Chapter 2 — Current practice in enterprise incident command
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes and connection"]
N1["2.1 Why command structures"]
N2["2.2 The commander's role"]
N3["2.3 Functional sections"]
N4["2.4 Conflicting reporting lines"]
N5["2.5 Information cadence"]
N6["2.6 Delegation and thresholds"]
N7["2.7 Handoffs and fatigue"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes and connection"]
N1["2.1 Why command structures"]
N2["2.2 The commander's role"]
N3["2.3 Functional sections"]
N4["2.4 Conflicting reporting lines"]
N5["2.5 Information cadence"]
N6["2.6 Delegation and thresholds"]
N7["2.7 Handoffs and fatigue"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX006"]
[Learning outcomes and connection]
|
v
[2.1 Why command structures]
|
v
[2.2 The commander's role]
|
v
[2.3 Functional sections]
|
v
[2.4 Conflicting reporting lines]
|
v
[2.5 Information cadence]
|
v
[2.6 Delegation and thresholds]
|
v
[2.7 Handoffs and fatigue]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes and connection
You will be able to (1) design an incident-command structure that works across divisions with conflicting reporting lines; (2) define the commander's authority, delegation and information cadence; (3) build a handoff protocol that survives shift changes and fatigue; and (4) stress-test a command charter against realistic failure points. Chapter 1 established how individual decisions are framed; this chapter places them inside an organization. Chapter 5 uses the structure to coordinate containment.
2.1 Why command structures
Large incidents fail more often from coordination than from technical ignorance. The Incident Command System (ICS), developed for wildfire response in the United States in the 1970s and embedded in the National Incident Management System (NIMS), introduced principles that transfer well: a single incident commander, unity of command (each person reports to one supervisor in the incident), manageable span of control (roughly three to seven direct reports), modular expansion, common terminology and a written incident action plan per operational period. Cyber incidents adapt these principles rather than copy the full structure.
2.2 The commander's role
The incident commander owns the incident: sets objectives, approves the action plan, makes or delegates decisions within pre-approved thresholds (Chapter 1) and escalates the rest. The commander is not the best technician; doing hands-on analysis is a common failure because it consumes attention needed for coordination. A deputy shares load and provides continuity.
Calder's charter enforces this: the group incident commander comes from a pre-approved roster of six trained people, with a deputy, and divisional CIOs sit in the command meeting as business liaisons rather than directing technical work themselves.
2.3 Functional sections
A typical enterprise cyber structure: Operations (technical investigation, containment, recovery — often split into workstreams), Planning (situation status, timeline, action plan, documentation), Communications (internal, customers, media, regulators via legal), Legal and privacy (advice, notification analysis, privilege), Business liaison (division leaders, service owners), and Logistics (people, tools, external retainer firms, rest rotations). In smaller incidents one person may hold several functions; the roles still exist.
At Calder, Planning maintains the incident record and the situation reports, and Business liaison is where the three divisional CIOs sit. A commander with eleven people reporting directly can regroup them into these six sections plus a deputy, which is the exercise this chapter sets.
2.4 Conflicting reporting lines
In enterprises, people in the incident report to divisional managers outside it. Unity of command during the incident must be agreed in policy: for the incident's duration, participants take incident tasking from the incident structure, while their line managers retain HR authority. Divisional leaders join as liaisons, not as parallel commanders. Without this agreement, the most senior person in the room becomes the de facto commander regardless of competence.
Calder learned this from a previous incident: three CIOs each ordered containment in their own divisions, and one isolated a shared directory server, breaking authentication for the other two. The group CISO was informed but not in command. The charter now states that divisional CIOs cannot order containment on shared services.
2.5 Information cadence
Set a battle rhythm: fixed times for situation updates (for example every 2 hours for the core team, every 6 for executives), a standard situation report format (facts, assessment, actions, decisions needed, next update), and a single source of truth (case record or shared document) that Planning maintains. Ad hoc requests for updates are redirected to the next scheduled update unless a decision is pending.
Calder's charter sets this rhythm: a 15-minute core sync every 2 hours in a standing format, an executive brief at 08:00 and 18:00, and Planning maintaining the single incident record. When a division head asks for an extra update mid-afternoon, the answer is the 18:00 brief, unless a decision she owns is waiting.
2.6 Delegation and thresholds
Delegate decisions with explicit bounds: "Operations lead may isolate any non-production host; production isolation requires commander approval unless the Chapter 1 threshold applies." Record delegations so that responsibility is clear in review.
Calder's charter writes its bounds the same way: Operations may contain within a single division's non-shared assets, while shared services such as identity, network core and email need the commander's approval. That rule is what would have stopped one CIO isolating the shared directory server in the earlier incident. Delegations made during an incident go into the decision log with the time and the person delegating, so a later review can see who had authority to act and when.
2.7 Handoffs and fatigue
Long incidents need operational periods (for example 12 hours) with formal handoffs. A handoff includes: current objectives, situation summary, active workstreams and owners, pending decisions, recent decisions and their reasons, risks and watch items, and contacts. The incoming commander reads back the key points. Fatigue degrades judgement; schedule rest deliberately, including for leaders.
Calder's stress test found the gap this list guards against: at the 19:00 shift change, the incoming commander found a pending decision, whether to force-reset all Logistics passwords, with no record of why it had been deferred. The handoff template now requires the options, the reason for deferral and the deadline. Commanders may serve at most two consecutive 12-hour periods.
2.8 Worked example (synthetic): a multi-division charter
Fictional. Calder Group has three divisions — Retail, Logistics and Financial Services — each with its own IT team and CIO, plus a group security team. A suspected identity-provider compromise affects all three.
Problem observed in a previous incident (fictional): three CIOs each ordered containment in their divisions; one isolated a shared directory server, breaking the others' authentication. The group CISO was "informed" but not in command.
Charter (excerpt): - Activation: group security duty manager declares a group incident when more than one division is affected or a shared service is involved. - Command: group incident commander from a pre-approved roster of six trained people (two per region), with a deputy. Divisional CIOs serve as business liaisons and sit in the command meeting; they cannot order containment on shared services. - Thresholds: Operations may contain within a single division's non-shared assets; shared services (identity, network core, email) need commander approval. - Cadence: core sync every 2 hours (15 minutes, standing format); executive brief at 08:00 and 18:00; Planning maintains the incident record. - Handoff: 12-hour periods at 07:00 and 19:00; written handoff with read-back; commanders may not serve more than two consecutive periods.
Stress test — shift change at 19:00 during active containment: the incoming commander finds a pending decision (whether to force-reset all Logistics passwords) without the context of why it was deferred. Fix: pending decisions in the handoff must include options, the reason for deferral and the deadline. The test also reveals that the deputy roster lacks coverage for weekends in one region — a logistics action.
2.9 Common errors and limits
- The commander doing technical work.
- Divisional leaders acting as parallel commanders.
- Updates on demand instead of on a rhythm.
- Handoffs without pending decisions and their reasons.
- Copying ICS terminology without the training and exercises that make it work.
Calder's charter answers each error in turn. The commander comes from a trained roster and does not take hands-on work. Divisional CIOs act as liaisons, not parallel commanders, and cannot order containment on shared services. A fixed sync and briefing rhythm replaces updates on demand. Handoffs must carry pending decisions with their reasons. The roster itself was tested in an exercise, which is how the weekend coverage gap in one region was found.
Exercises — chapter 2
Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.
EX006 — Span of control. Inputs: a commander has 11 direct reports. Steps: restructure to a manageable span and justify. Rubric: 3 = groups into sections (operations, planning, communications, legal/privacy, liaison, logistics) with leads, 4–6 direct reports; 2 = reduces span without logic; 1 = unchanged; 0 = none.
EX007 — Unity of command clause. Steps: write the policy clause that resolves conflicting reporting lines during incidents. Rubric: 3 = incident tasking authority, line-manager retention of HR authority, liaison role for divisional leaders, dispute escalation path; 2 = partial; 1 = vague; 0 = none.
EX008 — Situation report. Inputs: this chapter's multi-division charter worked example, at 14:00. Steps: write a one-page situation report in the standard format. Rubric: 3 = facts with sources, assessment with confidence, actions with owners, decisions needed with deadlines, next update; 2 = missing decisions; 1 = narrative; 0 = none.
EX009 — Handoff template. Steps: design a written handoff template with read-back items. Rubric: 3 = objectives, situation, workstreams/owners, pending decisions (options, reason for deferral, deadline), recent decisions with reasons, risks, contacts, read-back of top three; 2 = misses pending decision detail; 1 = list of notes; 0 = none.
EX010 — Stress test plan. Steps: design a 60-minute exercise that stress-tests the charter against a shift change and an absent deputy. Rubric: 3 = objectives, injects at handoff and deputy absence, observable criteria, observers, corrective-action capture; 2 = injects without criteria; 1 = generic; 0 = none.
Chapter synthesis
Enterprise command needs one commander with trained deputies, sections with clear leads, unity of command agreed in policy, a fixed information rhythm, bounded delegation and handoffs that carry pending decisions and their reasons — tested under shift change and absence.
Continue studying — chapter 02 of 12
← Chapter 01 · Course chapter index · Chapter 03 →
Continue to the next authored lesson.