Incident Response

Establishing Procedures

No one enjoys writing standard operating procedured (SOPs), but they are essential pieces of information to have documented when setting up a team. Basically, from the list of core services, you should know what your team is going to be doing. SOPs define, at the top level, how the team will perform those services. SOPs should be available for everyone on the team’s staff to read whenever necessary. The SOPs describe how to do each of the critical functions that the team provides. The core example of this is an SOP for incident escalation. This SOP should describe concisely and specifically what the team should do when it is notified of an incident. Who should the team call and notify? What type of information should be passed to each contact? Who is responsible for deciding how to proceed?

The idea of SOPs evolved from military and government operations centers, which live and die by their procedures. Naturally, the Department of Defense team mentioned earlier documented just about every process and procedure imaginable. SOP repositories should be stored on a web server where any employee can reference them quickly and easily, something particularly useful for night shifts, which are often lightly staffed and supervised.

Although a 24x7 military operations center is an extreme example, even a one-person response team that only works during typical business hours would be well advised to document its core processes and procedures. This is true if for no other reason than to show customers and management how it does what it does, and that it is prepared to meet contingencies.

As a final note on SOPs, bear in mind that it is impossible to document every process and procedure a team is going to encounter. There are always new situations in the world of incident response. Further, as mentioned earlier, no SOP will be perfectly complete; nor should they be so rigid that it cannot be changed or circumvented when necessary, but only for the right reasons. Remember Mister Murphy. Operational situations sometimes necessitate change in the most unanticipated ways. Always be flexible to change when necessary. While SOPs should guide a given set of actions, remember that they should never be set in stone and so inflexible that responders are unable to adapt them to fit a unique situation.