Quick card

The first thirty minutes of command, and what to fill as it grows.

#	Item
1	Take command out loud: your name, the time, the incident name, the channel. Open your activity log.
2	Size up: what happened, what is affected, what is still happening, what is unknown.
3	Set up to three objectives, each with a measure and a time.
4	Name an Operations lead and hand the technical work to them. Stay off the keyboard.
5	Open a command bridge and an out-of-band channel. Treat email, chat and identity as visible to the attacker until scoping shows otherwise.
6	Decide the incident type, 5 to 1, and fill the positions it calls for.
7	Tell counsel if personal data, regulators, law enforcement, extortion or insurance may be involved.
8	Set the time of the first briefing and the first executive update.
9	Write the incident briefing (ICS 201) before the first briefing.
10	Check hours: who has been awake since when, and who relieves them.

Positions by incident type

Type	Fill
5	Incident commander, often the analyst who found it
4	The core three: IC, Communications lead, Operations lead
3	IC, Operations, Planning, Communications, Liaison, with Legal advising. Safety once shifts run long
2	All Command and General Staff. Unified command if another party holds authority. Crisis team (EOC) active
1	All positions, deputies for key roles, unified command with outside authorities. Crisis team, executive group and joint information system active

One incident commander, named out loud.
One boss per responder for the length of the incident.
Three to seven people per supervisor. Split the work at seven.
Written objectives before tactics.
One voice to executives and the public, through the Public Information Officer.
Every update answers: what is affected, how bad, what to do now, and when it will be fixed or the next update is due.
Handover by briefing, announced to everyone, logged with the time.
Nobody joins the response without an assignment.