Lesson 5.38: Running a major incident
In a major incident the technical work is only half the problem; the other half is coordination: who decides, who talks to executives and customers, who writes down what was decided and why. Emergency services solved this decades ago with the Incident Command System: one commander, clear roles, a decision log and a regular rhythm of updates. In the lab, five hours into a ransomware incident, you check Northwind's bridge against its playbook: two commanders, missing roles, decisions without owners and a gap in executive updates, then fix them.
17 min
You will learn to
- Explain the incident commander role
- Check a roster against required roles
- Find decisions without owner or rationale
- Measure the cadence of status updates
- Fix command structure during an incident
Key terms
- Incident commander
- The one person who owns the response and makes or delegates decisions.
- Incident Command System (ICS)
- A public emergency-management model of roles and command, widely adapted for IT incidents.
- Scribe
- The person who records events and decisions in real time.
- Bridge
- The shared call or channel where the response is coordinated.
- Cadence
- The fixed interval of status updates.
← Legal hold and evidence handling · All lessons · Assessing a high-risk AI system →