Assign Key Roles and Responsibilities
Description
Assign key roles and responsibilities for incident response, including staff from legal, IT, information security, facilities, public relations, human resources, incident responders, and analysts, as applicable. Review annually, or when significant enterprise changes occur that could impact this Safeguard.
Implementation Checklist
Tool Recommendations
Security orchestration, automation, and response platform with playbook automation and case management
Palo Alto Networks · Enterprise subscription
Security orchestration and automated response platform with playbooks, case management, and 350+ integrations
Cisco (Splunk) · Event-based subscription
Security incident response and vulnerability response with orchestration, workflow automation, and CMDB integration
ServiceNow · Enterprise subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Critical Response Function Unfilled During Incident
IntegrityDuring a breach, no one is assigned to handle legal obligations such as breach notification or evidence preservation, resulting in regulatory violations and potential spoliation of evidence.
Conflicting Decisions from Multiple Uncoordinated Teams
AvailabilityIT, security, legal, and public relations teams make contradictory decisions during an incident because no predefined role assignments clarify who is responsible for which response functions.
Vulnerabilities (When Safeguard Absent)
No Predefined Role Assignments for Incident Response
Without assigned roles spanning legal, IT, security, facilities, PR, and HR, critical response functions are either duplicated or completely unaddressed during incidents.
Cross-Functional Coordination Gaps
Absence of defined roles means non-technical functions like legal, HR, and public relations are not integrated into the incident response, causing delays in notifications, employee actions, and public communications.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Document | Response procedure/playbook documentation | Reviewed bi-annually |
| Record | Response action logs showing procedure execution | Per incident |
| Document | Incident response plan and playbooks | Reviewed bi-annually |
| Record | Incident reports and post-incident review documentation | Per incident |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |