Incident Coordination

How to manage incident response teams and communicate clearly and effectively to vested parties.


In this course, we will discuss how to manage the broad range of groups involved in responding to an incident. From technical analysts to organizational leaders, it will be your job to ensure every entity has the information relevant to their duties, and identify which skills are needed and who can provide them.

Often, incident response is based upon technical tenets, and the human interaction element is absent. The class will discuss incident coordination, as defined by NIST and modeled after FEMA’s Incident Coordination System: A tried and true method for coordination. Frameworks for incident response plans will also be discussed. Class time will be enhanced with tabletop exercises to test the participant’s ability to interact during an incident.

What to expect

The first day of this course is mostly instructor lectures with intermittent group discussions. On the second day, participants will form into small groups of 3-4 members each to complete a series of tasks designed to test their ability to communicate while under pressure. After each task, we’ll review lessons learned.

This is mainly a nontechnical class. Come prepared to share experiences within the IC framework.

Day 1

  • Lecture
  • Miniature scenarios

Day 2

  • Lecture
  • Miniature scenarios
  • Incident Coordination tabletop exercise

Who should attend?

  • CIOs
  • CISOs
  • ISSMs
  • Incident Response leaders
  • Operational Technical Staff
  • Managers
  • Anyone who might find themselves in coordination and communication settings related to incident response

Is this the right class for me?

This class is to help assist IR personnel that are responsible for coordination and communication in incidents. Often the technical aspects of an incident work themselves out but it is the human side of an incident that can be frustrating. There are processes and best practices that you can learn to help you maneuver through the maze of incident coordination and creating and working an incident response plan. If you are a new or seasoned IT operations or security manager, or are called to represent your team for communications, notifications, or coordination, this class is for you!

Laptop Configuration

Laptop is required