ECIH (EC-Council Certified Incident Handler)
ECIH is EC-Council's incident handling and response certification. It covers the incident response process from preparation, recording and triage through notification, containment, evidence gathering and forensic analysis, eradication, recovery and post-incident activities, along with first response and the handling of malware, email, network, web application, cloud, insider threat and endpoint incidents. EC-Council lists incident handlers, risk assessment administrators, penetration testers, cyber forensic investigators, system administrators and IT managers among its audience.
Updated
Exam Details
- Issuer
- EC-Council
- Level
- Intermediate
- Exam code
- 212-89
- Exam type
- Multiple choice
- Questions
- 100
- Duration
- 3 hours
- Passing score
- 60% to 85%, depending on the exam form
- Exam fee
- $450
- Validity
- 3 years
- Tracks
- Forensics and Incident Response, Security Operations
Proctored multiple-choice exam delivered at EC-Council test centers, with several exam forms drawn from different question banks.
EC-Council lists the ECIH exam voucher at $450. Candidates who qualify through experience instead of official training also pay a $100 non-refundable eligibility application fee.
Requirements and Renewal
Prerequisites
Official EC-Council training or at least one year of information security work experience with an approved eligibility application. EC-Council designs the course for mid-level to senior-level cybersecurity professionals.
Renewal
EC-Council Continuing Education (ECE): 120 credits per certification within each three-year cycle and an annual ECE fee of $80. Members who miss the requirements are suspended and have 12 months to comply before revocation.
Current Version
ECIH v3, exam blueprint v2.
Exam Domains
9 domains| Domain | Weight |
|---|---|
| Incident Response and Handling Process | 11% |
| First Response | 11% |
| Malware Incidents | 11% |
| Email Security Incidents | 12% |
| Network Level Incidents | 12% |
| Application Level Incidents | 11% |
| Cloud Security Incidents | 10% |
| Insider Threats | 11% |
| Endpoint Security Incidents | 11% |
DoD 8140 Work Roles
1 work rolesThe DoD 8140 Qualification Matrix V2.1 lists ECIH as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Frequently Asked Questions
What does ECIH stand for?→
ECIH stands for EC-Council Certified Incident Handler. The current training release is ECIH v3.
How much does the ECIH exam cost?→
EC-Council lists the ECIH exam voucher at $450. Candidates who qualify through experience instead of official training also pay a $100 eligibility application fee.
How many questions are on the ECIH exam?→
Exam 212-89 has 100 multiple-choice questions with a 3-hour limit. The cut score ranges from 60% to 85% depending on the exam form.
What happens if I fail the ECIH exam?→
A first retake needs no waiting period, and later retakes need a 14-day wait. Candidates may attempt the exam at most five times in 12 months.
Exam details are checked against official EC-Council pages. Fees, exam versions, and renewal rules change; confirm with EC-Council before registering. ECIH is a trademark of its owner. This site is not affiliated with or endorsed by EC-Council.