Incident Command Roles: Who Does What
Every cyber incident needs six roles and a designated backup for each. Miss any of them and you will discover the gap at the worst possible moment. These roles come from 150+ real tabletop exercises and what actually held up under pressure.
Cyber incident command borrows from the Incident Command System (ICS) used in emergency management, but adapted for the specific demands of a cyber event — privilege, regulatory clocks, and executive-level decision authority. Unlike a physical emergency, a cyber incident requires legal, financial, and communications decisions before the technical picture is complete. That changes the org chart. For the overall framework see the 2026 Incident Response Playbook.
1. Incident Commander (IC)
Owns: Decisions, timeline, and accountability. The single point of authority during the incident.
Not necessarily: The most senior person, the CISO, or the best engineer.
Selection criteria: Calm under pressure, comfortable making decisions with incomplete information, trusted by executives to act. Often the best IC is a senior director, not the CISO — because the CISO needs to be free to brief the board.
Rotation: On anything longer than 8 hours, ICs rotate. Fatigue is the most common cause of bad decisions.
2. Scribe
Owns: The defensible record. Every decision, every notification, every timestamp, every handoff.
Why it is a dedicated role: If the same person who is making decisions is writing them down, they will not. The scribe is the reason the post-incident record holds up under regulatory and legal scrutiny.
Tooling: Inside IR-OS, the scribe writes directly into the hash-chained event ledger. Outside IR-OS, this role is typically performed in a shared document that will later be reconstructed into a timeline — a far less defensible approach. See the defensible record.
3. Communications Lead
Owns: Internal comms, customer comms, media comms, and board comms. Drafts every externally-facing statement.
Critical rule: Nothing goes out without Comms Lead drafting and Legal reviewing. Not a tweet, not a status page update, not a customer email. The number of incidents that spiraled because a product manager tweeted an apology cannot be overstated.
Pre-written templates: Comms Leads maintain a library of draft statements — "we are investigating," "we have contained," "we have notified" — that can be edited in minutes instead of drafted from scratch.
4. Legal Liaison
Owns: Privilege, notification decisions, regulator contact, law enforcement contact.
Typically: The General Counsel or a designated privacy/cyber attorney, working hand-in-glove with outside counsel for privilege.
Why outside counsel matters: Attorney-client privilege over forensics work is strongest when the forensics firm is engaged by outside counsel, not directly by the company. Plan this in advance.
Decisions owned: Whether to notify the SEC (Item 1.05), GDPR DPAs (Article 33), state AGs, HHS OCR, affected data subjects, law enforcement.
5. Technical Lead
Owns: Technical direction of containment, forensics, eradication, and recovery.
Not: The Incident Commander. These roles must be separated, because the Technical Lead is deep in the forensic weeds and the IC needs to stay focused on timelines, decisions, and stakeholders.
Coordinates with: The DFIR firm (often the panel firm from the cyber insurer), internal security engineers, and platform/infrastructure teams.
6. Executive Sponsor
Owns: Unblocking resources, approving cross-functional action, briefing the board.
Typically: The CEO, COO, or CIO. On large incidents, often the CEO becomes the Executive Sponsor by default.
Decisions owned: Shutting down production systems, engaging outside counsel, approving ransom payment (in consultation with Legal, CFO, and insurer), approving public statements.
Critical boundary: The Executive Sponsor does not run the incident. The IC runs the incident. The Executive Sponsor unblocks it.
Backups for Every Role
Every named role must have a named backup, trained to the same level. Incidents happen during vacations, board meetings, and family emergencies. A role without a backup is a single point of failure in your response plan.
Training Before You Need Them
Roles are muscle memory. They are built through tabletop exercises, not through reading a RACI document. Our guide to running the exercises is at how to run a C-Suite tabletop. At minimum, every named role and every backup should have participated in at least one tabletop in the last 12 months.
Train these roles inside IR-OS
Every IR-OS scenario assigns the six roles, tracks their actions, and produces a per-role after-action debrief.
Start free