Above the incident
Incident command runs the incident. When the incident reaches the whole organization, NIMS adds three structures above and around it. Each has its own job, and keeping the jobs separate leaves the incident commander free to run the response.
Emergency operations center: the crisis team
An EOC supports incident command and manages consequences away from the incident. In a cyber incident that is the crisis management team: business continuity, operations, finance, HR, facilities and customer operations, led by an executive who is not the incident commander. It runs manual workarounds while systems are down, keeps customers served, finds extra staff and money, and tells the incident commander what the business needs.
Activate it when business operations are disrupted beyond the technology estate, when the incident will run past a day, or when the response needs resources beyond the incident commander's authority.
Multiagency coordination group: the executive decision group
A MAC group is a small set of executives who set policy and priorities when demands exceed resources or several incidents compete. In cyber: the chief executive, general counsel, finance, operations, security and technology leadership, with the board kept informed. They decide what only they can decide: taking a line of business offline, which business unit restores first, public disclosure, any engagement with an extortionist with counsel advising on legal and sanctions exposure, and spending beyond set limits. They leave tactics to the incident commander.
Joint information system: one set of public facts
A JIS coordinates public information across every organization involved. A supplier breach that reaches your customers, or an incident with law enforcement, an insurer and a managed provider involved, puts several communications teams in front of the same audience. The JIS keeps their statements consistent: shared facts, agreed timing, each party speaking for its own part. A joint information center is where those communicators work together, in a room or on a bridge.
How they connect
| From | To | What flows |
|---|---|---|
| Incident command | Crisis team (EOC) | Status summaries, and resource requests beyond command authority |
| Crisis team (EOC) | Incident command | Resources, business priorities, decisions within the crisis team's authority |
| Crisis team (EOC) | Executive group (MAC) | Decisions that need executive authority, with options and business impact |
| Executive group (MAC) | Crisis team and incident command | Priorities, policy decisions, allocation of scarce resources |
| Every level | Joint information system | Verified facts cleared for release |
| Joint information system | Every level | Approved statements and their timing |
Watch for executives directing tactics from the crisis room. Give them the decisions only they can make, on a written list, and route everything else to the incident through the incident commander.