Incident Response: A Strategic Guide to Handling System and Network Security Breaches

Virtual Teams—Ensuring Availability

One major problem with virtual teams is that team members might not be available when required. If their daily responsibility is operations, it might be difficult to pull them when needed (especially if the affected system in an incident is one for which they are responsible).

The policy that establishes the incident response team should clearly articulate the requirements for availability. Senior management sponsors should affirm the policy that incident response duties must take precedence over normal operational responsibilities. If this is not clearly stated to line managers, they might be unwilling to release team members when they are required. Because team members will eventually go back to reporting ...