Earn Your CIDFP Designation

Where Technical Incident Response Meets Insurance Decision-Making

The Cyber Insurance Digital Forensics Professional (CIDFP) designation bridges the gap between technical cyber incident realities and insurance decision-making, so participants can better understand how cyber events unfold, how losses develop, and how policy, underwriting, and claims functions intersect.

This isn't open enrollment

Unlike self-paced PLUS designations, CIDFP runs as a single cohort each year. Once a cohort fills or the window closes, the next opportunity is a full year away.

Cadence | One cohort per year
Seats | Capped at 50-60 participants

Learn More

Why Organizations Should Register Employees for the CIDFP Designation

Rather than focusing solely on policy language or security controls, the program helps professionals connect technical cyber events to insurance outcomes, improving decision-making across the insurance lifecycle.

Sharper Underwriting

Move beyond checklists to real resilience assessment.

Stronger Claims Handling

Anticipate disputes before they escalate.

Better Product Design

Align coverage with how losses actually happen.

Common Language

Talk fluently with insureds, IR firms, and regulators.

Cross-Functional Development

One program, multiple career tracks.

Real-World Reps

A live ransomware wargame, not just theory.

A Four-Phase Learning Arc

The program moves from foundational cybersecurity and regulatory concepts into hands-on incident response and digital forensics, then into legal engagement and insurance strategy.

The CIDFP designation is delivered as a hybrid program: on-demand sessions you complete at your own pace, live Q&A webinars after each release to work through questions with instructors and peers, and a live in-person capstone that closes out the program.

Phase 1

Cyber Foundations & Incident Response Basics

Establishes a shared vocabulary between technical and insurance professionals.

Why cybersecurity matters economically and legally
Regulatory and statutory data security requirements
What constitutes a cyber "incident"
How incident response works in insured environments
The connection between technical events and policy language

Phase 2

How Cyber Incidents Actually Happen

Explains where claims come from and why certain incidents drive severity, complexity, and coverage disputes.

Enterprise IT infrastructure weaknesses
Cloud and SaaS account compromise (e.g., Microsoft 365)
Vulnerabilities, exploits, and attack paths
Ransomware lifecycle and extortion economics
Business Email Compromise (BEC) and funds transfer fraud
Data breaches and regulatory / privacy exposure

Phase 3

Digital Forensics, Legal Interface & Risk Modeling

Participants learn how technical findings translate into legal outcomes and financial exposure.

Core digital forensics principles and evidence development
Working with law enforcement (FBI, CISA, etc.)
Evidence preservation and legal scrutiny
Litigation, class actions, and expert testimony
How incident data informs cyber risk modeling and portfolio risk

Phase 4

Insurance Strategy: Underwriting, Claims & Resilience

Connects technical knowledge back to underwriting judgment and claims strategy.

Resilience-based underwriting, beyond checklist controls
Assessing real preparedness vs. stated controls
Claims handling realities in ransomware and breach scenarios
Coverage interpretation under pressure

15 Sessions · Released Every 2–3 Weeks

It All Builds to One Live Capstone: An End-to-End Cyber Claim Wargame

Held in person the day before the Cyber Symposium 2026. Participants work through a simulated ransomware incident from the first alert to the board report.

Coverage decisions

Negotiation dynamics

Notification & regulatory obligations

How to Earn the CIDFP Designation

The CIDFP designation is for professionals who want to demonstrate proficiency at the intersection of digital forensics, incident response, and insurance decision-making. It stands as a meaningful designation on its own, and also builds toward the CPLP designation - your path to ongoing learning and advancement across the cyber insurance lifecycle.

Step 1: Join PLUS and Confirm Your Experience

Become a PLUS member for free and confirm you have at least 2 years of insurance industry experience.

Not there yet? You can still enroll and begin working toward your designation. Your application will be reviewed once all requirements are met.

Step 2: Enroll in the CIDFP Designation Program

Enrolling(opens in new tab) in the designation program streamlines your experience by allowing you to track your progress, affirm your completion, and receive your designation. During the enrollment process, you'll enter your industry start date and purchase the Cyber Insurance Digital Forensics Professional (CIDFP) Designation Program(opens in new tab). The application fee is included in the cost of the program content; no additional fee is required.

Step 3: Complete the CIDFP Designation Program

Designed for cyber underwriters, claims professionals, and insurance product managers, this hybrid program includes 14 on-demand sessions and 1 live in-person capstone that moves from foundational cybersecurity and regulatory concepts into hands-on incident response, digital forensics, legal engagement, and insurance strategy, culminating in a live capstone wargame that simulates a full ransomware claim.

View CIDFP Designation Program

After you've completed the above requirements:

Affirm Your Completion and Receive Your Designation

After you complete all requirements for your designation, click the Affirm Completion link for your CIDFP designation program in your Education Programs dashboard. The PLUS Designation Manager will review and approve your designation. Note: This approval process can take a few business days to complete. After your designation has been approved, you'll receive a confirmation email with designation-specific information, and your designation certificate will be available for download in your Education Programs dashboard.

Maintain your CIDFP Designation

After earning your CIDFP designation, you're required to report 12 hours of professional development every 2 years. Failure to do so may result in PLUS revoking your designation.

Part of the Broader PLUS Learning Path

Next Step

Follows Cyber University, Certificate in Cyber Liability, and the CPLP Designation.

CPLP Credits

Counts toward CPLP self-reporting credits.

Standalone Value

Stands on its own as a designation.

Cyber Symposium

Timed before Cyber Symposium(opens in new tab), with a confirmed $250 discount toward registration.

One cohort. One window a year.

Enrollment in the designation and registration for the program open and close together. For 2026, registration opens August 5 and closes November 12. After that, both shut down until the next cohort in 2027.