Security Policies and Procedures · Topic 3 of 7
Incident Response Stakeholders and SOC Metrics
Map stakeholders to the incident response phases in NIST SP 800-61 and CMMC, and learn how SOC metrics such as time to detect relate to scope analysis.
- 5 min
- Includes a diagram
- Incident response involves management, IT, system owners, legal, HR and communications as well as the SOC.
- Management approves the plan and legal advises on evidence and notification.
- Communications prepare messages for staff, customers and the media.
What it is
Incident response involves many people beyond the security team, and the SOC measures how fast and how well it works.
Each stakeholder has a role in particular phases. Legal advice matters when data has leaked, and public relations matter when the news becomes public.
The metrics turn the response into numbers. They show how long each stage took, and where the process needs to improve.
How it works
Match each stakeholder to the phase where they contribute most, and use time based metrics to judge the response.
Stakeholders and their roles
| Stakeholder | Typical contribution |
|---|---|
| Incident response team and SOC | Detect, analyse, contain, eradicate and recover |
| Senior management | Approves the plan, makes business decisions, supplies resources |
| IT and network operations | Apply containment and recovery, rebuild systems |
| System and data owners | Explain what a system does, accept downtime, confirm recovery |
| Legal and compliance | Advise on evidence, notification duties and regulation |
| Human resources | Handle cases that involve staff |
| Public relations and communications | Prepare statements for staff, customers and the media |
| Law enforcement and external parties | Help with serious crimes, and with vendors, providers and insurers |
Mapping stakeholders to the phases
| Phase | Main stakeholders and what they do |
|---|---|
| Preparation | Management approves policy and funds the team. Legal reviews policy. IT builds logging and tooling. HR and training prepare staff |
| Detection and analysis | The SOC and response team validate and scope. System owners give context. Management is told of serious events |
| Containment, eradication and recovery | The response team and IT carry out the actions. Owners agree on downtime. Legal advises on evidence. Communications prepare messages |
| Post incident activity | Everyone joins lessons learned. Management approves changes. Legal and compliance close notification duties |
CMMC is the Cybersecurity Maturity Model Certification, a framework for organisations that work with the United States defence sector. It has an incident response area, whose practices cover similar activities to the NIST phases. The organisation plans for incidents, detects and reports them, responds, and tests its capability.
Organisations assign roles in different ways, so treat the table above as a typical mapping.
SOC metrics
A SOC measures time at each stage of an incident.
| Metric | Measures |
|---|---|
| Time to detect | The time from when the incident began, or the compromise happened, until it was noticed |
| Time to contain | The time from detection until the spread of the incident was stopped |
| Time to respond | The time from detection until the response actions were done |
| Time to control | The time until the incident was fully under control and could no longer cause harm |
Organisations define these terms in slightly different ways, so use the definitions given in a question. The common pattern is that a shorter time is better, and each metric covers a different stretch of the incident.
Incident start ---- detect ---- contain ---- respond ---- controlThe gap before detection is often the longest and the most damaging. An attacker who stays unnoticed for weeks can reach many systems.
Metrics and scope analysis
Scope analysis works out how far an incident reaches, such as which systems, accounts and data are involved. The metrics are linked to scope.
- A long time to detect means a larger possible scope, because the attacker had more time to move.
- A long time to contain also widens the scope, since the incident can still spread.
- Metrics that are high in one type of incident show where to invest. Slow detection suggests better monitoring. Slow containment suggests better playbooks and automation.
Tracking these figures over time shows whether changes to people, process and tools are working. They are also reported to management in simple terms.
What to remember for the exam
Seven facts cover most questions on this topic.
- Incident response involves management, IT, system owners, legal, HR and communications as well as the SOC.
- Management approves the plan and legal advises on evidence and notification.
- Communications prepare messages for staff, customers and the media.
- CMMC includes an incident response area, and its practices follow ideas similar to the NIST phases.
- Time to detect, contain, respond and control measure different stages of an incident.
- Shorter times are better.
- A long time to detect or contain increases the scope of an incident.
Think of the stakeholder first. Legal and public relations show up most when data is exposed or the incident becomes public.
Common mistakes
These four errors appear often.
Leaving the response only to the security team. Legal, communications and system owners all have roles.
Mixing up detect and contain. Detect is noticing the incident, and contain is stopping its spread.
Using one definition everywhere. Read the definition a question gives for each metric.
Ignoring the time before detection. It is often the longest period.
Metrics only help when they are measured the same way each time and reviewed after every incident.
Check yourself
Work through these three questions.
Which stakeholder advises on evidence handling and notification duties?
Legal and compliance staff advise on evidence and on notification duties.
What does time to detect measure?
The time from when the incident began, or the compromise happened, until it was noticed.
Why does a long time to detect widen the scope of an incident?
The attacker has more time to move between systems and reach more data.
Topic 3 of 7 in Security Policies and Procedures
Test yourself on Security Policies and Procedures
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.