Chapter 3. Operating an IRT

After an IRT is established, your next concern is how to successfully operate your team. This chapter covers the following topics to help you improve the operation of your IRT:

Team size and working hours

New team member profile

Advertising team’s existence

Acknowledging incoming messages

Cooperation with internal groups

• Prepare for the incidents

Measure of success

Team Size and Working Hours

One of the more common questions that organizations setting up their incident response team ask is, “How large should an IRT be?” Providing that budget is not a constraint, the team’s size is a function of what services the IRT wants to provide, the size and the distribution of the constituency, and planned working ...

Get Computer Incident Response and Product Security now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.