Decision Rights and Escalation: Who May Contain, Isolate and Disclose

All courses / AI Blue / Module 4 / Chapter 18

Learning objectives

After the lesson the participant can:

• Assign ten incident decisions to named holders with deputies, response times and inform lists
• Explain the response tiers and the rules by which a question moves between them
• Describe how the stop right is made cheaper than the right to continue
• Run a tabletop that measures time to acknowledge and time to decide and file the misses as findings

Key concepts

Decision right

A requirement with a holder, a deputy and a second deputy, a response time, an evidence standard and a record. It is set from the speed of the threat and the shortest applicable clock.

Response tiers

Five tiers decide in seconds to hours: playbook, on-call, incident commander, executive and management body. The lowest tier that can decide with the evidence decides, and the management body approves the file in advance.

Timeout rule

A page not acknowledged within the response time goes to the deputy by an automatic timer, never by a person remembering.

Escalation packet

A structured packet, not a message: the subject, the proposed action and its class, the evidence with data paths marked independent or shared, the evidence pointing the other way, the cost of waiting, the status of the clocks and the holder.

Three disclosure decisions

The file separates classification of the event, the decision to notify and the approval of the text. AI may propose classification and draft at Level 1 Assisted; a named executive holds the decision.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A stop needs one holder and no justification before it takes effect, and an unnecessary stop costs the organisation and not the individual. What would have to change in your culture for people to use that right?
2. Revoking a session is reversible containment of a credential, while disabling an account decides about a person's access to work. Where exactly would you draw that line in your identity system?
3. The management body approves the file in advance and is informed; it does not sit in the incident path. How does that square with its accountability under NIS 2 Article 20 and DORA Article 5?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. Who is the default holder of decision D5, disabling a staff account, and within what time?

   1. The triage agent, within seconds, inside a playbook
   2. The duty analyst, within 5 minutes, at Level 2
   3. The incident commander, within 10 minutes
   4. The executive board, within 240 minutes
   Show the answer

   C. The incident commander, within 10 minutes
   D5 is an AC-3 action held by the incident commander with a 10-minute response time; the line manager and SOC lead are told. Where conduct is suspected, HR and the works agreement come first.

2. What did Hansa Mutual's tabletop on decision D7 measure against its targets?

   1. Acknowledgement after 5 minutes and a decision after 20 minutes, both inside target
   2. A stop of the agent team in 57 seconds against a target of 120 seconds
   3. No acknowledgement at all, because the holder was not on the rota
   4. Acknowledgement after 18 minutes against a target of 10, and a decision after 51 minutes against 30
   Show the answer

   D. Acknowledgement after 18 minutes against a target of 10, and a decision after 51 minutes against 30
   The tabletop showed what a table does not: the holder acknowledged in 18 minutes and decided in 51. The faults found were in plumbing and delegation, not in judgement, and the file was amended.

3. Under the chapter's rules, what moves an unanswered page to the deputy?

   1. An automatic timer when the response time passes without acknowledgement
   2. A phone call from the duty analyst, made when the holder is known to be unreachable
   3. A decision by the management body at its next meeting
   4. A proposal from the investigation agent to change the holder
   Show the answer

   A. An automatic timer when the response time passes without acknowledgement
   The timeout rule sends an unacknowledged page to the deputy by an automatic timer, never by a person remembering.