Advanced Evidence preservation Mastery: Field Guide
RCCE students will learn audit evidence collection, management, and presentation including evidence types, collection methodologies, evidence repositories, and evidence lifecycle management. RCCE students will learn to identify the types of evidence required for various compliance frameworks, develop evidence collection procedures that produce consistent and reliable results, configure automated evidence collection from security tools and systems, manage evidence repositories with proper access controls and versioning, validate evidence quality and completeness, present evidence packages to internal and external auditors, and maintain evidence retention schedules that meet regulatory requirements. This advanced mastery course challenges experienced practitioners with complex scenarios, expert-level techniques, and nuanced decision-making. At an expert level, RCCE students will learn to handle the most demanding situations in this domain, developing the expertise expected of senior security professionals. Students tackle multi-layered problems that require synthesizing knowledge across multiple disciplines.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Advanced Evidence preservation Mastery: Field Guide
- Execute hands-on tasks for advanced evidence preservation mastery
- Execute hands-on tasks for field guide
- Explain Course Overview: Evidence Preservation Mastery fundamentals
- Execute hands-on tasks for core competency — covering Systematic evidence collection.
- Execute hands-on tasks for advanced outcomes — covering Multi-framework evidence mapping.
- Execute hands-on tasks for learning objectives
- Execute hands-on tasks for identify & classify
- Execute hands-on tasks for collect & automate — covering evidence types to compliance frameworks, repeatable collection procedures.
- Execute hands-on tasks for present & defend — covering Build evidence repositories with ACLs.
- Execute hands-on tasks for evidence preservation landscape
- Execute hands-on tasks for retain/dispose
- Execute hands-on tasks for compliance driver — covering SOX, HIPAA, PCI DSS, GDPR mandate evidence, Chain of custody enables legal proceedings.
| Module 01 | Advanced Evidence Preservation Mastery |
| Module 02 | Field Guide |
| Module 03 | Course Overview: Evidence Preservation Mastery |
| Module 04 | Core Competency |
| Module 05 | Advanced Outcomes |
| Module 06 | Learning Objectives |
| Module 07 | Identify & Classify |
| Module 08 | Collect & Automate |
| Module 09 | Present & Defend |
| Module 10 | Evidence Preservation Landscape |
| Module 11 | Retain/Dispose |
| Module 12 | Compliance Driver |
| Module 13 | DFIR Driver |
| Module 14 | Evidence Types: Documentary Evidence |
All hands-on labs run on Rocheston Rose X OS. Students practice advanced evidence preservation mastery: field guide by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for advanced evidence preservation mastery
- Lab 2: Execute hands-on tasks for field guide
- Lab 3: Explain Course Overview: Evidence Preservation Mastery fundamentals
- Lab 4: Execute hands-on tasks for core competency
- Lab 5: Execute hands-on tasks for advanced outcomes
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Advanced Evidence preservation Mastery: Field Guide, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI