The path teaches the craft of those who must turn data into usable evidence: what to look at first, what to acquire and in what order, how to preserve it, how to analyse it without being misled and how to write the document that closes the work. The method is that of the international standards of the ISO/IEC 27037, 27041, 27042 and 27043 family.
The common thread is that evidence is worth as much as the process that accompanies it: it is not the tool that makes it valid, but the chain of documented decisions that runs from the first moment that data was seen until someone reads it in a courtroom, in a disciplinary proceeding or in a notification to the authority.
Who it is for: information security managers and specialists, members of incident response teams, system and network administrators, IT managers, DPOs and privacy contacts, compliance managers and NIS contacts, internal audit staff, technical consultants and anyone who may have to explain, with evidence, what happened on a system.
Estimated duration: 26 hours. 6 modules, 103 test questions, 6 exercises, final test and named certificate.
Content updated to October 2026 on the ISO/IEC 27037, 27041, 27042 and 27043 family and on ISO 21043:2025, with links to the Budapest Convention, Law 48/2008 and the Code of Criminal Procedure, to the e-evidence package applicable from 18 August 2026, to Regulation (EU) 2016/679, to Directive (EU) 2022/2555 and to Legislative Decree 138/2024.
Unlocking progression: each module opens when you pass the test of the previous one (70% threshold, unlimited attempts). At the end, a final test of 30 questions on the whole path, with three attempts one week apart, and, on passing, the certificate in PDF with a verification code.