What is an incident commander?

In a cyber incident, the incident commander is the one person who coordinates the response and has the authority to make, or quickly tee up, decisions until the incident is closed. The title comes from the Incident Command System used in emergency management, where the incident commander is responsible for the overall management of the incident.

What it means in practice

Organizations use different titles: incident lead, incident manager, response coordinator. NIST’s incident handling guide (SP 800-61 Revision 2, since superseded by Revision 3) says a single employee, with one or more designated alternates, should be in charge of incident response. The Texas Department of Information Resources’ incident response team Redbook describes a coordinator who manages all aspects of the response, coordinates communication and makes sure notifications happen.

The job is coordination, not typing. The incident commander sets priorities (contain first, or preserve evidence first), assigns workstreams (technical, legal and privacy, communications, business operations, vendors), runs the briefing rhythm, keeps the decision log, and calls in outside help such as forensics, counsel and the insurer. Some decisions, such as whether to pay an extortion demand or notify a regulator, usually belong to executives and counsel. The commander’s job is to bring those decisions forward fast, with the facts and the options.

This role should be separate from the technical lead, who owns the quality of the hands-on work. NIST describes the technical lead as having oversight of, and final responsibility for, the team’s technical work. An incident commander who is also the best engineer ends up on the keyboard while nobody runs the incident.

Where it shows up in an incident

Naming the incident commander is one of the first decisions, and the incident response plan should name the role by position, with alternates, so nobody argues about it at 2 a.m. See the incident response plan template for where it sits.

Common mistakes:

Nobody is named, and everyone assumes it’s the IT director.
The CEO takes over and redirects the team toward whatever looks most visible. The CEO is better placed as the person being briefed, making the business calls.
There are no alternates, so the commander runs the whole incident with no relief.
Decisions are made on a call and never written down.
Outside advisers are treated as the commander. Counsel and the insurer’s responders advise. The organization still has to run its own response.

In a tabletop exercise

Two ways to test it:

Inject, 6:40 p.m., Saturday. “The IT director, who has been leading the response since early morning, tells the group she has been awake for 17 hours. Her designated alternate is on a flight that lands tomorrow.” Discussion: who takes over, how does the handoff happen, and does the plan say so?

Inject, 8:15 p.m. “The CEO joins the call and tells the IT team to restore the file server first because a customer is waiting on a quote.” Discussion: what does the incident commander do, and who needs to hear that this order of restoration is a business decision?

What it means in practice

Where it shows up in an incident

In a tabletop exercise

Sources