Security Incident Command

Guides managing a security incident from declaration through remediation handoff using the incident management framework (Google's IMAG, derived from ICS). The seven-step process transforms a chaotic escalation into a controlled, parallelized investigation with clear role assignments, operational security discipline, and a principled stopping rule.

Prerequisite: Assumes your team has completed incident-response-team-setup — specifically that IC/OL/CL/RL roles are defined, severity and priority models exist, and a communications plan is in place.

When to Use

• A detection alert, customer report, or engineer escalation suggests a targeted compromise or active attacker
• Someone in the organization says "we have a security incident" or "we think we've been breached"
• An escalation has passed triage and requires organized, multi-person incident management
• A running incident needs handover to a fresh team due to fatigue
• You are the first responder and need to decide whether to declare and take command
• A critical vulnerability (e.g., Shellshock-class severity) requires incident-level coordination even without confirmed exploitation

Scope boundary: This skill governs the command and investigation phases. Remediation execution and postmortem writing are downstream; the RL begins drafting the cleanup plan in parallel during investigation, and the postmortem begins once the incident closes.

Process