10 courses · 1,800 clock hours · 9–12 mo full-time. Grading is competency-based: each course requires the written exam, a competent skills demonstration with zero safety faults, a signed log, and a passed safety audit; percentage weights only rank performance above the competency floor.
Shared first block for every VoTechWorks program. OSHA 10 (30 for construction management), first aid/CPR/AED, applied trade math and measurement, technical reading and writing, digital literacy, and career readiness. Completed before students enter the lab and live systems unsupervised.
OutcomesShared first block for every VoTechWorks program. OSHA 10 (30 for construction management), first aid/CPR/AED, applied trade math and measurement, technical reading and writing, digital literacy, and career readiness. Completed before students enter the lab and live systems unsupervised.
How the course runs. 7 blocks: OSHA 10: introduction, rights, hazard recognition; First aid, CPR and AED; Applied trade math I: units, fractions, conversion; Applied trade math II: geometry, ratio and estimating; Technical reading and writing; Digital literacy for the trade; Career readiness: resume, portfolio, interview.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | OSHA 10: introduction, rights, hazard recognition | 10 | theory | Complete the OSHA 10-hour outreach course. |
| OSHA outreach materials | OSHA card issued |
| 2 | First aid, CPR and AED | 8 | practice | Respond to a collapse, bleed, burn or choke until help arrives. |
| Manikins, AED trainer, first-aid kit | AHA/Red Cross card issued |
| 3 | Applied trade math I: units, fractions, conversion | 20 | theory | Convert, add and scale measurements used in the trade. |
| Trade math workbook, tape measures, calculators | Quiz ≥ 70% |
| 4 | Applied trade math II: geometry, ratio and estimating | 20 | theory | Lay out from a drawing and estimate quantity, time and cost. |
| Drawings, estimating sheets | Estimate within 10% of the key |
| 5 | Technical reading and writing | 30 | theory | Read a specification or manual and write a clear technical report. |
| Spec excerpts, report template | Report rubric ≥ 3/4 |
| 6 | Digital literacy for the trade | 30 | lab | Use email, spreadsheets, and the trade's job-management tools. |
| Lab computers/tablets, the job app | IC3/MOS-style practical passed |
| 7 | Career readiness: resume, portfolio, interview | 30 | practice | Present yourself to an employer panel. |
| Portfolio templates, employer volunteers | Panel pass |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| OSHA 10 and first-aid written exams | Written exam | 25% | OSHA card issued; CPR/AED card issued | Authorized outreach trainer exam plus AHA/Red Cross skills check. Accuracy · Safety · Communication · Professionalism |
| Applied math & measurement exam | Written exam | 25% | 70% | Timed exam: conversions, layout math, estimating from a drawing or recipe/order. Accuracy · Safety · Communication · Professionalism |
| Technical report | Project | 25% | Rubric ≥ 3 of 4 on every criterion | A written report on a real task from the trade: problem, standard, method, result. Accuracy · Safety · Communication · Professionalism |
| Employer panel interview | Oral / panel | 25% | Panel pass | Resume, 3-minute portfolio walk-through, and interview with two employer advisors. Accuracy · Safety · Communication · Professionalism |
Competency course in Threats for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in Threats and keep a lab notebook signed off by the instructor.
OutcomesCompetency course in Threats for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in Threats and keep a lab notebook signed off by the instructor.
Why it matters. In Cybersecurity, threats is not a chapter to pass through but a skill an employer will pay for on day one; every credential exam in this program tests it directly or assumes it. The course runs in lab, against vendor documentation and the standard, with the lead engineer as the standard of judgment.
How the course runs. 12 blocks of about 14.3 hours: orientation and safety first, then the tools and the vocabulary, then the standard that governs the work. Guided practice becomes independent practice; measurement and inspection teach the student to judge their own work; the fault lab teaches what failure looks like before it happens on a job. A timed production run and the documentation block close the loop, and the course ends with the written exam and the observed skills demonstration.
What competent looks like. The student can explain threats, set up for it safely, perform it to the standard within time, spot and correct what is wrong, and write it up so that a stranger could verify the work.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | Orientation and safety for threats | 14.3 | theory | State the hazards of threats work and the controls for each; pass the safety brief. |
| PPE set, hazard cards, the program safety manual | Safety quiz 100% (retake until perfect); PPE donned correctly on demand |
| 2 | Tools, materials and terminology of threats | 14.3 | demo | Name, select and care for the tools and materials of threats; use the trade vocabulary correctly. |
| Full tool kit for threats, material samples, tool cards | Oral check: 20 tools/terms named and their use stated |
| 3 | Reading the standard: what governs threats | 14.3 | theory | Locate and apply the parts of vendor documentation and the standard that govern threats. |
| The code/standard excerpt, spec sheets, case file | Written check: 10 look-ups from the standard, 8 correct |
| 4 | Fundamentals I: guided practice in threats | 14.3 | practice | Perform the core tasks of threats step by step under direct supervision. |
| Practice stock/consumables, step checklists, the log | Checklist completed with instructor initials on every step |
| 5 | Fundamentals II: independent practice in threats | 14.3 | practice | Perform the core tasks of threats to the standard with the instructor observing, not assisting. |
| Task tickets, rubric, timer, practice stock | Rubric ≥ 3/4 on every line; time within 150% of the standard |
| 6 | Measurement, layout and quality checks in threats | 14.3 | lab | Measure, lay out and inspect threats work; decide accept/reject against tolerance. |
| Measuring instruments, drawings/orders, sample set | Inspection lab 9/10 correct with correct reasons |
| 7 | Faults, hazards and rework in threats | 14.3 | lab | Identify defective or unsafe threats work, explain the cause, and correct it. |
| Fault samples, diagnosis sheets, rework stock | Rework accepted by the lead engineer on inspection |
| 8 | Production run: threats to standard, timed | 14.3 | practice | Complete a realistic threats job to standard within the allotted time and materials. |
| Job packet, materials at estimated quantity, timer | Job accepted; time and material within estimate |
| 9 | Documentation: the log and the report in threats | 14.3 | theory | Record threats work in the industry format so a stranger could verify it. |
| Report template, the certifying body's hours form | Report accepted by instructor; hours form correctly completed |
| 10 | Skills-check rehearsal for threats | 14.3 | assessment | Rehearse the skills demonstration under exam conditions. |
| Skills checklist, timer, rehearsal stock | Rehearsal pass with zero critical misses, or a remediation plan on file |
| 11 | Advanced application and special cases in threats | 14.3 | practice | Apply threats to the non-standard situations met on real jobs. |
| Special-case packets, materials | Plan approved; special-case job accepted |
| 12 | Written exam and skills demonstration: threats | 14.3 | assessment | Pass the course's written exam and the observed skills demonstration. |
| Exam, checklist, all tools and stock for the demonstration | Written ≥ 75%; demonstration competent on every critical step with zero safety faults |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| Threats: written exam | Written exam | 25% | 75% | Theory, terminology, standards and safety for Threats. Multiple choice plus short calculation/interpretation items drawn from the certification body's task list. Standard met · Safety · Time · Quality/finish · Documentation |
| Threats: skills demonstration | Skills demonstration | 45% | Competent on every critical step; zero safety faults | Observed, timed performance of the core tasks of Threats against a checklist. A critical-step miss or a safety fault stops the assessment; re-attempt after remediation. Standard met · Safety · Time · Quality/finish · Documentation |
| Threats: lab notebook | Log | 15% | Complete, signed, ≥ 90% attendance of lab hours | Daily entries: task, standard, method, result, time; instructor sign-off. Serves as hours evidence for the licensing/certifying body. Standard met · Safety · Time · Quality/finish · Documentation |
| Threats: safety audit | Safety audit | 15% | Pass/fail — must pass | Unannounced audit of PPE, housekeeping, lockout/guarding, and hazard communication while performing Threats work. Standard met · Safety · Time · Quality/finish · Documentation |
Competency course in security ops for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in security ops and keep a lab notebook signed off by the instructor.
OutcomesCompetency course in security ops for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in security ops and keep a lab notebook signed off by the instructor.
Why it matters. In Cybersecurity, security ops is not a chapter to pass through but a skill an employer will pay for on day one; every credential exam in this program tests it directly or assumes it. The course runs in lab, against vendor documentation and the standard, with the lead engineer as the standard of judgment.
How the course runs. 12 blocks of about 14.3 hours: orientation and safety first, then the tools and the vocabulary, then the standard that governs the work. Guided practice becomes independent practice; measurement and inspection teach the student to judge their own work; the fault lab teaches what failure looks like before it happens on a job. A timed production run and the documentation block close the loop, and the course ends with the written exam and the observed skills demonstration.
What competent looks like. The student can explain security ops, set up for it safely, perform it to the standard within time, spot and correct what is wrong, and write it up so that a stranger could verify the work.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | Orientation and safety for security ops | 14.3 | theory | State the hazards of security ops work and the controls for each; pass the safety brief. |
| PPE set, hazard cards, the program safety manual | Safety quiz 100% (retake until perfect); PPE donned correctly on demand |
| 2 | Tools, materials and terminology of security ops | 14.3 | demo | Name, select and care for the tools and materials of security ops; use the trade vocabulary correctly. |
| Full tool kit for security ops, material samples, tool cards | Oral check: 20 tools/terms named and their use stated |
| 3 | Reading the standard: what governs security ops | 14.3 | theory | Locate and apply the parts of vendor documentation and the standard that govern security ops. |
| The code/standard excerpt, spec sheets, case file | Written check: 10 look-ups from the standard, 8 correct |
| 4 | Fundamentals I: guided practice in security ops | 14.3 | practice | Perform the core tasks of security ops step by step under direct supervision. |
| Practice stock/consumables, step checklists, the log | Checklist completed with instructor initials on every step |
| 5 | Fundamentals II: independent practice in security ops | 14.3 | practice | Perform the core tasks of security ops to the standard with the instructor observing, not assisting. |
| Task tickets, rubric, timer, practice stock | Rubric ≥ 3/4 on every line; time within 150% of the standard |
| 6 | Measurement, layout and quality checks in security ops | 14.3 | lab | Measure, lay out and inspect security ops work; decide accept/reject against tolerance. |
| Measuring instruments, drawings/orders, sample set | Inspection lab 9/10 correct with correct reasons |
| 7 | Faults, hazards and rework in security ops | 14.3 | lab | Identify defective or unsafe security ops work, explain the cause, and correct it. |
| Fault samples, diagnosis sheets, rework stock | Rework accepted by the lead engineer on inspection |
| 8 | Production run: security ops to standard, timed | 14.3 | practice | Complete a realistic security ops job to standard within the allotted time and materials. |
| Job packet, materials at estimated quantity, timer | Job accepted; time and material within estimate |
| 9 | Documentation: the log and the report in security ops | 14.3 | theory | Record security ops work in the industry format so a stranger could verify it. |
| Report template, the certifying body's hours form | Report accepted by instructor; hours form correctly completed |
| 10 | Skills-check rehearsal for security ops | 14.3 | assessment | Rehearse the skills demonstration under exam conditions. |
| Skills checklist, timer, rehearsal stock | Rehearsal pass with zero critical misses, or a remediation plan on file |
| 11 | Advanced application and special cases in security ops | 14.3 | practice | Apply security ops to the non-standard situations met on real jobs. |
| Special-case packets, materials | Plan approved; special-case job accepted |
| 12 | Written exam and skills demonstration: security ops | 14.3 | assessment | Pass the course's written exam and the observed skills demonstration. |
| Exam, checklist, all tools and stock for the demonstration | Written ≥ 75%; demonstration competent on every critical step with zero safety faults |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| Security ops: written exam | Written exam | 25% | 75% | Theory, terminology, standards and safety for security ops. Multiple choice plus short calculation/interpretation items drawn from the certification body's task list. Standard met · Safety · Time · Quality/finish · Documentation |
| Security ops: skills demonstration | Skills demonstration | 45% | Competent on every critical step; zero safety faults | Observed, timed performance of the core tasks of security ops against a checklist. A critical-step miss or a safety fault stops the assessment; re-attempt after remediation. Standard met · Safety · Time · Quality/finish · Documentation |
| Security ops: lab notebook | Log | 15% | Complete, signed, ≥ 90% attendance of lab hours | Daily entries: task, standard, method, result, time; instructor sign-off. Serves as hours evidence for the licensing/certifying body. Standard met · Safety · Time · Quality/finish · Documentation |
| Security ops: safety audit | Safety audit | 15% | Pass/fail — must pass | Unannounced audit of PPE, housekeeping, lockout/guarding, and hazard communication while performing security ops work. Standard met · Safety · Time · Quality/finish · Documentation |
Competency course in Linux for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in Linux and keep a lab notebook signed off by the instructor.
OutcomesCompetency course in Linux for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in Linux and keep a lab notebook signed off by the instructor.
Why it matters. In Cybersecurity, linux is not a chapter to pass through but a skill an employer will pay for on day one; every credential exam in this program tests it directly or assumes it. The course runs in lab, against vendor documentation and the standard, with the lead engineer as the standard of judgment.
How the course runs. 12 blocks of about 14.2 hours: orientation and safety first, then the tools and the vocabulary, then the standard that governs the work. Guided practice becomes independent practice; measurement and inspection teach the student to judge their own work; the fault lab teaches what failure looks like before it happens on a job. A timed production run and the documentation block close the loop, and the course ends with the written exam and the observed skills demonstration.
What competent looks like. The student can explain linux, set up for it safely, perform it to the standard within time, spot and correct what is wrong, and write it up so that a stranger could verify the work.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | Orientation and safety for linux | 14.2 | theory | State the hazards of linux work and the controls for each; pass the safety brief. |
| PPE set, hazard cards, the program safety manual | Safety quiz 100% (retake until perfect); PPE donned correctly on demand |
| 2 | Tools, materials and terminology of linux | 14.2 | demo | Name, select and care for the tools and materials of linux; use the trade vocabulary correctly. |
| Full tool kit for linux, material samples, tool cards | Oral check: 20 tools/terms named and their use stated |
| 3 | Reading the standard: what governs linux | 14.2 | theory | Locate and apply the parts of vendor documentation and the standard that govern linux. |
| The code/standard excerpt, spec sheets, case file | Written check: 10 look-ups from the standard, 8 correct |
| 4 | Fundamentals I: guided practice in linux | 14.2 | practice | Perform the core tasks of linux step by step under direct supervision. |
| Practice stock/consumables, step checklists, the log | Checklist completed with instructor initials on every step |
| 5 | Fundamentals II: independent practice in linux | 14.2 | practice | Perform the core tasks of linux to the standard with the instructor observing, not assisting. |
| Task tickets, rubric, timer, practice stock | Rubric ≥ 3/4 on every line; time within 150% of the standard |
| 6 | Measurement, layout and quality checks in linux | 14.2 | lab | Measure, lay out and inspect linux work; decide accept/reject against tolerance. |
| Measuring instruments, drawings/orders, sample set | Inspection lab 9/10 correct with correct reasons |
| 7 | Faults, hazards and rework in linux | 14.2 | lab | Identify defective or unsafe linux work, explain the cause, and correct it. |
| Fault samples, diagnosis sheets, rework stock | Rework accepted by the lead engineer on inspection |
| 8 | Production run: linux to standard, timed | 14.2 | practice | Complete a realistic linux job to standard within the allotted time and materials. |
| Job packet, materials at estimated quantity, timer | Job accepted; time and material within estimate |
| 9 | Documentation: the log and the report in linux | 14.2 | theory | Record linux work in the industry format so a stranger could verify it. |
| Report template, the certifying body's hours form | Report accepted by instructor; hours form correctly completed |
| 10 | Skills-check rehearsal for linux | 14.2 | assessment | Rehearse the skills demonstration under exam conditions. |
| Skills checklist, timer, rehearsal stock | Rehearsal pass with zero critical misses, or a remediation plan on file |
| 11 | Advanced application and special cases in linux | 14.2 | practice | Apply linux to the non-standard situations met on real jobs. |
| Special-case packets, materials | Plan approved; special-case job accepted |
| 12 | Written exam and skills demonstration: linux | 14.2 | assessment | Pass the course's written exam and the observed skills demonstration. |
| Exam, checklist, all tools and stock for the demonstration | Written ≥ 75%; demonstration competent on every critical step with zero safety faults |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| Linux: written exam | Written exam | 25% | 75% | Theory, terminology, standards and safety for Linux. Multiple choice plus short calculation/interpretation items drawn from the certification body's task list. Standard met · Safety · Time · Quality/finish · Documentation |
| Linux: skills demonstration | Skills demonstration | 45% | Competent on every critical step; zero safety faults | Observed, timed performance of the core tasks of Linux against a checklist. A critical-step miss or a safety fault stops the assessment; re-attempt after remediation. Standard met · Safety · Time · Quality/finish · Documentation |
| Linux: lab notebook | Log | 15% | Complete, signed, ≥ 90% attendance of lab hours | Daily entries: task, standard, method, result, time; instructor sign-off. Serves as hours evidence for the licensing/certifying body. Standard met · Safety · Time · Quality/finish · Documentation |
| Linux: safety audit | Safety audit | 15% | Pass/fail — must pass | Unannounced audit of PPE, housekeeping, lockout/guarding, and hazard communication while performing Linux work. Standard met · Safety · Time · Quality/finish · Documentation |
Competency course in scripting for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in scripting and keep a lab notebook signed off by the instructor.
OutcomesCompetency course in scripting for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in scripting and keep a lab notebook signed off by the instructor.
Why it matters. In Cybersecurity, scripting is not a chapter to pass through but a skill an employer will pay for on day one; every credential exam in this program tests it directly or assumes it. The course runs in lab, against vendor documentation and the standard, with the lead engineer as the standard of judgment.
How the course runs. 12 blocks of about 14.2 hours: orientation and safety first, then the tools and the vocabulary, then the standard that governs the work. Guided practice becomes independent practice; measurement and inspection teach the student to judge their own work; the fault lab teaches what failure looks like before it happens on a job. A timed production run and the documentation block close the loop, and the course ends with the written exam and the observed skills demonstration.
What competent looks like. The student can explain scripting, set up for it safely, perform it to the standard within time, spot and correct what is wrong, and write it up so that a stranger could verify the work.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | Orientation and safety for scripting | 14.2 | theory | State the hazards of scripting work and the controls for each; pass the safety brief. |
| PPE set, hazard cards, the program safety manual | Safety quiz 100% (retake until perfect); PPE donned correctly on demand |
| 2 | Tools, materials and terminology of scripting | 14.2 | demo | Name, select and care for the tools and materials of scripting; use the trade vocabulary correctly. |
| Full tool kit for scripting, material samples, tool cards | Oral check: 20 tools/terms named and their use stated |
| 3 | Reading the standard: what governs scripting | 14.2 | theory | Locate and apply the parts of vendor documentation and the standard that govern scripting. |
| The code/standard excerpt, spec sheets, case file | Written check: 10 look-ups from the standard, 8 correct |
| 4 | Fundamentals I: guided practice in scripting | 14.2 | practice | Perform the core tasks of scripting step by step under direct supervision. |
| Practice stock/consumables, step checklists, the log | Checklist completed with instructor initials on every step |
| 5 | Fundamentals II: independent practice in scripting | 14.2 | practice | Perform the core tasks of scripting to the standard with the instructor observing, not assisting. |
| Task tickets, rubric, timer, practice stock | Rubric ≥ 3/4 on every line; time within 150% of the standard |
| 6 | Measurement, layout and quality checks in scripting | 14.2 | lab | Measure, lay out and inspect scripting work; decide accept/reject against tolerance. |
| Measuring instruments, drawings/orders, sample set | Inspection lab 9/10 correct with correct reasons |
| 7 | Faults, hazards and rework in scripting | 14.2 | lab | Identify defective or unsafe scripting work, explain the cause, and correct it. |
| Fault samples, diagnosis sheets, rework stock | Rework accepted by the lead engineer on inspection |
| 8 | Production run: scripting to standard, timed | 14.2 | practice | Complete a realistic scripting job to standard within the allotted time and materials. |
| Job packet, materials at estimated quantity, timer | Job accepted; time and material within estimate |
| 9 | Documentation: the log and the report in scripting | 14.2 | theory | Record scripting work in the industry format so a stranger could verify it. |
| Report template, the certifying body's hours form | Report accepted by instructor; hours form correctly completed |
| 10 | Skills-check rehearsal for scripting | 14.2 | assessment | Rehearse the skills demonstration under exam conditions. |
| Skills checklist, timer, rehearsal stock | Rehearsal pass with zero critical misses, or a remediation plan on file |
| 11 | Advanced application and special cases in scripting | 14.2 | practice | Apply scripting to the non-standard situations met on real jobs. |
| Special-case packets, materials | Plan approved; special-case job accepted |
| 12 | Written exam and skills demonstration: scripting | 14.2 | assessment | Pass the course's written exam and the observed skills demonstration. |
| Exam, checklist, all tools and stock for the demonstration | Written ≥ 75%; demonstration competent on every critical step with zero safety faults |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| Scripting: written exam | Written exam | 25% | 75% | Theory, terminology, standards and safety for scripting. Multiple choice plus short calculation/interpretation items drawn from the certification body's task list. Standard met · Safety · Time · Quality/finish · Documentation |
| Scripting: skills demonstration | Skills demonstration | 45% | Competent on every critical step; zero safety faults | Observed, timed performance of the core tasks of scripting against a checklist. A critical-step miss or a safety fault stops the assessment; re-attempt after remediation. Standard met · Safety · Time · Quality/finish · Documentation |
| Scripting: lab notebook | Log | 15% | Complete, signed, ≥ 90% attendance of lab hours | Daily entries: task, standard, method, result, time; instructor sign-off. Serves as hours evidence for the licensing/certifying body. Standard met · Safety · Time · Quality/finish · Documentation |
| Scripting: safety audit | Safety audit | 15% | Pass/fail — must pass | Unannounced audit of PPE, housekeeping, lockout/guarding, and hazard communication while performing scripting work. Standard met · Safety · Time · Quality/finish · Documentation |
Competency course in SIEM for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in SIEM and keep a lab notebook signed off by the instructor.
OutcomesCompetency course in SIEM for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in SIEM and keep a lab notebook signed off by the instructor.
Why it matters. In Cybersecurity, sIEM is not a chapter to pass through but a skill an employer will pay for on day one; every credential exam in this program tests it directly or assumes it. The course runs in lab, against vendor documentation and the standard, with the lead engineer as the standard of judgment.
How the course runs. 12 blocks of about 14.2 hours: orientation and safety first, then the tools and the vocabulary, then the standard that governs the work. Guided practice becomes independent practice; measurement and inspection teach the student to judge their own work; the fault lab teaches what failure looks like before it happens on a job. A timed production run and the documentation block close the loop, and the course ends with the written exam and the observed skills demonstration.
What competent looks like. The student can explain sIEM, set up for it safely, perform it to the standard within time, spot and correct what is wrong, and write it up so that a stranger could verify the work.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | Orientation and safety for sIEM | 14.2 | theory | State the hazards of sIEM work and the controls for each; pass the safety brief. |
| PPE set, hazard cards, the program safety manual | Safety quiz 100% (retake until perfect); PPE donned correctly on demand |
| 2 | Tools, materials and terminology of sIEM | 14.2 | demo | Name, select and care for the tools and materials of sIEM; use the trade vocabulary correctly. |
| Full tool kit for sIEM, material samples, tool cards | Oral check: 20 tools/terms named and their use stated |
| 3 | Reading the standard: what governs sIEM | 14.2 | theory | Locate and apply the parts of vendor documentation and the standard that govern sIEM. |
| The code/standard excerpt, spec sheets, case file | Written check: 10 look-ups from the standard, 8 correct |
| 4 | Fundamentals I: guided practice in sIEM | 14.2 | practice | Perform the core tasks of sIEM step by step under direct supervision. |
| Practice stock/consumables, step checklists, the log | Checklist completed with instructor initials on every step |
| 5 | Fundamentals II: independent practice in sIEM | 14.2 | practice | Perform the core tasks of sIEM to the standard with the instructor observing, not assisting. |
| Task tickets, rubric, timer, practice stock | Rubric ≥ 3/4 on every line; time within 150% of the standard |
| 6 | Measurement, layout and quality checks in sIEM | 14.2 | lab | Measure, lay out and inspect sIEM work; decide accept/reject against tolerance. |
| Measuring instruments, drawings/orders, sample set | Inspection lab 9/10 correct with correct reasons |
| 7 | Faults, hazards and rework in sIEM | 14.2 | lab | Identify defective or unsafe sIEM work, explain the cause, and correct it. |
| Fault samples, diagnosis sheets, rework stock | Rework accepted by the lead engineer on inspection |
| 8 | Production run: sIEM to standard, timed | 14.2 | practice | Complete a realistic sIEM job to standard within the allotted time and materials. |
| Job packet, materials at estimated quantity, timer | Job accepted; time and material within estimate |
| 9 | Documentation: the log and the report in sIEM | 14.2 | theory | Record sIEM work in the industry format so a stranger could verify it. |
| Report template, the certifying body's hours form | Report accepted by instructor; hours form correctly completed |
| 10 | Skills-check rehearsal for sIEM | 14.2 | assessment | Rehearse the skills demonstration under exam conditions. |
| Skills checklist, timer, rehearsal stock | Rehearsal pass with zero critical misses, or a remediation plan on file |
| 11 | Advanced application and special cases in sIEM | 14.2 | practice | Apply sIEM to the non-standard situations met on real jobs. |
| Special-case packets, materials | Plan approved; special-case job accepted |
| 12 | Written exam and skills demonstration: sIEM | 14.2 | assessment | Pass the course's written exam and the observed skills demonstration. |
| Exam, checklist, all tools and stock for the demonstration | Written ≥ 75%; demonstration competent on every critical step with zero safety faults |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| SIEM: written exam | Written exam | 25% | 75% | Theory, terminology, standards and safety for SIEM. Multiple choice plus short calculation/interpretation items drawn from the certification body's task list. Standard met · Safety · Time · Quality/finish · Documentation |
| SIEM: skills demonstration | Skills demonstration | 45% | Competent on every critical step; zero safety faults | Observed, timed performance of the core tasks of SIEM against a checklist. A critical-step miss or a safety fault stops the assessment; re-attempt after remediation. Standard met · Safety · Time · Quality/finish · Documentation |
| SIEM: lab notebook | Log | 15% | Complete, signed, ≥ 90% attendance of lab hours | Daily entries: task, standard, method, result, time; instructor sign-off. Serves as hours evidence for the licensing/certifying body. Standard met · Safety · Time · Quality/finish · Documentation |
| SIEM: safety audit | Safety audit | 15% | Pass/fail — must pass | Unannounced audit of PPE, housekeeping, lockout/guarding, and hazard communication while performing SIEM work. Standard met · Safety · Time · Quality/finish · Documentation |
Competency course in incident response for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in incident response and keep a lab notebook signed off by the instructor.
OutcomesCompetency course in incident response for the Cybersecurity program. Instruction moves from demonstration to supervised practice to independent performance in the lab and live systems, measured against vendor documentation and industry standards. Students configure, secure and troubleshoot real work in incident response and keep a lab notebook signed off by the instructor.
Why it matters. In Cybersecurity, incident response is not a chapter to pass through but a skill an employer will pay for on day one; every credential exam in this program tests it directly or assumes it. The course runs in lab, against vendor documentation and the standard, with the lead engineer as the standard of judgment.
How the course runs. 12 blocks of about 14.2 hours: orientation and safety first, then the tools and the vocabulary, then the standard that governs the work. Guided practice becomes independent practice; measurement and inspection teach the student to judge their own work; the fault lab teaches what failure looks like before it happens on a job. A timed production run and the documentation block close the loop, and the course ends with the written exam and the observed skills demonstration.
What competent looks like. The student can explain incident response, set up for it safely, perform it to the standard within time, spot and correct what is wrong, and write it up so that a stranger could verify the work.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | Orientation and safety for incident response | 14.2 | theory | State the hazards of incident response work and the controls for each; pass the safety brief. |
| PPE set, hazard cards, the program safety manual | Safety quiz 100% (retake until perfect); PPE donned correctly on demand |
| 2 | Tools, materials and terminology of incident response | 14.2 | demo | Name, select and care for the tools and materials of incident response; use the trade vocabulary correctly. |
| Full tool kit for incident response, material samples, tool cards | Oral check: 20 tools/terms named and their use stated |
| 3 | Reading the standard: what governs incident response | 14.2 | theory | Locate and apply the parts of vendor documentation and the standard that govern incident response. |
| The code/standard excerpt, spec sheets, case file | Written check: 10 look-ups from the standard, 8 correct |
| 4 | Fundamentals I: guided practice in incident response | 14.2 | practice | Perform the core tasks of incident response step by step under direct supervision. |
| Practice stock/consumables, step checklists, the log | Checklist completed with instructor initials on every step |
| 5 | Fundamentals II: independent practice in incident response | 14.2 | practice | Perform the core tasks of incident response to the standard with the instructor observing, not assisting. |
| Task tickets, rubric, timer, practice stock | Rubric ≥ 3/4 on every line; time within 150% of the standard |
| 6 | Measurement, layout and quality checks in incident response | 14.2 | lab | Measure, lay out and inspect incident response work; decide accept/reject against tolerance. |
| Measuring instruments, drawings/orders, sample set | Inspection lab 9/10 correct with correct reasons |
| 7 | Faults, hazards and rework in incident response | 14.2 | lab | Identify defective or unsafe incident response work, explain the cause, and correct it. |
| Fault samples, diagnosis sheets, rework stock | Rework accepted by the lead engineer on inspection |
| 8 | Production run: incident response to standard, timed | 14.2 | practice | Complete a realistic incident response job to standard within the allotted time and materials. |
| Job packet, materials at estimated quantity, timer | Job accepted; time and material within estimate |
| 9 | Documentation: the log and the report in incident response | 14.2 | theory | Record incident response work in the industry format so a stranger could verify it. |
| Report template, the certifying body's hours form | Report accepted by instructor; hours form correctly completed |
| 10 | Skills-check rehearsal for incident response | 14.2 | assessment | Rehearse the skills demonstration under exam conditions. |
| Skills checklist, timer, rehearsal stock | Rehearsal pass with zero critical misses, or a remediation plan on file |
| 11 | Advanced application and special cases in incident response | 14.2 | practice | Apply incident response to the non-standard situations met on real jobs. |
| Special-case packets, materials | Plan approved; special-case job accepted |
| 12 | Written exam and skills demonstration: incident response | 14.2 | assessment | Pass the course's written exam and the observed skills demonstration. |
| Exam, checklist, all tools and stock for the demonstration | Written ≥ 75%; demonstration competent on every critical step with zero safety faults |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| Incident response: written exam | Written exam | 25% | 75% | Theory, terminology, standards and safety for incident response. Multiple choice plus short calculation/interpretation items drawn from the certification body's task list. Standard met · Safety · Time · Quality/finish · Documentation |
| Incident response: skills demonstration | Skills demonstration | 45% | Competent on every critical step; zero safety faults | Observed, timed performance of the core tasks of incident response against a checklist. A critical-step miss or a safety fault stops the assessment; re-attempt after remediation. Standard met · Safety · Time · Quality/finish · Documentation |
| Incident response: lab notebook | Log | 15% | Complete, signed, ≥ 90% attendance of lab hours | Daily entries: task, standard, method, result, time; instructor sign-off. Serves as hours evidence for the licensing/certifying body. Standard met · Safety · Time · Quality/finish · Documentation |
| Incident response: safety audit | Safety audit | 15% | Pass/fail — must pass | Unannounced audit of PPE, housekeeping, lockout/guarding, and hazard communication while performing incident response work. Standard met · Safety · Time · Quality/finish · Documentation |
An integrated, assessed piece of real work that draws on every trade course in Cybersecurity: planned, estimated, executed and documented by the student, reviewed by an employer advisor. Capstones are shown in the Student Yard or the Museum of VoTech where the work allows.
OutcomesAn integrated, assessed piece of real work that draws on every trade course in Cybersecurity: planned, estimated, executed and documented by the student, reviewed by an employer advisor. Capstones are shown in the Student Yard or the Museum of VoTech where the work allows.
How the course runs. 4 blocks: Capstone brief and specification; Capstone build I; Capstone build II; Capstone presentation and defense.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | Capstone brief and specification | 54 | theory | Read the capstone specification and plan the job. |
| Capstone spec, estimating sheets | Plan and estimate approved |
| 2 | Capstone build I | 54 | practice | Execute the first half of the capstone to standard. |
| All materials per estimate | Mid-point inspection passed |
| 3 | Capstone build II | 54 | practice | Complete the capstone to standard within the estimate. |
| As above | Work complete; package complete |
| 4 | Capstone presentation and defense | 54 | assessment | Present the finished work and its documentation to the panel. |
| Presentation space, the finished work | Rubric ≥ 3/4 on every criterion |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| Capstone: finished work + documentation | Project | 60% | Rubric ≥ 3 of 4 on every criterion | Employer advisor + instructor score the finished work against the specification, the estimate, and the documentation package. Meets specification · Within estimate · Workmanship · Safety · Documentation |
| Capstone: portfolio | Portfolio | 20% | Complete | Photos/drawings/logs of every course skills demonstration plus the capstone, in the program portfolio format. Completeness · Organization · Evidence quality |
| Capstone: defense | Oral / panel | 20% | Panel pass | 15-minute presentation and questions from the panel. Explains decisions · Answers technical questions · Professional communication |
Supervised placement with an employer partner in Cybersecurity work. Hours are logged against the certifying body's task list; the employer evaluates against the same rubric used in the shop.
OutcomesSupervised placement with an employer partner in Cybersecurity work. Hours are logged against the certifying body's task list; the employer evaluates against the same rubric used in the shop.
How the course runs. 4 blocks: Placement orientation; Supervised work: weeks 1–2; Supervised work: weeks 3–4; Supervised work: final weeks.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | Placement orientation | 81 | theory | Know the site, its rules, and the competency list you will be evaluated on. |
| Site handbook, competency list, hours log | Induction signed |
| 2 | Supervised work: weeks 1–2 | 81 | field | Perform entry tasks under close supervision. |
| Hours log | Log current; supervisor initials |
| 3 | Supervised work: weeks 3–4 | 81 | field | Perform the trade's routine tasks with normal supervision. |
| Hours log, evaluation form | Mid-point evaluation satisfactory |
| 4 | Supervised work: final weeks | 81 | field | Meet employer expectations for a new hire on the competency list. |
| Evaluation form, hours verification | Final evaluation satisfactory on every competency; hours verified |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| Employer evaluation | Skills demonstration | 70% | Satisfactory on every competency | Mid-point and final evaluation by the site supervisor on the program competency list. Competency · Safety · Attendance · Conduct · Initiative |
| Hours & task log | Log | 30% | Required hours complete and verified | Signed log of hours and tasks; verified by the registrar for the board/certifying body. Complete · Verified |
Structured preparation for CompTIA CySA+; CompTIA Security+; ISC2 CC: content review mapped to the exam blueprint, timed practice exams, practical-exam rehearsal, and registration/eligibility paperwork with the registrar.
OutcomesStructured preparation for CompTIA CySA+; CompTIA Security+; ISC2 CC: content review mapped to the exam blueprint, timed practice exams, practical-exam rehearsal, and registration/eligibility paperwork with the registrar.
How the course runs. 4 blocks: The exam blueprint; Mock exam I and review; Practical exam rehearsal; Mock exam II and registration.
| # | Lesson | Hr | Type | Objective | Activities | Materials | Check |
|---|---|---|---|---|---|---|---|
| 1 | The exam blueprint | 22.5 | theory | Map the credential exam blueprint to what you have learned. |
| Published blueprint, study plan template | Study plan on file |
| 2 | Mock exam I and review | 22.5 | assessment | Sit a timed full-length mock and review every miss. |
| Mock exam, answer keys | Score recorded; review complete |
| 3 | Practical exam rehearsal | 22.5 | practice | Rehearse the practical/skills portion to the exam's time and format. |
| Practical exam materials | Rehearsal within time, no critical misses |
| 4 | Mock exam II and registration | 22.5 | assessment | Sit the second mock and complete exam registration. |
| Registration forms, hours evidence | ≥ 80%; registration submitted |
| Assessment | Type | Weight | Pass standard | Method & rubric |
|---|---|---|---|---|
| Mock certification exam (×2) | Mock certification exam | 100% | ≥ 80% on both | Full-length timed mocks built from the certifying body's published blueprint; second attempt after targeted review. Score · Time management |
The program completion credential(s). Sat at the school's authorized testing center or the body's test site; results recorded in the student record and reported in the annual outcomes report. Pass standard: Credential issued by the body.
Back to Cybersecurity · How the school gets authority to award these credentials