Separate availability of a person from authority to decide | Professional Incident response and cyber resilience

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Day 3 — Separate availability of a person from authority to decide

Learning decision. A contact directory is useful only if the contacted role can make the required decision for this scope and time. Split four powers: request an action; approve access to evidence; approve disruption to service; perform the approved action. A single person may hold several powers under a real policy, but the case record must say which power was exercised and under which rule. C01 names neither an after-hours identity alternate nor a service-owner fallback. A learner cannot fill those blanks by guessing who is on call.

Use a minimal decision gate before any controlled rehearsal: (action, target, environment, window, purpose, approver role, operator role, evidence to record, stop condition). The tuple is a teaching aid. A right to view an IdP dashboard does not imply permission to export detailed events, and an export permission does not imply permission to revoke a session. The same separation applies when urgency rises later in Chapter 2. The NIST incident-response recommendations support planned response capability; they do not issue tenant-specific delegations to a learner.

Worked example. In W1 at a synthetic 02:00 shift, suppose the analyst needs to confirm whether detailed IdP session fields can be obtained before a hypothetical source becomes unavailable. The primary identity custodian is unreachable; C01 has no alternate. The analyst may prepare a bounded request and record the contact failure. They may not ask a convenient administrator to use their credential, infer permission from read-only access, or perform a disruptive session reset. The incident lead can route the missing authority question to the organization's actual escalation mechanism if one exists; where no route is documented, status remains awaiting authorized path. This records a service-readiness defect without accusing anyone of causing an incident.

Make the negative path explicit. If an approved alternate exists but can only authorize data collection, that still leaves session revocation gated. If the service owner can approve a pause but no operator is available, the pause is approved but not executed. If an operator reports execution, the next record is verification of effect and service impact; do not convert the operator's statement into measured containment. Separating these states prevents a generic “handled” label from hiding missing evidence.

Practice. Complete EX003 as a role and alternate matrix. For identity export, session restriction and service-outage tolerance, name the distinct requested decision, approval source, operator and exact unknown if the primary is absent. Compare with its worked answer. Limit: this public example supplies no real organization policy or emergency delegation. Previous: Day 2 · Week index · Next: Day 4.

Exercise for this lesson

EX003 — Owner escalation. Input: C01 has no after-hours identity alternate or service-owner fallback. Write a role-based primary/alternate matrix and the exact unanswered decision if each is unavailable. No personal contacts may be invented. A 2-point result distinguishes collection permission from disruptive-action approval.

EX003 — Model escalation matrix. Identity export: primary identity custodian, alternate missing in C01, response lead can request but cannot appoint an unauthorized substitute. Account/session restriction: identity owner plus service owner/emergency-change approver decide scope; an authorized identity operator executes; fallback approval route not supplied. Service-outage tolerance: service owner decides; after-hours delegate missing. Case coordination: incident lead records the owner gap and escalates through the organization's actual supervisor process if available. The unanswered decision is who can approve time-sensitive identity collection or disruption when the primary is absent. A plan that names a made-up person or treats the analyst as approver loses the boundary point.

Additional worked reasoning (EX003 — Missing authority is an explicit finding.): The identity custodian may have delegated evidence-export rights but the identity owner separately decides about session/account restrictions under the applicable plan. With the alternate and service-owner fallback unlisted, the correct cells are unknown/await approved escalation, not invented names. The incident lead can record contact attempts and seek organizational authorization; the analyst may not create an emergency power. An outcome that names a responsible role but leaves the authorization source undefined is incomplete, not approved.

Week 1 Day 3 extension — worked result. A role matrix can say: “IdP detail: analyst requests, identity custodian/data owner approves under actual policy, authorized custodian exports, incident lead records; after-hours alternate not supplied in C01.” For session restriction, use a separate identity/service-owner decision and an identity operator; neither the export approval nor the analyst's request covers that action. For service-outage tolerance, name the service owner and mark the fallback not supplied. At 02:00, an unreachable primary changes the route to pending authorized escalation, not to approved by urgency. Two points require this separation and an explicit blocked decision for each missing alternate.