Kurssi koostuu neljästä eri modulista, joissa harjoitellaan tietoturvapoikkeamien käsittelyyn vaadittavia perustaitoja. Kaikki kouluttajat ovat Funet CERTin jäseniä. Kurssin materiaali on englanniksi, koulutuskielenä Suomi.

Tarkempi kuvaus moduleista (teksti TRANSITSin alkuperäisestä materiaalista):

• Organisation - Covers how CSIRTs fit within their organisations and includes planning the team, defining its constituency, determining which services to offer, staffing, communicating with external parties, funding, and obtaining management authority.
• Technical - Covers how intruders attack systems and their motivations, how network protocols can be abused, vulnerabilities of operating systems and services, denial-of-service attacks, hiding traces, and information gathering techniques. Includes several practical exercises.
• Operational - Covers the incident handling process from initial reports, through triage, investigation, resolution, closure, to post-analysis. Includes practical exercises and a survey of useful tools.
• Legal - Covers areas of European legislation likely to affect CSIRTs in their work, and that operatives should be familiar with. This includes data protection, computer misuse, network monitoring, collection of evidence, and working with law enforcement agencies.

Other topics such as PGP keys and relevant RFCs are also covered during the course.