Roles and Responsibilities of the Response Team
Who does what during an incident
An effective incident response team depends on each person knowing exactly what role they play before the crisis happens, because improvising the assignment of responsibilities in the middle of an active attack creates confusion, duplicated efforts and late decisions. Typical roles include the incident lead, who coordinates and makes final decisions; the technical analysts, who investigate and contain; a communications owner who manages information inside and outside the organization; and liaisons with legal and leadership for decisions that go beyond the purely technical. In practice, defining these roles in advance and practicing them in drills avoids the common scenario where several people try to lead the response at the same time while nobody takes care of communicating the incident's status to management. A key nuance is that the incident leadership role shouldn't always fall to the person with the most technical knowledge, but to whoever best coordinates people and stays calm under pressure.