Page 210 - CISSO_Prep_ Guide

vision to the future and understand how to use this incident as an
opportunity to improve?

The overall strategic leader must be a person that can delegate
responsibility to trustworthy team leaders. There may be many
separate initiatives going on simultaneously, and each initiative
should have a leader that can handle their area of responsibility
with little oversight and report on the status of their
responsibilities back to the overall leader.

Therefore, to manage the incident, the organization may have
three levels of teams.
• The strategic team governs and provides oversight and
direction for the incident. It must also deal with the legal,
public relations, and customer and employee
communications issues.
• The incident management team provides oversight for
the various operational teams and directs the recovery
operations. They also feed the status report to the
strategic team.
• The operational teams are doing the various actions and
steps necessary to recover individual operations,
departments, or business functions. These skilled people
implement the steps of the plan and rebuild business
operations.