5.1: Your Job During an Incident
Your Job During an Incident
The instinct that got you your job will hurt you here. You’re technical. An incident is a technical event. Every fiber of you will want to be in the terminal, in the log query, in the war-room channel asking “what about the DNS logs?” Resist it — not because you’d be useless there, but because if you’re in the weeds, nobody is doing your actual job, and your actual job is the set of decisions no one else in the building is allowed to make.
The line, drawn in advance
The clean split: responders decide what’s true; leaders decide what to do about it. Your team owns facts and containment mechanics. You own the decisions with legal, financial, or reputational consequence. In matrix form — and this table is worth circulating to your exec team on a quiet day, because a quiet day is when people can agree to it:
| You decide | You delegate |
|---|---|
| Engage outside counsel and the insurer — and when | Containment technique (isolate vs. watch vs. block) |
| Authorize emergency spend (IR firm, forensics, overtime) | Forensic collection and evidence handling |
| Take a business system down / accept downtime | IOC hunting, scoping, log analysis |
| Disclosure: regulators, customers, public, board | Threat-intel attribution guesses |
| Any contact with the attacker, and ransom posture | Ticket-level prioritization inside the response |
| Approve every external communication | Vendor coordination on technical remediation |
| End the incident — declare it closed | Writing the technical timeline |
Two items on the left get missed constantly. Accepting downtime is a business decision, not a technical one — when Colonial Pipeline shut its pipeline in May 2021, that wasn’t ransomware encrypting pumps; it was leadership deciding they couldn’t safely bill or operate with IT compromised. Whatever you think of the call, it was made at the right altitude. And declaring the incident over is yours because responders, left alone, will either close too early (exhaustion) or never (thoroughness). Someone has to own “we are done, here’s the residual risk we’re accepting.”
What “leading” looks like, hour by hour
Your visible job during the incident is four behaviors:
Set the rhythm. Decide the update cadence (lesson 3.4’s template) and enforce it — for yourself upward, and for the response team inward. A team that’s briefing you every twenty minutes isn’t responding; a team that hasn’t briefed you in six hours has lost its narrator.
Buy things fast. The highest-leverage thing a leader does in hour one is remove friction: pre-approve the IR retainer activation, authorize the overtime, get counsel on the phone. Responders stall on approvals; be the person who has already approved.
Absorb pressure from above. The CEO wants answers hourly; the board chair texts. Your job is to be the membrane: calm, specific, time-bounded updates go up, and none of that anxiety flows down into the war room. A responder who can hear the CEO’s panic responds worse.
Write decisions down. Every call from the left column of the matrix goes into a decision log — what was decided, when, by whom, what alternatives were on the table, what was known at the time. Lesson 5.6 gives you the template. This habit looks bureaucratic until the moment it’s the only thing standing between “we made a reasonable call on incomplete information” and a regulator’s hindsight. Hold that thought for lesson 5.2 — and for what happened to the one CSO who’s been to trial over exactly this.
The failure modes have names
The two ways leaders break in incidents are both altitude failures. The submarine: disappears into the technical response, surfaces twice a day, execs fill the silence with speculation and the org’s decisions drift to whoever talks loudest. The megaphone: hovers over the war room relaying every fragmentary finding straight to the board, so half-facts become commitments the responders then have to un-say. Both are more comfortable than the actual job, which is standing in the middle, holding decision authority, and being interruptible but not absorbed.
Practice the middle. The scenario in lesson 5.5 is built to punish both extremes.