Topics in this domain
- Event vs Incident vs Breach
- Developing the Incident Response Plan
- Incident Response Team Roles and Authority
- Incident Classification and Severity Levels
- Incident Response Playbooks and Decision Trees
- Escalation and Communication Plans
- Business Impact Analysis
- RTO, RPO, MTD and Recovery Prioritisation
- Business Continuity Planning and Strategies
- Crisis Management and Continuity Governance
- Disaster Recovery Planning
- Recovery Sites: Hot, Warm and Cold
- Backup Strategies and Cloud DR
- Incident Response Training
- Testing Plans: Tabletop, Functional and Full Interruption
- Evaluating Exercises and Improving Readiness
- Security Event Detection and Monitoring Methods
- SIEM, the SOC and Event Correlation
- Threat Intelligence and Indicators of Compromise
- Incident Triage and Initial Investigation
- Evidence Preservation, Forensics and Chain of Custody
- Containment Strategies: Short-Term and Long-Term
- Making Containment Decisions
- Breach Notification and Regulatory Reporting
- External Communications: Customers, Media and Law Enforcement
- Eradication, Recovery and Return to Normal Operations
- Post-Incident Review and Root Cause Analysis
- Lessons Learned and Incident Trend Analysis
Incident Response Team Roles and Authority
More than a technical team
A serious incident pulls in far more than the security team: lawyers about notification, communications staff about customers, executives about shutting down revenue-earning systems. Organising, training, equipping and assigning responsibilities to incident response teams is a CISM task, and the team and its authority are agreed in advance, so nobody has to ask permission at 3 a.m.
Who’s on the team
| Role | Responsibilities |
|---|---|
| Incident manager | Leads and coordinates the response; tracks actions and decisions |
| Technical responders | SOC, IT, forensics, cloud and network specialists |
| Legal and compliance | Notification duties, legal privilege, law enforcement, contracts |
| Communications | Messages to staff, customers and the media |
| Executive sponsor | Business decisions: shutting down services, paying, disclosing |
| HR | Insider cases and staff impact |
| External partners | IR retainer firm, cyber insurer, MSSP, key vendors |
Decide authority in advance
| Decision | Who has authority (example) |
|---|---|
| Isolate an infected server | Incident manager or SOC lead |
| Take a customer-facing service offline | Executive sponsor or delegate |
| Notify the regulator | Legal, with executive approval |
| Involve law enforcement | Legal and the executive sponsor |
| Engage the IR retainer | CISO |
Without pre-agreed authority, containment is delayed while people argue.
Team models
- Central: one team for the whole organisation. Consistent; suits smaller or single-site organisations.
- Distributed: teams by region or business unit. Local knowledge; needs coordination.
- Outsourced or hybrid: an MSSP or IR retainer provides experts, while internal staff coordinate and decide. The most common model.
Equipping the team
- named members and deputies with current contact details
- out-of-band communication (phones, a separate chat platform), in case email or chat is compromised
- tools and access ready in advance: EDR, logs, forensic capability, cloud consoles
- retainers: an IR firm, legal counsel, the cyber insurer’s hotline
- training and regular exercises
Example. During a weekend ransomware attack, the IR team can’t reach the CIO, and nobody else knows whether they may shut down the ERP. Six hours pass. Afterwards, the plan names deputies for every role and gives the incident manager authority to isolate any system immediately.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most important thing to define before an incident | Roles, responsibilities and authority |
| Non-technical members of the IR team | Legal, communications, HR, executive sponsor |
| Benefit of an IR retainer | Expert help available quickly in major incidents |
| Contact lists should be… | Current and accessible out of band |
| Who leads the response? | The incident manager |
In short
- Organising, training, equipping and assigning responsibilities to incident response teams is a CISM task.
- The team includes an incident manager, technical responders and business functions: legal, communications, HR, an executive sponsor and external partners.
- Authority must be defined in advance: who can isolate systems, shut down services, call law enforcement or approve notifications.
- Team models: central, distributed, or hybrid with an external IR retainer for major incidents.
- Every role needs a named deputy and up-to-date contact details, including out-of-band channels.
- Equip the team before incidents: tools, access, forensic capability, retainers and documentation.
Exam traps
- Without pre-agreed authority, containment is delayed while people argue.
- Incident response isn't only technical; legal and communications are core members.
- Contact lists stored only in email or chat fail if those systems are compromised.
- An IR retainer arranged during an incident costs more and arrives later.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Who's on the team
Team models
1 / 9