Incident Response and Crisis Management
Technical response inside a crisis system
The exam tests whether you can run incident response as a disciplined lifecycle while a crisis team manages business, legal, and communication decisions. NIST SP 800-61 describes preparation; detection and analysis; containment, eradication, and recovery; and post-incident activity. Crisis management adds strategic direction, prioritization, stakeholder communication, and decision logging. The two must be linked by clear escalation and declaration criteria.
Core rules
- Preparation includes severity matrices, declaration authority, playbooks, contact lists, out-of-band communication, forensic kits, and pre-approved legal and regulatory contacts.
- Detection and analysis: triage alerts, confirm scope, preserve evidence, and open an incident log with timestamps and decisions. Do not let containment destroy forensic value without a documented tradeoff.
- Containment options include isolating network segments, disabling accounts, blocking indicators, and powering down only when necessary. Eradication removes persistence; recovery restores trusted systems and validates them.
- Crisis roles: incident commander, operations lead, communications lead, legal and privacy lead, business continuity lead, and executive sponsor. Use a battle rhythm-scheduled briefings and a single source of truth.
- Communications must cover employees, customers, regulators, insurers, and law enforcement as required. Privacy and breach notification clocks may start at awareness, not confirmation.
Worked example
A hospital detects ransomware on a clinical workstation. The incident commander declares a severity 1 incident, isolates the affected VLAN, and activates downtime procedures for medication ordering. The crisis team meets at 30-minute intervals, legal assesses notification duties, and communications releases a holding statement. Forensics images the workstation before rebuild. Recovery restores from an immutable backup, validates clinical data, and rotates credentials. A decision log records why the network was segmented and when regulators were called.
Traps
Do not run a crisis as a purely technical bridge call. Do not delay legal and privacy involvement until recovery. Do not destroy logs or memory by rebooting without a forensic decision. Do not use unclear declaration authority or ad hoc communication. Do not forget business continuity workarounds while IT recovers.