Chapter 5 of 12 · Before any incident
Q5: Who Decides What in the First 24 Hours?
- Who is in charge if we are attacked?
- When will the board be told?
In an incident, confusion about who decides costs more time than almost anything else. This is a question to settle while things are calm.
What you should hear
- One named incident lead, and a deputy.
- Who can decide to take systems offline, even if it stops trading.
- Who decides on outside help, legal advice and communication.
- When and how the board is told, and what threshold triggers that.
Red flags in the answer
- "It depends on the situation" with no named people.
- The plan relies on email or chat systems that may be down.
- The board has never agreed which decisions it wants to be part of.
The question you might not ask out loud
Should the board be involved in the response at all?
The board should not run the response. It should know who does, agree in advance which decisions come to it, such as paying a ransom or a major public statement, and make sure management has the authority to act fast on the rest.
Follow-up
"Show me the contact list you would use if email were down. When was it last checked?"
Why this matters: the first day of an incident sets the course for the weeks that follow. Systems are shut down or not, evidence is kept or lost, and the first message to staff and customers goes out. Those calls need clear owners who already know they own them.
Ask about deputies too. Incidents do not wait for holidays. If the incident lead or the CEO is unreachable, someone else must be able to decide without waiting.
Rule of thumb:Decide who decides before you need to decide.