Incident roles and authority
Define who activates the plan, who leads response, who makes operational decisions, who approves communications, and who coordinates outside support.
Incident Response Planning
Prepare before a cyber incident becomes an operational crisis.
Systems Risk Advisory helps utilities, local governments, and critical infrastructure organizations build incident response plans that address cyber events, ransomware, OT disruption, vendor compromise, communications, continuity, and recovery decisions.
Why it matters
Cyber incidents create operational decisions, not only technical tasks.
During a cyber incident, leaders need to know who has authority, who must be contacted, what systems can be isolated, how operations continue, how public communication will work, and how recovery will be validated before systems return to service.
For utilities and critical infrastructure organizations, incident response planning must account for essential services. A plan that only addresses IT restoration may miss SCADA visibility, remote access, vendor support, manual operations, regulatory notifications, public messaging, and continuity of operations.
Built for infrastructure operations
Systems Risk Advisory develops incident response plans and playbooks that connect cybersecurity response with operations, OT/ICS, emergency management, executive decision-making, and recovery priorities.
Questions this service helps answer
Know what happens when the incident starts.
Incident response planning should remove uncertainty before pressure is high. The plan should help staff and leaders act even when information is incomplete.
- Who has authority to declare an incident and activate the response team?
- Who contacts IT, OT, leadership, legal, insurance, law enforcement, regulators, and vendors?
- What systems can be isolated without disrupting essential operations?
- How will the organization operate if email, phones, SCADA visibility, or business systems are unavailable?
- How will staff preserve evidence while still protecting operations?
- What public messaging and internal communications are needed?
- How will backups, restoration, and system return-to-service be validated?
- How will lessons learned become updates to plans, procedures, controls, and exercises?
Core planning areas
What we develop or review
Each engagement is scoped to the organization. The goal is a plan people can use, not a binder that stays on a shelf.
First 24 hours playbook
Build practical steps for early triage, escalation, containment, communication, documentation, and continuity during the first day of a cyber incident.
Ransomware readiness
Address isolation decisions, backup checks, payment decision support, insurance coordination, legal coordination, public messaging, and phased recovery.
OT and SCADA impacts
Plan for loss of visibility, remote access shutdown, vendor support limits, engineering workstation concerns, manual operations, and safe return-to-service.
Containment and isolation
Clarify what may be disconnected, who can approve isolation, what dependencies must be considered, and how containment affects operations.
Communications and reporting
Prepare internal notifications, executive updates, governing body briefings, public information coordination, regulatory contacts, and partner notifications.
Backup and recovery coordination
Review restoration priorities, backup protection assumptions, recovery dependencies, validation steps, and decision points before systems return to use.
Vendor and third-party support
Identify vendor contacts, support paths, remote access practices, emergency access decisions, contractual considerations, and escalation expectations.
After-action improvement
Establish how the organization will capture lessons learned, update plans, assign corrective actions, and prepare future exercises.
Cyber plus operations
The plan should protect service continuity.
Cyber incidents can affect billing, email, work orders, phones, remote access, file shares, engineering workstations, SCADA visibility, reporting, access control, and public communication. For infrastructure organizations, the key question is not only how to restore computers.
The key question is how to keep essential services operating while the organization investigates, contains, communicates, and recovers.
Common triggers
- Leadership concern about ransomware readiness
- Insurance, audit, board, or council questions about cyber response
- SCADA, remote access, vendor access, or OT security concerns
- Recent incident, near miss, phishing event, or account compromise
- Outdated incident response plan or missing ransomware playbook
- Need to connect cyber response with emergency response planning
How engagements work
A practical planning process
Understand operations
Identify essential services, critical systems, existing plans, response roles, IT and OT dependencies, vendors, and recovery constraints.
Review current readiness
Assess plans, contact lists, escalation paths, backups, remote access, communications, decision authority, and incident documentation practices.
Build or update plans
Develop practical incident response procedures, ransomware playbooks, first 24 hours guides, communications steps, and recovery decision points.
Validate and improve
Brief leadership, align with emergency response planning, and support tabletop exercises or after-action improvement planning.
Deliverables
Planning outputs that support decisions under pressure.
Deliverables are designed for real use during an incident. They should be clear enough for leadership, operations, IT, OT, emergency management, and outside partners to understand their roles.
- Incident response plan review or updated incident response plan
- Ransomware response playbook
- First 24 hours decision guide
- Cyber incident contact list and notification matrix
- OT and SCADA incident coordination considerations
- Communications and public information planning notes
- Backup, restoration, and return-to-service decision points
- Leadership briefing and optional tabletop exercise package
Scenario coverage
Plan for the events most likely to create confusion.
Incident response plans should address the incidents that force fast decisions across technical, operational, legal, public communication, and executive lines.
Ransomware
Business systems affected, backups uncertain, public services continuing, and leadership facing restoration, notification, and communication decisions.
SCADA disruption
Loss of visibility, anomalous control behavior, remote access shutdown, vendor support constraints, and manual operations decisions.
Vendor compromise
Third-party access concerns, shared support tools, remote sessions, compromised credentials, and coordination with vendors and integrators.
Account compromise
Suspicious logins, email compromise, privileged access concerns, MFA gaps, and containment decisions.
Data loss or exposure
Sensitive information concerns, legal and insurance coordination, documentation, notifications, and public confidence issues.
Cyber-physical incident
Physical access, damaged equipment, control system concerns, public messaging, law enforcement coordination, and operational continuity.
Related resource
Start with the easiest access risks.
The Volume 1 Companion Toolkit supports short cybersecurity tasks for remote access, passwords, MFA, and account security. These areas often shape incident response because compromised access can drive containment, notification, and recovery decisions.
Download the Volume 1 toolkit
Use the toolkit to track tasks, assign owners, and record progress for practical cyber risk reduction.
Related services
Incident response planning should connect to assessment, emergency planning, and exercises.
Cybersecurity Assessments
Identify account, remote access, backup, logging, and incident readiness gaps before an event.
OT/ICS & SCADA Security
Review control system pathways, vendor access, segmentation, and continuity considerations that affect response.
Emergency Response Planning
Connect cyber incident response to broader operational emergencies, communications, and continuity actions.
Tabletop & Operational Exercises
Test roles, decision points, communications, containment, manual operations, and recovery priorities.
Ready to improve cyber incident readiness?
Systems Risk Advisory can help develop or update incident response plans that support leadership decisions, technical containment, OT coordination, communications, continuity, and recovery.