Sources and licence

This guide adapts the National Incident Management System, Third Edition, published by FEMA in October 2017, and the Incident Command System forms, to cybersecurity. Both are works of the United States government. The three components, the four command and coordination structures, the fourteen management characteristics and the resource management process are summarized from NIMS.

The adaptation, cyber mappings, examples and templates are by Habib Tora and are licensed under CC BY 4.0. Take it and change it for your organization.

The three-stage structure, the three Cs and the three core roles take their cue from Google's Incident Management Guide, written by Adam Crume, Alex Cepoi, Chelsea Granados, Roxana Loza, Steve McGhee, Svetlana Gites, Trevor Mattson-Hamilton and Vrai Stacey, and from the Managing Incidents chapter of Site Reliability Engineering. Both are summarized and credited here. No text from them is reproduced.

The after-action format follows the AAR/IP of the Homeland Security Exercise and Evaluation Program.

Not published by, endorsed by, or affiliated with FEMA, the Department of Homeland Security or Google.