Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A plain guide to CertNexus’s incident detection and response certification as of 2026, covering the five CFR-410 domains, the exam format and passing score, cost, eligibility, renewal, DoD 8140 status, career paths, and how CFR compares to ECIH, CompTIA CySA+ and Security+. Use it to decide whether CFR fits your job, or to see what the exam actually tests before you book it.
CyberSec First Responder (CFR) is CertNexus’s vendor-neutral certification for the people who defend information systems before, during, and after a cyber incident. The current exam is CFR-410.
Despite the name, the exam isn’t limited to the response. Its five domains follow the functions of the NIST Cybersecurity Framework, so you’re tested on knowing your assets and risks, hardening and auditing systems, spotting attacks in logs and alerts, running the response with the evidence intact, and then restoring systems and feeding what you learned back into recovery plans.
The credential is ANAB-accredited under ISO/IEC 17024, and CertNexus states that it is DoD 8140 approved. CFR is issued and maintained by CertNexus, which also publishes the CFR-410 exam blueprint (version 1.10, last modified February 22, 2022) that the current exam follows.
Assets, threats, vulnerabilities, and the rules that apply. 22% of the exam.
Hardening, audits, patching, and access control. The heaviest domain at 24%.
Read indicators, logs, and alerts, and tell attacks from benign activity. Weighted at 18%.
Contain the threat, collect evidence properly, and tell the right people. Worth 19%.
Restore systems, find the root cause, and update the recovery plans. The smallest domain at 17%.
Four things that set CFR apart from security certifications that treat incident response as one topic among many.
CertNexus builds CFR under the ISO/IEC 17024 standard. Subject matter experts take part in the job task analysis, the item writing, and the cut score, and practitioners in the field answer a job task survey and beta test the exam. The CFR-410 blueprint credits 17 contributors, including people from the U.S. Air Force AFCERT, Johns Hopkins Applied Physics Laboratory, KBR, and Fiserv.
The blueprint names Nmap, Nessus, FTK, EnCase, and Volatility alongside native Windows and Linux tools, and it expects you to know macOS, Windows, Linux, Android, and iOS. No single product line runs through the exam.
Many response credentials start when the alert fires. CFR puts 46% of its weight on Identify and Protect, so asset inventory, compliance, hardening, and audits count as part of the responder’s job.
CertNexus states that CFR is DoD 8140 approved. The CFR-410 blueprint also says the exam meets four legacy DoD 8570.01-M baselines: CSSP Analyst, CSSP Infrastructure Support, CSSP Incident Responder, and CSSP Auditor.
DoD 8140 replaced those categories with DCWF work roles and proficiency levels. Before you rely on CFR for a federal or contractor position, confirm it for your role on the current DoD 8140 qualification matrix at cyber.mil.
The certification, the CFR-410 exam, and what it takes to keep CFR current, as published by CertNexus and checked in October 2026.
CertNexus names one direct follow-on, CyberSec First Responder Advanced (CFR-A). Past that, most CFR holders either go deeper into digital forensics or start moving toward running a security program.
CertNexus’s hands-on follow-on, built around attacking, analyzing, and addressing threats. Exam CFA-110 launched in September 2024 as a 25-item online assessment with an 80% passing score, and CertNexus classes it as a credential rather than a certification.
EC-Council’s Computer Hacking Forensic Investigator, exam 312-49: 150 multiple-choice questions in 4 hours. The logical next step if the evidence handling and forensic image objectives in Respond and Recover were the part of CFR you liked most.
ISC2’s CISSP asks for five years of paid experience in two or more of its eight domains. It fits CFR holders who are moving from the response team toward security management or architecture, and it counts for the full 90 CECs toward CFR renewal.
CFR assumes you already know TCP/IP networking, common operating systems, and basic controls like firewalls and anti-malware. It usually follows a foundation credential and a couple of years of hands-on work, and it opens into forensics, advanced response, or leadership tracks.
Build the baseline
The analyst and responder seat
Two questions to answer before you commit: can you take the exam, and should you take CFR specifically. The first one is easy.
No application or approval step.
Buy a CFR-410 voucher from the CertNexus store ($367.50 as of October 2026) or directly through Pearson VUE, then schedule at a test center or on OnVUE. CertNexus doesn’t ask for an application, a fee, or proof of experience, and the voucher includes one free retake. Experience still matters, though. CertNexus writes the exam for people with about three to five years on a security team.
Optional, and the voucher can come with it.
CertNexus Authorized Training Partners run CFR-aligned courses, and the blueprint notes that an exam voucher can come with your training program. Training Camp’s four-day boot camp includes the voucher and a free retake, and you can take CFR-410 on-site after class instead of booking a separate appointment.
CFR is written for the people who protect systems before, during, and after an incident. Five of these roles come from CertNexus’s own list of roles aligned with the credential, and the sixth is the DoD position type its blueprint names:
Watches the SIEM and the alert queue, reads logs from network and host sources, and decides which alerts are real. Most of this job is described in the Detect domain.
Contains confirmed incidents, collects evidence without altering it, correlates the data, and writes the report that goes to management. The Respond domain is built around this seat.
Uses IDS/IPS, firewall and EDR data to defend the network and recommends countermeasures when activity looks wrong. CertNexus lists it among the roles aligned with CFR.
Images disks and memory, keeps chain of custody intact, and pulls what matters out of the evidence after an incident. CFR covers the fundamentals, and a dedicated forensics certification goes much further.
Scopes and runs vulnerability assessments, ranks findings with CVSS, and tracks plans of action until each fix is confirmed. Identify and Protect test this work directly.
One of four legacy DoD 8570.01-M baselines the CFR-410 blueprint says the exam meets. Under DoD 8140 these positions map to DCWF work roles, so confirm CFR on the current qualification matrix for the role and proficiency level you are hired into.
CFR is one of several credentials built around incident detection and response. Here’s how it lines up against EC-Council’s ECIH and CompTIA’s CySA+ and Security+, using each issuer’s published figures as of fall 2026.
| CFR | EC-Council ECIH | CompTIA CySA+ | CompTIA Security+ | |
|---|---|---|---|---|
| Issuer | CertNexus | EC-Council | CompTIA | CompTIA |
| Exam | CFR-410: 80 multiple-choice and multiple-response, 120 minutes | 212-89: 100 multiple-choice, 3 hours | CS0-004: max 85 multiple-choice and performance-based, 165 minutes | SY0-701: max 90 multiple-choice and performance-based, 90 minutes |
| Passing Score | 70% or 73%, varies by exam form | 60% to 85%, varies by exam form | 750 on a 100 to 900 scale | 750 on a 100 to 900 scale |
| Exam Cost | $367.50 voucher, one free retake included | $450 voucher without training, plus $100 application fee | $439 retail voucher | About $439 voucher |
| Experience | None required, 3 to 5 years targeted | 1 year infosec, or official training | About 4 years recommended, none enforced | None required, Network+ and 2 years IT recommended |
| Renewal | 90 CECs over 3 years + $150 per cycle, or retake | 120 credits over 3 years, $80 annual fee | 60 CEUs over 3 years, annual CE fee | 50 CEUs over 3 years |
| DoD 8140 | Approved per CertNexus, confirm your work role on the matrix | Mapped by EC-Council to DCWF 531, confirm on the current matrix | Approved (10 DCWF work roles) | Approved for multiple DCWF work roles |
| Focus | Identify, Protect, Detect, Respond, Recover (5 domains) | Incident handling and response, 9 domains | Security operations, vulnerability management, response, reporting | Security fundamentals, 5 domains |
| Best For | SOC, CSIRT, and DoD contractor defenders | Responders, CSIRT staff, Tier 2 analysts | Generalist SOC analysts | Breaking into cybersecurity |
Security+ is the foundation here. CFR, CySA+ and ECIH compete for the same analyst and responder seat, so let the job postings and the DoD 8140 matrix entries for your target role decide between them.
Certification Matchups puts the published facts, strengths and weak spots of two certifications side by side.
Our four-day CertNexus CyberSec First Responder boot camp teaches the CFR-410 material live, in person or online, with official CertNexus courseware, hands-on labs, your exam voucher, and a free exam retake included. We deliver CertNexus exams on-site, so you can sit CFR-410 on the last day of class, and you keep 180 days of one-on-one coaching afterward. See the rest of our CertNexus courses if you’re planning a longer path.
Reading an exam blueprint, DoD 8140 qualification rules, SOC work, and incident case studies that connect to the CFR-410 domains.
How certification bodies turn a job task analysis into the objectives document, why item writers can only test what it lists, and how to read its verbs for depth. Worth reading before you open the 30 objectives in the CFR-410 blueprint.
A work role by work role look at the DCWF, from Cyber Defense Analyst (511) to Incident Responder (531), and why the right certification depends on your role code and proficiency level.
The two tests a certification has to pass to reach the DoD 8140 qualification matrix: ANAB accreditation under ISO/IEC 17024 and at least 70% alignment with a DCWF work role.
What the analyst seat looks like shift to shift, from routine monitoring and alerts that turn out to be nothing to the occasional real intrusion. A reality check on the work the Detect domain describes.
Why responders who are strong on premises struggle with their first cloud incident, from where the evidence lives to who is responsible for what. CFR-410 lists cloud audit logs as a detection source.
When attackers destroy data instead of encrypting it, there is no key and nothing to negotiate. The Stryker wiper attack and what it means for the recovery planning tested in the Recover domain.
A former incident response manager and a former ransomware negotiator were sentenced to four years in federal prison in April 2026 for running BlackCat attacks. A hard case study in the trust placed in the people who handle incidents.
The CFR-410 exam follows blueprint version 1.10, with five domains weighted between 17 and 24 percent and 30 objectives in all. CertNexus’s official course teaches the material in 11 lessons. Click any domain for what it covers.
Seven objectives on knowing the environment before anything goes wrong: finding assets with active and passive tools such as Nmap and Nessus, tracking threats through CVE, CVSS, CWE and CAPEC, and running a vulnerability assessment from scoping through remediation. It also covers the privacy and security rules a responder has to know (GDPR, HIPAA, PCI DSS, the NIST SP 800 series and more) and the working relationships with law enforcement and vendors that need to exist before an incident.
The heaviest domain, with eight objectives. It runs from reporting security posture trends and applying policy against attack methods (footprinting, password attacks, social engineering, DoS) to defense in depth with IDS/IPS, firewalls, segmentation, EDR, least privilege and patch management. Independent audits, plans of action for audit findings, security updates, and identity and access control round it out.
Five objectives on spotting an attack and proving it is one. You read indicators of compromise such as unknown open ports, new administrator accounts and off-hours logins, and you work log files from network, host and cloud sources with SIEM tools, grep, Event Viewer and PowerShell. Then you separate incidents from benign activity, document and escalate them, and judge how far a threat has spread through command and control, lateral movement and exfiltration.
Six objectives on running the response itself. That means executing the incident response plan, containing the threat with allowlists, IDS/IPS rules, segmentation and port blocking, and analyzing what happened with Windows and Linux tools. Forensically sound evidence collection and chain of custody, incident reports, attacker TTPs, and accurate communication with internal teams, law enforcement, the media and other CSIRTs are all here.
Four objectives on getting back to normal and learning from the incident. Root cause analysis, after action reports and lessons learned come first, followed by countermeasures for the affected systems and a review of memory and disk images for anything still relevant. The domain closes with input into disaster recovery, contingency and continuity of operations plans.
The official CertNexus course outline follows this lesson order. The badge on each row shows how many topics the lesson covers.
Why risk management matters, how to assess and mitigate risk, and how to build documentation into the process.
Classifying threats and analyzing the trends that change an organization’s security posture.
Threat modeling, then the impact of reconnaissance and of social engineering.
System hacking, web-based attacks, malware, hijacking and impersonation, DoS incidents, and threats to mobile and cloud security.
Command and control, persistence, lateral movement and pivoting, data exfiltration, and anti-forensics.
Cybersecurity auditing, a vulnerability management plan, vulnerability assessment, and penetration testing.
Deploying a security intelligence collection and analysis platform, then collecting data from network-based and host-based sources.
Working logs with common tools first and then with SIEM tools.
Analyzing incidents with Windows-based and Linux-based tools and analyzing indicators of compromise.
Deploying an incident handling and response architecture, mitigating incidents, and handing incident information over to a forensic investigation.
Applying a forensic investigation plan, securely collecting and analyzing electronic evidence, and following up on the results.
Domains and weights reflect CertNexus’s CyberSec First Responder (CFR-410) Exam Blueprint version 1.10 (modified February 22, 2022). Lessons reflect the official CFR-410 course outline. Lesson colors show where each lesson sits in the before, during, and after cycle and are not an official CertNexus mapping. CertNexus publishes no per-domain question counts.
The questions candidates ask most often when researching the CertNexus CyberSec First Responder certification.
CyberSec First Responder (CFR) is CertNexus’s vendor-neutral certification for defenders who protect information systems before, during, and after a cyber incident. The current exam is CFR-410, and its five domains follow the functions of the NIST Cybersecurity Framework: Identify, Protect, Detect, Respond, and Recover. CertNexus states that CFR is ANAB-accredited under ISO/IEC 17024 and DoD 8140 approved.
There are no formal prerequisites. CertNexus asks for no application, fee, or supporting documentation to sit CFR-410, and it doesn’t require a training course first. It does describe the target candidate as someone with about three to five years of experience on a CERT, CSIRT, SOC, or cybersecurity team, and the blueprint recommends knowing the NIST Cybersecurity Framework, log analysis, vulnerability assessment, and incident response processes before you test.
CFR-410 has 80 items in multiple-choice and multiple-response formats, and you get 120 minutes. That time includes 5 minutes for the candidate agreement and 5 minutes for the Pearson VUE tutorial, so plan on about 110 minutes for the questions. The passing score is 70% or 73% depending on the exam form you draw, and CertNexus says the forms have been statistically equated.
CFR-410 is delivered through Pearson VUE. You can test in person at a Pearson VUE test center or online through Pearson OnVUE remote proctoring. Training Camp also delivers CertNexus exams on-site, so boot camp students can sit CFR-410 right after class.
The CFR-410 blueprint has five domains and 30 objectives: Identify (22%), Protect (24%), Detect (18%), Respond (19%), and Recover (17%). Protect is the largest, and it reaches well past firewalls into audits, plans of action, patching, and identity and access control. Detect and Respond together come to 37%, so the hands-on incident work is a little over a third of the exam and the rest is preparation and recovery.
The CertNexus store lists the CFR-410 exam voucher at $367.50 as of October 2026. Every CertNexus voucher includes one free retake of the same exam version, and vouchers expire 18 months after purchase. If you train first, the voucher can come with your training program instead, which is how Training Camp’s CFR boot camp works.
CFR is valid for three years from the date you earn it. You can renew by passing the current version of the exam again before it expires, or by joining the CertNexus Continuing Education Program, earning 90 continuing education credits (CECs) within the three-year cycle, and paying the $150 fee for that cycle. The CFR program document lists the qualifying activities, and a few related certifications, CISSP and CISM among them, are worth the full 90 CECs on their own.
CertNexus states that CFR is DoD 8140 approved. Its CFR-410 blueprint also says the exam meets the requirements of four legacy DoD 8570.01-M baselines: CSSP Analyst, CSSP Infrastructure Support, CSSP Incident Responder, and CSSP Auditor. DoD 8140 ties qualifications to DCWF work roles and proficiency levels instead, so confirm CFR for your specific role on the current DoD 8140 qualification matrix before you rely on it.
Both are ANAB-accredited incident response certifications, but they’re scoped differently. EC-Council’s ECIH (exam 212-89, 100 questions in 3 hours) works through incident handling by incident type, from malware and email to cloud, insider threats, and endpoints. CFR-410 (80 items in 120 minutes) puts more of its weight before the incident, with Identify and Protect at 46% of the exam, and it has no application step or fee. If your job is mostly running declared incidents, ECIH is the narrower fit. Analysts who also own asset inventory, hardening, and audits will find more of their day in CFR.
They overlap heavily on detection and response. CySA+ (exam CS0-004) has up to 85 questions in 165 minutes and includes performance-based questions, while CFR-410 is 80 multiple-choice and multiple-response items in 120 minutes. CySA+ gives vulnerability management and reporting their own domains, and CFR spends more time on compliance frameworks, audits, and recovery planning. CompTIA recommends about four years of experience for CySA+, and CertNexus targets three to five years for CFR, so the audience is close to the same.
CertNexus aligns CFR with security operations roles such as SOC analyst, cybersecurity analyst, and cyber defense analyst, with incident roles such as incident response analyst, cyber incident responder, threat analyst, and digital forensics analyst, and with infrastructure roles such as systems security administrator. The blueprint also points it at federal contractors and private firms that run Defensive Cyber Operations or DoD Information Network (DoDIN) operations and incident handling.
It depends on how much of the blueprint you already do at work. A SOC analyst who reads logs every day will move quickly through Detect but may need real study time on the compliance frameworks in Identify and on the audit and plan-of-action objectives in Protect, the heaviest domain at 24%. CertNexus’s own instructor-led course outline runs five days. Training Camp’s boot camp covers the material in four, which works best if you already have the two or more years of security experience the course outline recommends.
For defenders who want a vendor-neutral credential that covers the whole incident cycle, it’s a sensible pick. CFR is ANAB-accredited, CertNexus states it is DoD 8140 approved, the exam has no eligibility gate, and renewal through continuing education costs $150 per three-year cycle. It’s a weaker choice if you need a first security certification, where Security+ is the usual start, or if the job postings you’re targeting name CySA+ or ECIH specifically. Keep in mind that the CFR-410 blueprint was last modified in February 2022, before NIST released Cybersecurity Framework 2.0 with its new Govern function, so governance isn’t a separate CFR domain.
CFR-410 is the current exam. CertNexus launched it in March 2022 and lists its sunset date as TBD, so no replacement has been announced as of October 2026. This page follows version 1.10 of the CFR-410 exam blueprint, last modified February 22, 2022. CertNexus notes that its exam objectives can change without notice, so check the CFR page on certnexus.com before you schedule.
Tell us where you are, whether that’s weighing the certification, working out funding, or planning training for a SOC or response team, and we’ll help you map out the right path.