ECIH Certification
The ECIH Certification, formally known as the EC Council Certified Incident Handler (E|CIH), is a specialist credential for professionals who manage cyber incidents. The program teaches a structured approach to incident preparation, recording, triage, notification, containment, evidence gathering, eradication, recovery, and post-incident review.The program covers malware, email, network, web application, cloud, insider-threat, and endpoint incidents, plus first response and forensic analysis.
Why Choose ECIH Certification Training?
Security tools can generate alerts, but skilled professionals must still decide what happened, what to isolate, what evidence to preserve, and how to restore operations safely.
The ECIH Course closes this operational gap by connecting security knowledge with a repeatable response process. Rather than focusing only on threat theory, the training shows how an incident moves from initial detection through containment, recovery, and lessons learned.
This incident response certification helps you:
- Build a consistent incident handling and response workflow.
- Triage incidents and set response priorities based on risk and impact.
- Preserve, document, package, and transport digital evidence correctly.
- Respond to incidents across networks, endpoints, applications, and cloud platforms.
- Prepare for responsibilities in SOC, CSIRT, forensics, and cyber defense teams.
Course Structure
Everything you need to know about the curriculum and outcomes.
Why Choose Us?
NYTCC delivers ECIH Certification Online Training aligned with the course outline.
With NYTCC, you receive:
- Live online delivery: Learn from anywhere through scheduled virtual sessions.
- Experienced guidance: Understand difficult topics with instructor support.
- Flexible preparation: Select a schedule that fits work and personal commitments.
- Structured exam coverage: Follow a clear plan across the complete official curriculum.
- Focused revision: Reinforce important terms, workflows, and exam objectives before test day.
- Learner support: Resolve course-related questions throughout your preparation.
ECIH Certification Exam Format
The examination for the ec council ecih certification tests knowledge across the incident handling curriculum.
| Exam Detail | Information |
| Certification | EC-Council Certified Incident Handler (E|CIH) |
| Exam name/code | ECIH 212-89 |
| Number of questions | 100 |
| Duration | 3 hours |
| Question format | Multiple choice |
| Test delivery | EC-Council Exam Portal |
| Passing score | Varies by exam form; 70% |
ECIH Certification Examination Cost
The EC-Council store currently lists the ECIH remote-proctored exam voucher at US$450. It is non-transferable, valid for one year, and requires eligibility approval for self-study candidates.
Domains of ECIH Certification
Knowledge weightage as per official certification standards.
EC-Council publishes the following ten course modules. The current public course page does not provide percentage weights for these modules, so no unofficial weightings are added below.
| Module | Syllabus Area | Main Coverage |
|---|---|---|
| 1 | Introduction to Incident Handling and Response | Threats, frameworks, security concepts, incident management, automation, standards, laws, and compliance |
| 2 | Incident Handling and Response Process | Preparation, recording, assignment, triage, notification, containment, evidence, eradication, recovery, and information sharing |
| 3 | First Response | Scene security, documentation, evidence collection, preservation, packaging, and transportation |
| 4 | Handling and Responding to Malware Incidents | Preparation, detection, containment, malware analysis, eradication, recovery, and best practices |
| 5 | Handling and Responding to Email Security Incidents | Detection, containment, analysis, eradication, recovery, case studies, and preventive practices |
| 6 | Handling and Responding to Network Security Incidents | Unauthorized access, inappropriate use, denial of service, wireless incidents, validation, and response |
| 7 | Handling and Responding to Web Application Security Incidents | Preparation, detection, containment, analysis, eradication, recovery, and application-security practices |
| 8 | Handling and Responding to Cloud Security Incidents | Cloud response procedures and incidents involving Azure, AWS, and Google Cloud |
| 9 | Handling and Responding to Insider Threats | Preparation, detection, containment, analysis, eradication, recovery, and best practices |
| 10 | Handling and Responding to Endpoint Security Incidents | Mobile, IoT, OT, and other endpoint-related security incidents |
Career Post ECIH Certification
The certified incident handler certification supports career development across incident response, security operations, cyber defense, and digital forensics.
Relevant career paths include:
- Incident Handler, Incident Responder, or Incident Response Engineer
- Incident Response Analyst, Specialist, Consultant, or Manager
- CSIRT Analyst, Engineer, Manager, or Team Lead
- SOC Analyst or SOC Engineer
- Information Security or Cyber Defense Analyst
- Cyber Forensic Investigator or Digital Forensic Analyst
- Cyber Threat, Risk, or Vulnerability Analyst
Average Salary
EC-Council reoprts an average U.S. incident handler salary of US$110,774 per year, citing ERI SalaryExpert data current to June 1, 2026. This is an estimate, not a guarantee.
Actual compensation varies by location, experience, job title, industry, education, technical skills, and employer.
Frequently Asked Questions
What is ECIH?
ECIH stands for EC-Council Certified Incident Handler. It is a specialist program covering incident preparation, triage, containment, evidence gathering, eradication, recovery, and post-incident activities across multiple types of cybersecurity incidents.
Is ECIH suitable for beginners?
No. EC-Council positions ECIH for mid- to senior-level cybersecurity professionals and recommends at least one year of cybersecurity experience. Beginners should first develop core networking, operating-system, and security knowledge.
How long is the ECIH training and exam?
EC-Council describes ECIH as a three-day program with 24 hours of class time. The certification exam lasts three hours and contains 100 multiple-choice questions.
What score is required to pass ECIH 212-89?
There is no single fixed pass mark. EC-Council uses different exam forms, with cut scores ranging from 60% to 78% depending on the form assigned to the candidate.
How much does the ECIH exam cost?
The store currently lists the remote-proctored ECIH exam voucher at US$450. Training, learning materials, taxes, or other services may cost extra. Always verify the current price before purchasing.
What jobs can I pursue after earning ECIH?
Relevant roles include incident handler, incident responder, SOC analyst, CSIRT analyst, cyber defense analyst, digital forensics analyst, threat analyst, and incident response consultant or engineer.
Is ECIH an accredited certification?
Yes. EC-Council states that ECIH is ANAB-accredited. The program is also approved under U.S. DoD 8140 for the Cyber Defense Incident Responder work role.
Ready to ECIH Certification?
Fill out the form below and our team will get back to you shortly.