Leading a major incident: incident command
In a major incident with many teams working at once you take command, keep a decision log, handle communication with legal, regulators, customers and the press, and close the incident without burning out the team.
Level 501 · 13 lessons · 12 practice labs
Lessons
Command structure
- The incident command system: commander, scribe, tech lead, comms
- Battle rhythm: status calls, shifts, handovers
- The decision log: what we decided, why, with what information
- Short task: write the command plan for the first two hours
Talking to the outside world
- Regulator notifications: GDPR’s 72 hours, NIS2 and other regimes
- Customer and press statements: accurate, timely, measured
- Working with outside experts, insurers and law enforcement
- Legal privilege and counsel-directed investigations
- Short task: draft the first customer notice
Closing out
- When an incident ends: closure criteria
- Protecting the team: fatigue, rotation and stress
- The incident report to the board
- Capstone: command a major incident in a live simulation
Practice labs
- Assign the command roles: Assign commander, scribe, technical lead and communications roles with duties in a team of eight.
- A command plan for the first two hours: Write a two-hour plan with status meeting interval, decision authority and first objectives.
- A shift and handover scheme: Define the shift roster, handover template and fatigue limits for an incident lasting three days.
- Write a decision log line: Record three decisions in the form what, why and on what information.
- Decide on incomplete information: Make the containment decision faced with two conflicting technical reports and write your assumptions.
- Define the closure criteria: Define with measurable criteria when the incident counts as over and apply them to a prepared status report.
- List the notification duties: Tabulate the deadlines and addressees under GDPR, NIS2 and other regimes for the breach in the scenario.
- Draft the first customer notice: Draft a measured, timely customer notice based on confirmed information.
- A plan for working with outside parties: Define the information-sharing limits for outside experts, insurer, law enforcement and a counsel-led investigation.
- A one-page summary for the board: Summarise the incident on one page under impact, status and matters needing a decision.
- Prepare answers to press questions: Write accurate, short and legally safe answers to five hard questions.
- Command a major incident in simulation: In the Yelkovan Bankası scenario make decisions against incoming injects, keep the log and write the closing report.
About this course
In a major incident with many teams working at once you take command, keep a decision log, handle communication with legal, regulators, customers and the press, and close the incident without burning out the team.
What you will learn
- Command structure
- Talking to the outside world
- Closing out
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.