Incident Response

Establishing Procedures

No one enjoys writing standard operating procedured (SOPs), but they are essential pieces of information to have documented when setting up a team. Basically, from the list of core services, you should know what your team is going to be doing. SOPs define, at the top level, how the team will perform those services. SOPs should be available for everyone on the team’s staff to read whenever necessary. The SOPs describe how to do each of the critical functions that the team provides. The core example of this is an SOP for incident escalation. This SOP should describe concisely and specifically what the team should do when it is notified of an incident. Who should the team call and notify? What type of information should be passed to each contact? Who is responsible for deciding how to proceed?

The idea of SOPs evolved from military and government operations centers, which live and die by their procedures. Naturally, the Department of Defense team mentioned earlier documented just about every process and procedure imaginable. SOP repositories should be stored on a web server where any employee can reference them quickly and easily, something particularly useful for night shifts, which are often lightly staffed and supervised.

Although a 24x7 military operations center is an extreme example, even a one-person response team that only works during typical business hours would be well advised to document its core processes and procedures. This is true if for no ...