Chapter 9 — Response leadership and assurance decisions | Postgraduate Incident response and cyber resilience

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes and connection"]
  N1["9.1 The leadership gap after containment"]
  N2["9.2 Assurance claims"]
  N3["9.3 Briefing structure"]
  N4["9.4 Closure conditions"]
  N5["9.5 Delegation and residual risk acceptance"]
  N6["9.6 Review cadence"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes and connection"]
  N1["9.1 The leadership gap after containment"]
  N2["9.2 Assurance claims"]
  N3["9.3 Briefing structure"]
  N4["9.4 Closure conditions"]
  N5["9.5 Delegation and residual risk acceptance"]
  N6["9.6 Review cadence"]
  N7["Chapter synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]

[Learning outcomes and connection]
    |
    v
[9.1 The leadership gap after containment]
    |
    v
[9.2 Assurance claims]
    |
    v
[9.3 Briefing structure]
    |
    v
[9.4 Closure conditions]
    |
    v
[9.5 Delegation and residual risk acceptance]
    |
    v
[9.6 Review cadence]
    |
    v
[Chapter synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes and connection

You will be able to (1) brief executives and boards with fact-limited statements before root cause is known; (2) make and record assurance claims with their basis; (3) define measurable closure conditions; (4) set a review cadence; and (5) accept or escalate residual risk at the right level. Chapters 1–8 built decisions, structure and evidence; this chapter is about leading with them upward.

9.1 The leadership gap after containment

After containment, pressure shifts: executives want to know "are we safe?", "who did it?", "what will it cost?" — often before the investigation can answer. Leaders who over-promise ("we are fully secure") create reputational and legal risk; leaders who say nothing lose trust and control of the narrative. The specialist provides fact-limited briefings that are useful without being speculative.

Calder's Day 3 briefing found that balance: it said no attacker activity had been seen in 40 hours, and also that how the attacker first got in was not yet known.

9.2 Assurance claims

An assurance claim is a statement that a property holds ("the adversary no longer has access to our identity platform") with a basis (tests, evidence, coverage) and a confidence. Assurance cases in safety engineering structure claims, arguments and evidence (for example Goal Structuring Notation). For incidents, a simple table suffices: claim, evidence, coverage gaps, confidence, owner. Never make an assurance claim whose evidence you cannot show.

Calder's Day 3 table has such a row: the claim "no attacker access to identity platform" rests on no authentications with old credentials, no new federation trusts or consents in 40 hours and tested monitoring rules, with the unknown initial access route as the stated gap and moderate confidence.

9.3 Briefing structure

For executives: bottom line (one sentence), what we know (with confidence), what we don't know yet (and when we expect to), what we have done, decisions needed from you, risks to watch, next briefing. Keep technical detail in an appendix. For boards: add implications for strategy, regulation and oversight duties, and the residual risks they are being asked to accept.

Calder's Day 3 briefing follows this order. Its bottom line is one sentence; the payment-systems claim carries moderate confidence because logs earlier than 30 days were unavailable; and its two decisions are funding phishing-resistant MFA for administrators and accepting residual risk of undiscovered persistence until the monitoring period ends.

9.4 Closure conditions

An incident should close when measurable conditions are met, not when attention fades. Typical conditions: containment verified for a defined period with monitoring; eradication tests passed; recovery accepted by owners; notifications completed; evidence preserved; corrective actions assigned with owners and dates; post-incident review scheduled. Residual risks transferred to the risk register.

Calder's identity incident set its conditions in advance: 30 days without re-entry indicators; initial access identified and remediated, or documented as unknown with compensating controls; mailbox exposure determined and notifications completed; corrective actions assigned; and a review held. The second condition admits that an answer may never come.

9.5 Delegation and residual risk acceptance

Residual risk must be accepted by someone with authority proportional to its size. Define in advance which levels accept what (for example, the CISO up to a threshold; the executive committee above it; the board for risks affecting strategy).

At Calder, the residual risk that undiscovered persistence exists until the 30-day monitoring period ends was put to the executive committee in the Day 3 briefing, not accepted by the incident commander, because it affected the whole group's identity platform. A lower-impact risk, such as a single division's delayed log review, would sit within the CISO's threshold.

9.6 Review cadence

After closure: 30-day check of monitoring results and corrective actions; 90-day review of effectiveness; inclusion in quarterly risk reporting.

For Calder's identity compromise, the 30-day check coincides with the end of the re-entry monitoring period set in the closure conditions. It asks whether any indicator fired and whether phishing-resistant MFA for administrators has been funded and deployed as decided on Day 3. The 90-day review asks whether the corrective actions worked: whether the initial access route has been found or documented as unknown with compensating controls. Quarterly risk reporting keeps the accepted residual risk visible until it is retired.

9.7 Worked example (synthetic): executive briefing before root cause

Fictional. Day 3 of the Calder identity compromise (Chapter 5). Containment executed Saturday; root cause (how the domain admin credential was first obtained) not yet established.

Briefing (excerpt): - Bottom line: We removed all known attacker access on Saturday and have seen no attacker activity in the 40 hours since; we do not yet know how the attacker first got in. - Known (confidence): Attacker accessed executive mailboxes via a malicious app for 6 days (high); attacker held domain and cloud admin rights (high); no evidence of access to payment systems, which are separately managed (moderate — logs reviewed for 30 days; earlier logs unavailable). - Not yet known: initial access route (expected within 5 days from forensic firm); full list of mailbox items read (expected 48 hours). - Done: containment in one window; 300 users reset; monitoring for re-entry in place. - Decisions needed: approve funding for phishing-resistant MFA for all administrators (€X, 6 weeks); accept residual risk that undiscovered persistence exists until the 30-day monitoring period ends. - Next briefing: Thursday 08:00.

Assurance table (excerpt): Claim "no attacker access to identity platform" — evidence: no authentications with old credentials, no new federation trusts or consents in 40 hours, monitoring rules tested — gaps: unknown initial access route — confidence: moderate — owner: identity workstream lead.

Closure conditions: 30 days without re-entry indicators; initial access identified and remediated or documented as unknown with compensating controls; mailbox exposure determined and notifications completed; corrective actions assigned; review held.

9.8 Common errors and limits

"We are secure" without basis.
Closing when attention fades rather than when conditions are met.
Residual risk accepted by whoever is in the room.
Technical detail crowding out decisions in executive briefings.

Calder's Day 3 briefing avoids each error. It never says "we are secure"; it says no attacker activity has been seen for 40 hours, with an assurance table behind the claim. Closure waits for the 30-day conditions. The residual risk of undiscovered persistence goes to the executive committee as a decision. Technical detail stays in the appendix, and the decisions needed are listed on the first page.

Exercises — chapter 9

Attempt each exercise before opening the worked results. Every case, organization, person, address and number in an exercise is synthetic unless a cited public source is named.

EX041 — Rewrite a briefing. Inputs: "The hackers are gone. Our team did an amazing job. We think it was a nation-state." Steps: rewrite as a fact-limited executive briefing. Rubric: 3 = the briefing structure taught in this chapter, claims with confidence, no attribution speculation, decisions requested; 2 = structure partly; 1 = minor edits; 0 = none.

EX042 — Assurance table. Steps: write three rows of an assurance table for the end of a ransomware recovery. Rubric: 3 = claims with evidence, coverage gaps, confidence and owner; 2 = missing gaps; 1 = claims only; 0 = none.

EX043 — Closure conditions. Steps: write closure conditions for a business email compromise that caused a fraudulent payment. Rubric: 3 = account containment verified, mail rules removed, payment recovery status, bank and law-enforcement reports, supplier verification controls, notifications, corrective actions; measurable; 2 = five; 1 = vague; 0 = none.

EX044 — Risk acceptance matrix. Steps: design a matrix that assigns residual-risk acceptance authority by impact level. Rubric: 3 = levels with criteria and accepting roles, review periods; 2 = levels without criteria; 1 = one role; 0 = none.

EX045 — Board paper. Steps: write a 200-word board paper section on the Calder incident's residual risks and requested decisions. Rubric: 3 = oversight framing, residual risks with likelihood/impact, decisions, timeline for assurance; 2 = operational detail dominates; 1 = narrative; 0 = none.

Chapter synthesis

Lead upward with fact-limited briefings, evidence-backed assurance claims, measurable closure conditions, residual risk accepted at the right level and a review cadence that outlasts the incident's attention span.