All playbooks
Incident scenarios · Incident responders and SOC leads
Critical incident: standing up the response
Not a technical playbook. The one you run alongside it when an incident outgrows the people on it.
The technical playbook keeps running. This is the other half: who decides, who records, who is told, and who is still standing at 3am.
What this does not establish
- Whether this is critical. Someone has to make that call and put their name on it.
- How long it runs. Staff for days; most crises outlast the first night.
- Who is already stretched. The people who found it have been at it for hours.
0 of 11 ticked
Selected step
DetectStep 1 of 11Decision
Declaring it is the first decision, and it is a decision, not a formality.
Is this actually a critical incident?
If no: Stay in the technical playbook; do not stand up a cell you do not needOtherwise continue to “Escalate: SOC manager, director, global security”.
- Critical is about consequence, not noise: money, safety, regulator, or the business stopping.
- Domain-wide compromise, live extortion, or data confirmed gone usually qualify.
- Standing up a cell for a non-crisis burns the people you will need later.
- If you are arguing about it, escalate and let someone senior decide.