Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Who decides what during a crisis, and who stands in when they cannot?

3 decision pointsThe pack behind this answer: Cyber Resilience & Recovery

Add to board memo

The short answer

Recommendation
Write down before a crisis a short list of decisions, each with one person accountable and a named deputy. Keep the incident response plan's decision rights exactly as it sets them, and let the deputy decide when the first holder cannot act in time.
Reasoning
In a crisis, two people deciding the same thing is as harmful as nobody deciding. The crisis lead takes the recovery decisions, and every incident decision stays where the incident response plan puts it. In a cyber incident the crisis lead is also the executive incident lead, so recovery and the incident have one leader. Crises happen at night, during holidays and to the people who would lead the response, so a deputy who has practised can step in.
Considerations
  • Only the board or its equivalent decides on a ransom: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. That decision never moves lower.
  • Waiting for an executive is never a reason to let harm spread. The incident manager isolates at once, and may stop a customer-facing service first where waiting would let harm spread.
  • No one is the first holder of two roles that must act in the same hour. Where one person holds several roles, each needs a different deputy.
  • By the pack's default, the deputy decides if the crisis lead cannot be reached within 30 minutes, the time the incident plan gives for reaching the executive incident lead in a Severity 1 incident.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA decision is needed during a crisisDecisionWhich kind of decision is it?OutcomeOnly the board or its equivalent decides; it never moves lowerStepThe incident manager decides, at onceStepThe executive incident lead decidesStepThe incident manager decides; the technical lead recommendsStepThe crisis lead decidesDecisionCan the first holder act now, and in no other first-hour role?OutcomeThe first holder decides and the crisis log records itDecisionIs a deputy named, and can they be reached?OutcomeThe deputy decides and records that they acted as deputyOutcomeTake it to the crisis lead; name a deputy after the crisis

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 12 steps.

  1. Start

    A decision is needed during a crisis

    In a crisis, two people deciding the same thing is as harmful as nobody deciding. Set out in advance who answers for each decision, who does the work, and who stands in. In a cyber incident the continuity decisions sit beside the incident response plan's decision rights, which this flow quotes unchanged.

    In the pack

  2. Decision

    Which kind of decision is it?

    The pack's matrix lists 19 activities, each with exactly one role accountable, and its first-hours card picks out nine decisions. This flow groups those into five kinds. If a decision fits none of them, find it in your own matrix before anyone acts on it.

    In the pack

  3. Outcome

    Only the board or its equivalent decides; it never moves lower

    That is the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. The incident plan adds: never before legal advice (including sanctions checks), the insurer's view and a report to law enforcement, and the plan assumes you do not pay. In the pack's example, if the board cannot meet, its chair calls an extraordinary meeting.

    In the pack

    See also

  4. Step

    The incident manager decides, at once

    The incident plan gives isolation to the incident manager, using the least disruptive containment that stops the harm. Before any action that would stop a service people depend on for safety or essential operations, the service owner and specialists are brought in. Waiting for an executive is never a reason to let harm spread.

    In the pack

    See also

  5. Step

    The executive incident lead decides

    In a cyber incident the executive incident lead is the crisis lead. The incident plan lets the incident manager stop the service first where waiting would let the harm spread, and report it at once. Where people depend on the service for safety or essential operations, its owner and specialists are brought in first.

    In the pack

    See also

  6. Step

    The incident manager decides; the technical lead recommends

    The incident manager decides restore or rebuild, chooses each recovery point and approves each system's return to production. The technical recovery lead recommends and does the work. A system returns only after its business owner has tested the service and confirmed it works.

    In the pack

    See also

  7. Step

    The crisis lead decides

    The crisis lead declares the crisis, invokes each service's continuity plan, sets the recovery order and target times, answers for what staff, customers and the public are told, and declares the end of recovery. The business owner starts the service's workaround. The crisis lead and the incident manager are two different people, even in a small organisation.

    In the pack

    See also

  8. Decision

    Can the first holder act now, and in no other first-hour role?

    No one is the first holder of two roles that must act in the same hour. A holder who cannot be reached within the time the incident plan sets cannot act: for a Severity 1 incident, the crisis team is convened within 1 hour. The recovery plan template calls the deputy if a role holder is not reached within 30 minutes, and if that is the crisis lead, the deputy decides whether to invoke the plan. If you cannot tell, take the cautious branch.

    In the pack

  9. Outcome

    The first holder decides and the crisis log records it

    Record the decision in the crisis log with its time, who took it and why, whether or not it turned out to be right, as the incident plan does for its own decisions. The resilience coordinator keeps the crisis log beside the incident plan's case log.

    In the pack

  10. Decision

    Is a deputy named, and can they be reached?

    Every crisis and recovery role should have a named deputy, by name or post, never a team, with an out-of-hours contact. A deputy still shown as a placeholder is not named. Where one person must hold several roles, each needs a different deputy.

    In the pack

  11. Outcome

    The deputy decides and records that they acted as deputy

    The deputy acts with the holder's rights and is bound by the same rules. The first holder takes over again only after a handover recorded in the crisis log. A deputy is ready only if they have practised: by the pack's default every holder and deputy takes part in an exercise at least every 24 months, and at least one exercise declares the first holders unavailable so the deputies decide.

    In the pack

    See also

  12. Outcome

    Take it to the crisis lead; name a deputy after the crisis

    A role with no deputy means nobody can act when the holder cannot. Take the decision to the crisis lead, who says who acts, and log it; if it is the crisis lead's own decision, your plan should say who steps in, since the pack assumes every role has a deputy. Afterwards, name the missing deputy and put them in the next exercise. The readiness report names each role without one.

    In the pack

    See also

Practical checklist

  1. List the crisis decisions, with one role accountable for each, taking the incident plan's decision rights unchanged.
  2. Name a first holder and a deputy for every role, by name or post, with an out-of-hours contact.
  3. Check that nobody is the first holder of two roles that must act in the same hour.
  4. Keep the contact list where it can be reached when email, chat and desk phones are down.
  5. Call the deputy when a holder cannot be reached in the time your plan sets, and have them record that they acted as deputy.
  6. Record each decision in the crisis log with its time, who took it and why.
  7. Hand back to the first holder only through a handover recorded in the crisis log.
  8. Put every holder and deputy in an exercise at least every 24 months by the pack's default, including one where the deputies decide.

Evidence to have ready

  • The responsibility matrix, with one accountable role for each decision and a named deputy for each role.
  • The offline contact list for holders and deputies, with the date it was last checked.
  • The crisis log, showing each decision, its time, who took it, why, and any deputy acting or handover.
  • Exercise records showing each holder and deputy took part, and any exercise where the deputies decided.
  • Readiness reports naming any role without a deputy.

Assumptions

  • You have an incident response plan that names an incident manager and an executive incident lead, and they are two different people.
  • You know who your top approver is: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board.
  • Contact details for every holder and deputy can be reached when email, chat and desk phones are down.

Not covered here