An incident response team (IRT) is a cross-functional group that executes the incident response plan and coordinates incident management. It brings together IT, legal, communications, executive management, and, when needed, external partners. Clear responsibilities, backup personnel, and multiple communication methods help the team continue operating during disruption. section 9.2
Effective IRT preparation includes:
- Scope the response plan around critical business functions, important data, likely effects, and regulatory requirements. section 9.2
- Assign each member defined responsibilities, at least three communication methods, and a fallback person. section 9.2
- Use training and simulated exercises to verify that employees understand the plan and can act quickly. section 9.2
Tabletop breach exercise
A cybersecurity firm tests its IRT against unusual traffic from a server containing customer financial data and personally identifiable information. The exercise progresses from breach confirmation and containment to ransomware escalation and a journalist’s inquiry. Participants decide who to notify, how to handle encrypted data, and how to coordinate internal, external, and public communications. section 9.3.1
