Sizing the response
NIMS sorts incidents into five complexity types. Type 5 is the smallest. Type 1 is the most complex. The type tells you which positions to fill and whether the plan must be written down.
| Type | In NIMS | Cyber example | Written IAP |
|---|---|---|---|
| 5 | One or two resources, closed within the first operational period | A phishing report with one mailbox affected | No |
| 4 | Several resources, one operational period, Command and General Staff not activated | Commodity malware on a handful of endpoints | No. A written objective list is enough |
| 3 | Some or all Command and General Staff positions activated, multiple operational periods | Business email compromise with a fraudulent payment, ransomware on one site | Yes, each period |
| 2 | Needs resources beyond local capability, most positions filled | Enterprise ransomware with an outside response firm and an insurer | Yes, each period |
| 1 | The most complex, all positions filled, national-level resources | A disruption of critical infrastructure with government coordination | Yes, each period |
Example
If your organization already uses severity levels, map them once, in writing, and publish the mapping.
| Severity | Type | Command |
|---|---|---|
| SEV 4 | 5 | Analyst in command |
| SEV 3 | 4 | IC and Operations lead |
| SEV 2 | 3 | Command and General Staff as needed |
| SEV 1 | 2 or 1 | Full organization, unified command likely |
When to grow
- A supervisor has more than seven people reporting.
- The incident will run past the current operational period.
- An outside response firm, insurer, regulator or law enforcement agency is engaged.
- Customers, the public or the media will hear about it.
- Containment could affect a physical process or anyone's safety.
- Two parts of the organization claim authority over the same systems.
- Business operations are disrupted beyond the technology estate: activate the crisis team as well. See Above the incident.
Order of growth
Add positions in the order the workload usually arrives: an Operations lead, then a Public Information Officer, then Planning with documentation first, then Liaison, then Logistics, then Finance/Admin. Safety joins as soon as shifts run past twelve hours or containment touches a physical process.
When to shrink
Fold positions back as their workload drops, returning their duties to the person above them. The IC announces each change and updates the organization assignment list.
For Type 4 incidents, and as the core of every larger one, fill three roles: incident commander, communications lead and operations lead. They are the core roles in Google's incident management system, IMAG, which is built on ICS, so they grow into the full organization without renaming anything. Add Planning when the incident runs past one shift. See Respond and manage.