Unified command
Unified command is how several parties with authority over the incident run one response. They agree one set of objectives and one plan. Each keeps authority over its own people and budget, and none acts outside the plan without telling the others.
Who sits in it
A party joins unified command when it holds authority or accountability for part of the response.
| Party | Joins when | Otherwise |
|---|---|---|
| Technology leadership | Systems will be isolated, rebuilt or restored | Supports through Operations |
| Security leadership | Almost always, for investigation and containment | n/a |
| OT or engineering | Plant or physical systems are affected or at risk | Advises the Safety Officer |
| The affected business | Operations, customers or revenue are affected | Receives updates |
| Counsel | Legal exposure is driving decisions | Legal advisor to command |
| Managed security provider | It takes containment actions under its contract | Works through Operations |
| Law enforcement | It holds authority over part of the response, as in some public-sector incidents | Through Liaison |
Rules
- One set of objectives and one IAP, approved by every member.
- One Operations Section Chief, whatever the number of members.
- One voice outside the incident, through the Public Information Officer.
- Members sit together, or on one bridge, during planning.
- A member who must act outside the plan says so first and the others hear it before it happens.
Counsel and privilege
If counsel directs the investigation to preserve privilege, record that in the IAP. Documentation, the forensic report and outside responders' deliverables then follow counsel's routing, and Planning keeps the record index to match.
Managed providers
A provider that can isolate hosts or disable accounts in your environment acts inside the plan. Agree in advance which actions it takes on its own authority and which need the Operations Section Chief, then write that list into the IAP so the night shift knows it too.
Insurers
An insurer may require notice within a set time and may direct which response firms and counsel you use. It works through Liaison and Finance/Admin, and its requirements go into the IAP as constraints.