learner through an XZ Utils supply chain trust scenario.
• Secure Programming – using the CISA Secure by Design approach, this lab examines any flaws in code that could lead to overflow attacks and details how to prevent them from occurring. The lab focuses on SQL and OS command injection vulnerable and exploitable code.

These Skilling Continuation Labs were created for cyber professionals with some IT/cyber experience who fall into the upper beginner to lower intermediate cyber skill range. These labs are available to play in the President’s Cup Practice Area. We are confident these labs will provide a continuation of skills for the cyber professional.

The National Initiative for Cybersecurity Careers and Studies (NICCS)

Looking for additional cybersecurity training, education, and career resources this summer? Be sure to visit the newly redesigned NICCS website, which has the same great content with even more information to share! NICCS now features updated navigation, new content and pages, updated features on interactive tools, and more. Here are a few highlights to check out:

• Redesigned NICE Workforce Framework for Cybersecurity (NICE Framework) and Cyber Career Pathways Tool that incorporate NICE Framework Components v2.0.0 updates
• Updated look and feel for the Education & Training Catalog, which includes thousands of in-person and online cybersecurity courses across the nation
• Refreshed PDF guides and new downloadable NICCS information materials · New Cybersecurity for Beginners page with guidance for individuals who are just getting started in cybersecurity

Visit NICCS today to explore these updates and more. Also, be sure to share this information with your colleagues and stakeholders. Can’t find what you’re looking for or have feedback on the refreshed website? Reach out to NICCS@mail.cisa.dhs.gov

Want to subscribe to the newsletter? Sign up a co-worker or friend? Enter your email here Cybersecurity and Infrastructure Security Agency to receive this Cyber Training Bulletin every month!

For additional information about ongoing cyber training, contact us at cybertraining@mail.cisa.dhs.gov