Carnegie Mellon University

Cyber Forensics and Incident Response (CyFIR) Track

Taught by instructors from Carnegie Mellon's CERT Division, the CyFIR track prepares students in information security and digital investigations through a skill-based curriculum using state-of-the-art software.

Who can complete the CyFIR track? The CyFIR track is available to all INI students.

How do I complete the track? Students pursuing the track devote a total of 48 units of their program curriculum to understanding and
 developing skills in host/network cyber forensics and digital investigations - see CyFIR courses and track completion details below.

What is the outcome of the track? Successful completion of the track results in a CyFIR certificate issued by the CERT Division.

Is the CyFIR track right for me?

Consider the CyFIR track if you want to: 

Decipher Puzzles

Through the track, you will develop the skills necessary to search for and analyze digital evidence on computer systems using professional methods. You will use these skills to investigate cybersecurity breaches to determine and implement effective solutions.

Solve Problems

As computer criminals evolve in their hacking abilities, specialists in information security must remain one step ahead. Students in the track will learn critical incident response skills from members of the CERT Division. Hands-on projects will provide experience managing and solving information security problems.

Pursue an Exciting Career

The demand for information technology professionals continues to grow steadily, and hiring managers are placing a priority on filling the information security positions within their organizations. Employers in a variety of sectors will be eager to hire graduates with the special skills acquired through the track.


The CyFIR Track consists of the following courses (48 units total):

14-761 Applied Information Assurance (co-requisite to 14-822 and 14-823)
14-822 Host-Based Forensics
14-823 Network Forensics
14-832 Cyber Forensics and Incident Response Capstone

CyFIR track courses can count as electives for all degree programs. In some cases, these courses can also be considered towards core requirements depending on the degree program. Students should refer to their program's curriculum page and degree-specific core lists. MSIS students can apply the courses towards certain security core requirements as well, if not already fulfilled by another course. 

Track Completion

Students must successfully pass all CyFIR track courses in order to receive the certificate. The courses can be used to fulfill electives, core requirements (depending on program), and Advanced Studies (if approved by the faculty advisor for bicoastal students in an Advanced study option).