EC-CouncilEC-Council Certified Incident Handler (ECIH)
EC-Council Certified Incident Handler (ECIH) proves that you can prepare for, detect, contain and recover from security incidents using a structured process. It is aimed at incident handlers, SOC analysts, security administrators and anyone on an organisation's response team.
The certification is earned through exam 212-89, covering incident handling and response for malware, email, network, web application, cloud and insider threats, along with forensic readiness. Candidates often have some security operations experience, and preparation uses realistic incident scenarios, guided labs and practice questions to build calm, methodical exam readiness.
Your path to certification
Prepare
Start from where you are; we help you assess your level.
Train
1 course with an instructor
Sit the exam
ECIH (212-89)
Stay current
Renew ECIH every three years by logging 120 EC-Council continuing education credits and keeping the annual fee up to date.
Where do you sit the exam? At our test centre
CEH, CND, CHFI, CCT and ECIH exams are delivered through Pearson VUE at our Authorised Test Centre in Mazzeh. EC-Council delivers its other exams through its own ECC Exam portal, and we help you register for those.
Preparation courses
Renewal and validity
Each certification in EC-Council's continuing professional education (CPE) scheme, previously known as ECE, needs its own 120 credits within its three-year window, earned through relevant activity such as events, courses, research or a newer exam version, while the annual fee keeps the certificate active year by year. EC-Council revises the scheme from time to time, so confirm the current CPE policy on its certification site.
Let's plan your next step together.
Tell us the course or certification you have in mind and we'll send the outline, upcoming dates, fees and private-team options.