Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we call in outside incident-response help?

5 decision pointsThe pack behind this answer: Security Incident Management

Add to board memo

The short answer

Recommendation
Call outside responders when harm is spreading faster than your team can contain it, recovery needs more than you have, or evidence must stand up in court, a claim or a police case. If you hold cyber insurance, tell the insurer and check its panel conditions before you engage anyone.
Reasoning
Outside responders can start within agreed hours, without a new contract, when the incident is beyond your own team. The answer changes as the incident grows, so the crisis team asks the question at every meeting. Many cyber policies require notice within a set time and some pay only for the insurer's panel firms, so engaging others first can affect cover. Outside responders work under your direction: the decisions and the reports stay with your own people.
Considerations
  • In the pack's defaults the incident manager engages outside responders within the retainer, and the executive incident lead decides above it. Your own plan may split it differently.
  • Arrange the retainer or panel access before an incident, with the authority to engage it agreed. If your retainer firm is not on the insurer's panel, agree in advance whether the insurer will accept it.
  • Containment does not wait for outside help, for the insurer or for Legal's advice on how a firm is engaged.
  • If the incident may end in court, a claim or a police case, let outside responders take disk and memory images. Your job in the first hour is to destroy nothing and write down who touched what.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartAn incident is under way; do we need outside help?DecisionIs harm spreading faster than your responders can contain it?DecisionCould it end in court, a claim or a police case?DecisionIs recovery beyond what your own team can do?OutcomeHandle it in-house, and ask again at each updateDecisionDo you hold cyber insurance?StepTell the insurer and follow its panel conditionsStepBring Legal in alongside, without holding up the responseDecisionIs the work within an existing retainer?OutcomeThe incident manager engages them nowOutcomeThe executive incident lead decides, at once

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 11 steps.

  1. Start

    An incident is under way; do we need outside help?

    Outside responders are people who can start within agreed hours, without a new contract, when the incident is beyond your own team. The crisis team asks whether outside help is needed at every meeting, so the answer can change as the incident grows.

    In the pack

  2. Decision

    Is harm spreading faster than your responders can contain it?

    The ransomware playbook's rule: while it is still spreading, ask for outside responders if the technical responders cannot keep up. Tired responders with nobody to take over are another sign: the crisis team agenda asks about both in the same item. If you cannot tell, answer yes.

    In the pack

  3. Decision

    Could it end in court, a claim or a police case?

    If the incident might end in court, in a claim against a supplier or with the police, ask outside responders to take disk and memory images: they know how to keep them admissible. Memory capture needs training. Your job in the first hour is to destroy nothing and write down who touched what. If you cannot tell, answer yes.

    In the pack

  4. Decision

    Is recovery beyond what your own team can do?

    For example, the backups are damaged or cannot be trusted, and systems must be rebuilt from clean images while data is recovered from other sources. The ransomware playbook engages outside responders if needed at that point. If you cannot tell, answer yes.

    In the pack

  5. Outcome

    Handle it in-house, and ask again at each update

    Your own team and suppliers can run the response. Keep outside help on the crisis team agenda: whether it is needed is asked at every meeting, and a rise in severity is a good moment to ask again.

    In the pack

    See also

  6. Decision

    Do you hold cyber insurance?

    Many policies require the insurer to be told within a set time, and some pay only for the insurer's panel firms. Engaging others first can affect cover. If you do not know, find out before you engage anyone.

    In the pack

  7. Step

    Tell the insurer and follow its panel conditions

    Use the insurer's incident line; in the pack, the executive incident lead tells the insurer. Follow its instructions on its panel responders before engaging anyone else, where the policy requires it. If your own retainer firm is not on the panel, the pack advises agreeing in advance whether the insurer will accept it. Notice to the insurer does not wait for the investigation to finish.

    In the pack

  8. Decision

    Is the work within an existing retainer?

    A retainer lets a firm start within agreed hours on agreed terms. The pack's readiness check asks that a retainer or the insurer's panel is in place, with the authority to engage it agreed. If there is none, or the work goes beyond it, answer no.

    In the pack

  9. Outcome

    The incident manager engages them now

    Within the retainer, engaging outside responders is the incident manager's decision. Record it in the decision log with the time and the reason. The firm works under the incident manager's direction: it can advise and act, but declaration, severity, the reporting screen and the decisions stay with your own people.

    In the pack

  10. Outcome

    The executive incident lead decides, at once

    Beyond the retainer, engaging outside responders is the executive incident lead's decision. Take it to them now, with the reason. If they cannot be reached, go to the named deputy; meanwhile the incident manager keeps containing without waiting. Afterwards, arrange a retainer or panel access with the authority to engage it agreed, so the next incident does not start with a contract.

    In the pack

Practical checklist

  1. Ask at every crisis team meeting whether outside help is needed.
  2. Check whether harm is spreading faster than your responders can contain it, or they are tired with nobody to take over.
  3. Check whether the incident could end in court, a claim or a police case, and whether recovery is beyond your team.
  4. If you hold cyber insurance, tell the insurer through its incident line and follow its panel conditions.
  5. Bring Legal in alongside, without holding up containment.
  6. Engage within the retainer on the incident manager's decision, or take it to the executive incident lead at once if it goes beyond.
  7. Direct the firm's work, and keep declaration, severity, the reporting screen and the decisions with your own people.
  8. After the incident, arrange a retainer or panel access if you had none.

Evidence to have ready

  • The decision log entry for engaging outside help, with the time, who decided and the reason.
  • The insurer notification with its time and reference, and its instructions on panel firms.
  • The retainer or panel details: firm, contract reference, hours included, activation number and who may activate it.
  • The handling record for any evidence the outside responders collected.

Assumptions

  • You have a named incident manager and executive incident lead, and your technical responders may include a managed IT provider and a security monitoring provider.
  • The split of authority shown is the CISO Times incident pack's default. Your own plan may set a different one.

Not covered here