ECIH — EC-Council Certified Incident Handler
EC-Council's incident handling certification and a DoD 8140 option for IR roles. Covers the incident response lifecycle with broad coverage across multiple incident types. DoD 8140 approved which is its main value in the market. Compared to GCIH, ECIH has lighter technical depth and is more process-oriented — which suits compliance-driven environments but less so hands-on IR teams. GCIH is the stronger technical credential but ECIH will satisfy the same DoD checklist requirements. If you're purely targeting government or contractor roles and need to check the IR certification box, ECIH is a cost-effective path.
| Issuer | EC-Council |
|---|
| Level | intermediate |
|---|
| Domains | Digital Forensics & Incident Response |
|---|
| Practical weight | 25% |
|---|
| Cost (USD) | 450 |
|---|
| Renewal | 3 years |
|---|
| DoD 8140 | Yes |
|---|
| Skills | incident_response_process, incident_handling_procedures, evidence_handling, containment_strategies, forensic_basics, ir_documentation |
|---|
Official certification page
Browse all 426 cybersecurity certifications on EBCertMap