One-year Programme: Cybercrime Investigation and Response

Start semesters

2025 Autumn

One-year Programme: Cybercrime Investigation and Response

Study Facts
- Area of Study
  Computing
- ECTS
  60
- NQF Level
  Bachelor's degree (Level 6 1. Cycle)
- Campus
  OnlinePLUS - Bergen, OnlinePLUS - Oslo, Online
- Study Mode
  OnlinePLUS, Full-time, Online
- Entry Requirements
  Entry Requirements
- Study Programme Leader
  Veronica Schmitt

Introduction

Noroff University College (NUC) offers studies designed to equip students with the skills necessary to operate in the evolving landscape of digital security. This 60 ECTS study serves as an introduction to the field of Digital Forensics and Incident Response (DFIR), providing students with the knowledge and foundational skills required to investigate digital incidents, analyse forensic data, and understand the broader implications of cybercrime investigations.

The modern world is increasingly reliant on interconnected digital technology, with every action leaving performed on a device leaving a digital trace. Organisations across industries—law enforcement, finance, corporate and critical sectors—must respond to security breaches and conduct forensic investigations to safeguard critical assets. The ability to detect, respond, investigate, and mitigate cyber incidents is now essential, not only for cybersecurity professionals but for anyone involved in digital security operations.

While traditionally digital forensics was confined to law enforcement, the rise in cybercrime and security breaches has expanded the field to include corporate security teams, government agencies, and private forensic consultants. The study introduces students to core forensic and incident response methodologies, enabling them to engage with real-world digital investigations and learn the fundamentals of forensic analysis and incident response techniques.

This study acts as a stepping stone into the broader field of digital forensics and incident response, providing students with an opportunity to continue studying the Bachelor Digital Forensics and Incident Response (DFIR) at Noroff University College, progressing into more advanced forensic analysis and security operations.

Aims of the Degree Programme

This study aims to introduce students to key forensic methodologies and incident response techniques, giving them a practical and theoretical foundation in digital investigation, network security, and cryptography as they apply to cyber incidents and other related fields. Graduates will gain proficiency in:

Digital forensic – Learning how to collect, process, and analyse digital evidence.
Incident response – Learning how to respond to cyber threats, mitigate damage, and preserve evidence.
Legal and ethical considerations – Understanding digital investigations within the legal framework and professional ethics and the legal requirements for the disclosure of data breaches.

This 60 ECTS study serves as an entry point for students interested in digital forensics and investigating cyber incidents. It provides a foundational knowledge base that prepares students to progress into full degree studies or explore entry-level roles in forensic investigation and incident response.

The study encourages students to develop problem-solving skills, critical thinking, and a methodical approach to forensic analysis and responding to cyber incidents. Students who complete this study will have a strong foundation to continue their studies in digital forensics and incident response or apply their knowledge in forensic and security-related roles.

Course Model

This programme is a full-time study, based on a 40-hour per week study schedule. The study consists of two semesters which are delivered over 1 academic year (each of a 10-month duration), providing 60 ECTS of educational material and qualification. This results in a 30 ECTS workload per semester, which equates to 1,500-1,800 hours of work. Each year the programmes and their courses are reviewed to ensure the degree continues to be appropriate for this fast-developing field. Some courses may span semesters and the credit value is only awarded in the semester they are completed. The courses that comprise this programme are therefore subject to minor changes each academic year.

YCCIR - Cybercrime Investigation and Response H25

Course	Course type	2025 Spring	2025 Autumn
UC2IRF10 Incident Response Fundamentals	Core	10
UC2DFF10 Digital Forensics Fundamentals	Core	10
UC1OSA10 Operating Systems and Computer Architecture	Core	10
UC2DFI10 Digital Forensic Investigation	Core		10
UC1NFU10 Network Fundamentals	Core		10
UC1ACR05 Applied Cryptography	Core		5
UC1AS105 Academic Skills 1	Core		5
Sum (60 total)		30	30

Programme Learning Outcomes

A Programme Learning Outcome (PLO) is essentially a statement that describes what the student has achieved upon successfully completing the study. Each course description has its own set of learning outcomes, which contribute to the achievement of Programme Learning Outcomes. The PLOs for this programme are based on the Norwegian Qualifications Framework for Lifelong Learning (NQF) at bachelor level. The NQF levels are formulated on the basis of what a person knows, can do and is capable of doing as a result of a learning process. The outcomes of the completed learning process are described in the categories: “knowledge”, “skills” and “general competences”.

Knowledge: Understanding of theories, facts, principles, procedures in subject areas and/or occupations.
Skills: Ability to utilise knowledge to solve problems or tasks (cognitive, practical, creative and communication skills.
General Competence: Ability to utilise knowledge and skills in an independent manner in different situations.

Students who complete the programme will attain a transcript confirming their results and are intended to acheive the following:

Knowledge

The candidate …

K1	can explain the fundamental principles of digital forensics and incident response, including key investigative processes and forensic methodologies.
K2	understands the legal and ethical considerations surrounding digital forensics and cybercrime investigations.

Skills

The candidate …

S1	apply digital forensic techniques to collect, preserve, and analyse digital evidence from various sources.
S2	can utilise incident response methodologies to detect, assess, and respond to cyber incidents.
S3	can analyse forensic evidence using structured investigative processes, ensuring data integrity and chain of custody.
S4	can interpret forensic findings and effectively communicate technical conclusions in a clear and structured manner.
S5	can conduct research and critical analysis in digital forensics, applying academic skills to investigate emerging issues in cyber investigations.

General Competence

The candidate …

G1	can work independently and collaboratively in forensic and incident response scenarios, demonstrating problem-solving and analytical thinking.
G2	can apply ethical reasoning and professional integrity when handling sensitive digital evidence.
G3	can communicate forensic findings clearly to both technical and non-technical audiences.
G4	can recognise the need for continuous learning and professional development in the fast-evolving field of digital forensics and incident response.

Teaching and Learning

Learning Activities

All studies use a variety of teaching and learning activities to encourage students to actively explore and apply new knowledge, along with developing skills and competencies. Each course will incorporate a range of teaching and learning methods according to which are most appropriate for that course – determined through a process of constructive alignment. The primary aim of these methods is to support the students’ learning process and facilitate the achievement of the learning outcomes. The applicable teaching and learning methods include, but are not limited to, the following:

Teacher-Led Activities (TLA)
Lectures and video lectures Online lessons Tutorials	Seminars Presentations

Teacher-Supported Work (TSW)
Practical Work Workshops	Scheduled guidance Group work

Self-Study (SST)
Research Reflection	Group work (Individual) Virtual Laboratory Work

Learning Resources

Key information for the degree is delivered in lectures, normally in one of the Campus auditoriums and as a live stream. Tutorials and supported study are delivered through laboratory-based sessions. All educational material is accessible through the LMS, which forms part of the Virtual Learning Environment (VLE), illustrated in Figure 1.

The LMS provides a central location for the distribution of all educational content and learning resources related to all courses throughout the study:

Programme Description
Course Descriptions
Lecture slides
Recorded lectures
Reading lists

Student Handbook
Tutorial exercises
Supplementary notes
Self-study material

The dates and times for all educational sessions for every course, including lectures and tutorials, can be found in the online timetabling system (TimeEdit).

Study Workload

The student workload has been carefully considered for each course to include an appropriate combination of activities suitable for the subject area.

Information and details about a specific course can be found in the respective Course Description. However, each course comprises a selection of lectures, tutorials, and other appropriate sessions. These are timetabled based on a full-time study schedule of 08:00 to 16:00, Monday to Friday.

At the start of each academic year, a Study Schedule is published and made accessible. It contains the planned start and end dates for all courses in the degree. The schedule also includes dedicated study time to work on projects and extra-curricular sessions, including seminars, workshops, and guest speakers from industry. If the schedule is updated, students are promptly informed.

Assessment

Grading of Assessments

Each course in the study comprises of several graded (summative) assessments, where students can demonstrate their achievements and abilities. Information about assessments for each course is provided via the course pages on the LMS. When assessments are released, students are encouraged to always read through the instructions fully and carefully, to ensure the greatest chance of success. If anything is unclear, please contact the relevant Course Leader as soon as possible.

A course is successfully completed once the student has obtained a passing grade for that course. Every assessment has a specific completion deadline comprising a date and time. Work can be submitted any time up to the stated deadline. Students must be able to clearly demonstrate the extent to which they have met the learning outcomes of that course in order to pass. Students will encounter a variety of assessments, which may be used for formative and summative purposes, to ensure that students meet or exceeded the PLOs.

Specific assessment strategies for each course, and instructions for submitting course work, are detailed in the LMS course pages. Please see the regulations available on www.noroff.no/en.

Assessment
Formative	Continuous Assessment Online Test Interactive Online Test
Summative	Presentation of Practical Work Portfolio of Work Projects Online Exams Reports Term Paper Oral Test

Grading Scale

Both formative and summative results may be assessed as Approved / Not approved, Pass / Fail or A-F.
Assessments are graded according to the standard university grading scale, illustrated in the table below.

Grade Letter	Quality Indicator	Definition
A	Excellent	An excellent performance, clearly outstanding. Shows a high degree of independence.
B	Very good	A very good performance, above average. Shows a certain degree of independence.
C	Good	An average performance, satisfactory in most areas.
D	Satisfactory	A performance below average, with significant shortcomings.
E	Sufficient	A performance that meets the minimum criteria, but no more.
F	Fail	A performance that does not meet the minimum criteria.

Entry Requirements

For general admission it is required to document the following criteria as passed:

Higher Education Entrance Qualification, and
Candidates must be able to document proficiency in the English language.
Language requirements by Samordna Opptak

Special admission requirements:
In addition to the general admission requirements, it is required to document the following:

Mathematics R1 (S1+S2)

For admission on basis of prior learning and work experience:
Admission based on prior experience requires a written application for evaluation. Applicable candidates must be at least 25 years of age in the year of admission.

For candidates with foreign education the requirements for Higher Education are:

The country must be recognized by NOKUT, specified in the GSU-list.
Candidates must be able to document proficiency in the English language.
Language requirements by Samordna Opptak

For further information, please see the admission requirements: https://www.noroff.no/en/admission/admission-requirements

Campus and Online Study

All students follow the same progression according to their education plan, irrespective of whether they study online or on campus. All students study the courses at the same time, with the same delivery and workload, following identical assessment strategies for every course. At the study level no distinction is therefore made between campus and online students. All students are required to engage in live education sessions (such as lectures) and undertake all required educational activities.

Students are encouraged to interact with each other via online forums and chat systems, enabling discussions to take place involving both online and campus students. Each student cohort is therefore a single learning community, concurrently engaging in all educational activities irrespective of actual physical location. Throughout all educational sessions course staff actively encourage participation from campus and online students simultaneously, and do not focus solely on those who are physically present.

This tight integration of campus and online ensures students will be part of a cohesive learning community throughout their study. As a result, this also means that should students personal situations change during their studies, and they must change their mode of study from online to campus (or vice versa) this can be done with little to no disruption to their studies

Opportunities for Further Studies

The subject material will enable graduates to go on to continue studying at Noroff University College B Digital Forensics and Incident Response.

Possible Professions

Graduates understand business security needs examined and are able to ensure that such security solutions are implemented correctly, and that they are in fact adequate to mitigate the risks the organisation faces in the given context. Whilst a complete bachelor is not achieved, study will set graduates to begin to work in areas such as:

Digital Forensics Investigator
Intrusion Analyst
Cyber Security Incident Responder
Cyber Security Analyst
CERT Specialist
SOC Analyst