Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
Everything you need to know about EC-Council's incident handling and response certification as of 2026: the nine domains of exam blueprint v2.0, the 212-89 exam format, eligibility, cost, renewal, career paths, and how ECIH compares to CND, CompTIA CySA+ and other security credentials. A complete reference guide for anyone considering ECIH or trying to understand what it covers.
ECIH is EC-Council's specialist certification for incident handling and response, now in its third program version (ECIH v3) and tested by exam 212-89.
It covers the work that starts when an alert becomes an incident: recording and triage, notification, containment, evidence gathering, eradication, recovery, and the post-incident review. The blueprint applies that process to malware, email, network, web application, cloud, insider threat, and endpoint incidents.
The credential is ANAB-accredited under ISO/IEC 17024, mapped by EC-Council to the NICE 2.0 framework and to CREST CCIM, and built on an industry-wide job task analysis. ECIH is issued and maintained by EC-Council, which also publishes the exam blueprint (v2.0, effective January 10, 2024) that the current exam follows.
Policies, team, tooling, and training in place before anything happens.
Log the report and hand it to an owner.
Validate, categorize, and prioritize what you are dealing with.
Tell the people who need to know, inside and outside the organization.
Stop the spread without destroying evidence.
Collect and analyze evidence with chain of custody intact.
Remove the root cause and every foothold the attacker left behind.
Restore systems and confirm they are clean before going back to normal.
Document, report, and fix what the incident exposed.
Four things that set ECIH apart from the broader security certifications that only touch incident response in passing.
EC-Council built ECIH v3 on an industry-wide job task analysis and says the program is fully mapped to the NICE 2.0 framework and to CREST CCIM. In practice that means the nine domains follow the tasks an incident handler is measured on at work, not a vendor's product line.
The cloud domain covers incidents in Azure, AWS, and Google Cloud; the endpoint domain covers mobile, IoT, and OT. Nothing in the exam assumes you run one platform.
Most well-known security certifications test how attacks work. ECIH tests what you do at 2 a.m. after one has already succeeded, from first response through recovery.
EC-Council maps ECIH to DCWF work role 531, Cyber Defense Incident Responder, under DoD 8140. That mapping is EC-Council's own and is dated May 2024.
A vendor mapping is not the same as a listing, so before you rely on ECIH for a federal or contractor position, confirm it on the current DoD 8140 Approved Qualifications Matrix at the DoD Cyber Exchange.
The certification, the 212-89 exam, and what it takes to keep ECIH current, as published by EC-Council in September 2026.
EC-Council positions ECIH as a step toward three of its other credentials: CHFI for people heading into digital forensics and incident response, and CND or Certified SOC Analyst for people staying on the blue team.
EC-Council's Computer Hacking Forensic Investigator. The forensics counterpart to ECIH's live-response focus, and the credential EC-Council names for ECIH holders who want to become DFIR specialists.
Certified Network Defender, exam 312-38: 100 questions over 4 hours across 20 modules and eight blueprint domains. Covers protecting and monitoring the network before an incident is ever declared.
EC-Council's Certified SOC Analyst. The credential EC-Council names alongside CND for ECIH holders who want to build out the monitoring and detection side of blue-team work.
ECIH assumes you already know basic networking and security. It usually comes after a foundation credential and a year or two of hands-on work, and it opens into forensics, broader blue-team, or leadership tracks.
Build the baseline
The incident handler seat
Two questions to answer before you commit: can you take the exam, and should you take ECIH specifically. Here's a straight answer to both.
You can apply to sit the exam directly.
Submit an exam eligibility application to EC-Council with documentation of at least one year of information security work experience and pay the non-refundable $100 application fee. Once approved, you buy the $450 exam voucher and schedule 212-89 through the EC-Council exam portal.
Official training waives the requirement.
Complete an EC-Council Accredited Training Center (ATC) course (Training Camp's ECIH boot camp qualifies) and the experience requirement is automatically waived. Your exam voucher comes with the training, so you can sit for ECIH immediately after the course finishes.
ECIH is written for the people who get the call when something has gone wrong. These are the roles it is most often hired for, and the ones EC-Council itself names for the credential:
Works declared incidents end to end: triage, containment, eradication, recovery, and the report that follows. This is the role ECIH is written for.
Staffs a computer security incident response team, coordinates with the affected business units, and keeps evidence handling and notifications inside policy.
The escalation point for alerts a Tier 1 analyst can't close. Validates incidents and runs the first stages of response before handing off or taking the case.
Combines forensic evidence collection with live response, keeping chain of custody intact while the incident is still moving. A common step toward CHFI.
The DoD Cyber Workforce Framework role EC-Council maps ECIH to in its May 2024 mapping. Investigates, analyzes, and responds to cyber incidents inside a DoD or contractor network environment. Confirm the listing on the current DoD 8140 Approved Qualifications Matrix before relying on it.
Owns the response plan, playbooks, and tabletop exercises, and directs the team during a live incident, including communication with executives and regulators.
ECIH is one of several credentials that touch incident response. Here's how it lines up against EC-Council's own CND and CEH and against CompTIA CySA+, using each issuer's published figures as of September 2026.
| ECIH | EC-Council CND | CompTIA CySA+ | EC-Council CEH | |
|---|---|---|---|---|
| Issuer | EC-Council | EC-Council | CompTIA | EC-Council |
| Exam | 212-89: 100 multiple-choice, 3 hours | 312-38: 100 multiple-choice, 4 hours | CS0-004: max 85 multiple-choice and performance-based, 165 minutes | 125 multiple-choice, 4 hours |
| Passing Score | 60% to 85%, varies by exam form | 60% to 85%, varies by exam form | 750 on a 100 to 900 scale | 60% to 85%, varies by exam form |
| Exam Cost | $450 voucher without training, plus $100 application fee | $550 remotely proctored voucher | $439 retail voucher | About $1,199 voucher |
| Experience | 1 year infosec, or official training | 2 years, or official training | About 4 years recommended, none enforced | 2 years infosec, or official training |
| Renewal | 120 credits over 3 years, $80 annual fee | 120 credits over 3 years | 60 CEUs over 3 years, annual CE fee | 120 ECE credits over 3 years |
| DoD 8140 | Listed by EC-Council for DCWF 531; confirm on the current matrix | Check the current DoD 8140 Approved Qualifications Matrix | Approved (10 DCWF work roles) | Approved for multiple DCWF work roles |
| Focus | Incident handling and response, 9 domains | Network defense, 20 modules, 8 domains (CND v3) | Security operations, vulnerability management, response, reporting | Offensive methodology, 20 modules |
| Best For | Responders, CSIRT staff, Tier 2 analysts | Network and infrastructure defenders | Generalist SOC analysts | Offensive and hybrid roles |
These certifications cover overlapping but distinct ground. Many blue-team professionals hold ECIH alongside one of the others.
Our official EC-Council ECIH boot camp covers the full incident handling and response curriculum over three days, with hands-on labs, official EC-Council courseware, your 212-89 exam voucher, and a free retake included, so you leave exam-ready. See the rest of our official EC-Council courses if you are planning a longer path.
Exam prep, incident response case studies, reporting rules, and how DoD 8140 approval actually works.
A working guide to the 212-89 exam: what each of the nine blueprint domains asks of you, how the weights break down, where candidates tend to underprepare, and a study order that follows the response lifecycle instead of the table of contents.
Cloud incidents break the habits responders built on-premises: no box to pull, logs that live with the provider, and identities doing the damage. Why this is now its own exam domain and what to practice.
When the goal is destruction rather than payment, the containment and recovery steps you rehearsed for ransomware stop applying. What changes in triage, backups, and communication when there is nothing to negotiate.
Federal incident reporting deadlines turn the notification step of the response process into a compliance clock. What covered entities have to report, how fast, and what that means for the people running the incident.
An hour-by-hour look at the analyst seat, from queue triage to escalations to the handoff into formal incident response. Useful for anyone deciding whether ECIH or a broader analyst credential fits the job they want.
A live case of attackers turning a legitimate DFIR tool against its owners. What the intrusion looked like, why a responder's own tooling can become an indicator, and how the application-level domain applies in practice.
How a certification gets onto the DoD 8140 Approved Qualifications Matrix, what accreditation has to do with it, and why a vendor's own work role mapping is not the same thing as a listing. Read this before you rely on any credential for a federal role.
The 212-89 exam follows blueprint v2.0, in effect since January 10, 2024, with nine domains weighted between 10 and 12 percent each. The ECIH v3 course teaches the same material across 10 modules. Click any domain for what it covers.
What counts as a security incident, how incident management is organized, and the standards, frameworks, laws, and acts that shape a response program. Also covers response automation and orchestration and the nine-step process that runs from preparation through post-incident activities.
The first responder's job once an incident is confirmed: securing and documenting the scene and deciding what can be touched. Collecting, preserving, packaging, and transporting evidence so it holds up later.
Preparing for malware incidents, detecting them, and then containing and eradicating the infection. Recovery after the incident and guidelines for keeping malware out in the first place.
Types of email security incidents and the preparation that makes them easier to handle. Detection, containment, eradication, recovery, and the practices that cut down on repeat incidents.
Preparing for network incidents and telling a real event from background noise. Handling unauthorized access, inappropriate usage, denial-of-service, and wireless network incidents.
Preparing for web application incidents and analyzing them once they are detected. Containment and eradication, recovery of the affected application, and the practices that harden web applications afterward.
Why cloud incidents are harder to handle than on-premises ones, from shared responsibility to limited visibility. Handling incidents in Azure, AWS, and Google Cloud, plus the practices that reduce them.
Types of insider threats and the preparation steps that make them easier to spot. Detecting, containing, and eradicating insider activity, then recovering and putting controls in place to prevent a repeat.
Why endpoints need their own incident handling process, and how to prepare for and detect endpoint incidents. Handling mobile, IoT, and OT-based incidents, each with its own constraints.
Official EC-Council training follows this module order. The badge on each row shows which blueprint domain the module feeds.
Information security threats and attack vectors, attack and defense frameworks, and what separates an event from an incident.
The nine-step process from preparation to post-incident activities, plus incident management, automation and orchestration, and the standards and laws that apply.
Securing and documenting the scene, collecting evidence, and preserving, packaging, and transporting it.
Preparation, detection, containment, eradication, and recovery for malware incidents, with prevention guidelines.
Types of email security incidents and the full handling cycle from preparation to recovery.
Detecting and validating network incidents and handling unauthorized access, inappropriate usage, denial-of-service, and wireless incidents.
Detection and analysis of web application incidents, containment and eradication, recovery, and hardening practices.
The challenges of cloud response and how to handle incidents in Azure, AWS, and Google Cloud.
Types of insider threats, preparation, detection, containment, eradication, and recovery after an insider attack.
Preparing for and detecting endpoint incidents, and handling mobile, IoT, and OT-based incidents.
Domains and weights reflect EC-Council's ECIH Exam Blueprint v2.0 (effective January 10, 2024). Modules reflect the ECIH v3 course. EC-Council publishes no per-domain question counts.
The questions candidates ask most often when researching the EC-Council Certified Incident Handler certification.
ECIH is EC-Council's specialist credential for incident handling and response. The current program is ECIH v3, tested by exam 212-89, and it covers the full incident handling and response process along with how to handle malware, email, network, web application, cloud, insider threat, and endpoint incidents. It's built for people who work the response side of security rather than the offensive side.
There are two routes. You can complete official EC-Council training, which qualifies you to sit the exam without an experience review, or you can apply directly with at least one year of information security work experience and pay a non-refundable $100 application fee. Training Camp's ECIH boot camp is official EC-Council training, so the exam voucher comes with the course.
Exam 212-89 is 100 multiple-choice questions in 3 hours. It's delivered through the EC-Council exam portal (ECC Exam Center). EC-Council uses several exam forms, and the cut score depends on the form you draw: in EC-Council's words, cut scores can range from 60% to 85%.
The exam follows blueprint v2.0, effective January 10, 2024, which has nine domains: Incident Response and Handling Process (11%), First Response (11%), Malware Incidents (11%), Email Security Incidents (12%), Network Level Incidents (12%), Application Level Incidents (11%), Cloud Security Incidents (10%), Insider Threats (11%), and Endpoint Security Incidents (11%). The weights are close to even, so no single domain carries the exam.
EC-Council lists the ECIH exam voucher at $450 for candidates applying without training. Candidates who skip official training also pay a non-refundable $100 application fee. If you train through an official course, the voucher is normally bundled into the course fee, which is how Training Camp's boot camp works.
ECIH is valid for three years. To renew it you earn 120 continuing education credits over the three-year cycle and pay EC-Council's annual $80 continuing education fee under the ECE/CPE policy. Credits come from training, conferences, teaching, writing, and the other activities the policy lists.
EC-Council maps ECIH to DCWF work role 531, Cyber Defense Incident Responder, under DoD 8140. That is EC-Council's own mapping, dated May 2024. Before you rely on it for a federal or contractor position, confirm the current listing on the DoD 8140 Approved Qualifications Matrix at public.cyber.mil, because the matrix is what your component will check.
Both come from EC-Council, but they cover different jobs. CND (Certified Network Defender) is about protecting and monitoring the network before and during an attack: 20 modules across eight blueprint domains, tested by a 100-question, 4-hour exam. ECIH picks up once an incident is declared and walks through triage, containment, eradication, recovery, and lessons learned. Many blue-team professionals hold both.
CySA+ is CompTIA's broader security analyst credential. Its CS0-004 exam mixes multiple-choice and performance-based questions across security operations, vulnerability management, incident response, and reporting. ECIH goes deeper on one of those four areas, incident handling, and tests it with 100 multiple-choice questions. If your job is the SOC in general, CySA+ covers more ground; if your job is running incidents, ECIH is the more specific match.
The credential is aimed at incident responders, incident handlers, CSIRT and CERT analysts, SOC analysts moving into response work, digital forensics and incident response (DFIR) analysts, and the team leads who coordinate them. EC-Council also positions it as a step toward CHFI for forensics and toward CND and Certified SOC Analyst for other blue-team roles.
It depends on how much response work you've already done. People who already sit in a SOC or on a CSIRT mostly need to learn EC-Council's process vocabulary and the cloud, insider threat, and endpoint material. Newer candidates should plan for longer and put extra time into the email and network domains, which carry the highest weights at 12% each. Training Camp's boot camp compresses the instruction into three days, which works when you already have basic security experience.
If you want a credential that matches an incident response job description, yes. ECIH is ANAB accredited under ISO/IEC 17024, mapped by EC-Council to the NICE 2.0 framework and to CREST CCIM, and its current blueprint includes cloud, insider threat, and endpoint domains that older response training skipped. It's less useful if you're looking for a broad first security certification, where Security+ or CySA+ fits better, or if you want offensive skills.
Exam blueprint v2.0 took effect on January 10, 2024 and is the version the 212-89 exam follows in 2026. It organizes the exam into nine domains, including dedicated domains for cloud security incidents across Azure, AWS, and Google Cloud and for endpoint incidents involving mobile, IoT, and OT systems. The candidate handbook was reissued as v3.2 on September 7, 2026, so check it for the current exam policies before you register.
Tell us where you are, whether that's weighing the certification, working out funding, or planning training for a response team, and we'll help you map out the right path.