The first incident decision should not happen during the incident

During a serious incident, technical uncertainty and business urgency arrive together. Teams need permission to act, a way to establish facts and a shared understanding of who can accept disruption. A response plan should make those decisions easier under stress.

01 / UNDERSTAND

The business issue

NIST SP 800-61 Revision 3 integrates incident response with cybersecurity risk management. For executives, this means preparation extends beyond the security team: operations, legal, communications, suppliers and customer-facing leaders all have decisions to make.

02 / ACT

Your action guide

Explore each step, then use the questions with your business and technology teams.

DECISION INTO ACTION

Set decision rights

Name the incident lead, business decision-maker and alternates. Define authority to restrict access, interrupt a service, involve external specialists and approve customer communications.

Set decision rights

Name the incident lead, business decision-maker and alternates. Define authority to restrict access, interrupt a service, involve external specialists and approve customer communications.

Protect the fact record

Maintain a timeline with confidence levels and sources. Preserve relevant evidence using an agreed process and restrict access to sensitive incident information.

Exercise conflicting priorities

Run a tabletop in which containment affects a critical service. Include unavailable executives, unreliable communications and a supplier that cannot immediately provide answers.

Review the evidence. Revisit the decision.

Ask the leadership team
Who can authorize a disruptive protective action when the usual executive is unreachable?

03 / VERIFY

What to measure

Establish your baseline and agree targets for the service. These are suggested measures, not claimed results.

Decision latency

Time to reach an authorized containment or continuity decision.

Contact readiness

Named roles and alternate contacts tested in an exercise.

Fact quality

Material conclusions linked to evidence and confidence.

Use this in your next risk review

Working prompts for your team. Selections stay in this page only and are not a security assessment.

A business owner is accountable for this risk.The action has an owner and an agreed review date.The evidence demonstrates operation, not just policy.The remaining exposure is understood and accepted by the right authority.

04 / BUILD WITH US

How Genellipse helps

GeneSecure

GeneSecure can help organize security events, investigation context and response tasks so technical and operational teams have a shared record.

Explore GeneSecure

GeneComply

GeneComply can support incident-related control evidence, policy reviews and remediation tracking. Legal notification obligations and deadlines require jurisdiction-specific assessment; a workflow tool does not determine them on its own.

Explore GeneComply

End each rehearsal with an approved change to authority, process or capability. A completed exercise is useful only if the difficult decisions become clearer.

Explore CISO Advisory

Office of CISO, GENELLIPSE

Sources & editorial notes

Original Genellipse analysis and practical recommendations. Primary guidance informs the technical context; linked organizations do not endorse Genellipse or its products.

NIST SP 800-61 Revision 3: Incident Response

Prepared for this archive on October 10, 2026. Examples are illustrative. Product scope, integrations and responsibilities are confirmed for each engagement.