<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-war-room-procedures
description: >-
  Establish war room coordination with role assignments, meeting cadence, decision logging, status boards, and virtual/physical setup for major incidents.
domain: cybersecurity
subdomain: incident-management
tags:
  - war-room
  - incident-command
  - coordination
  - roles
  - cadence
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.CO-1", "RS.RP-1", "RS.MI-1"]
  frameworks: ["NIST SP 800-61", "ICS/NIMS"]
---

# Building War Room Procedures

## Overview

War rooms provide focused coordination for major incidents (S1/S2). Structured
roles, cadence, and decision tracking prevent chaos during high-pressure response.

## War Room Roles

```
INCIDENT COMMANDER (IC):
├── Single authority for decisions — NOT the technical investigator
├── Assigns tasks, coordinates workstreams
└── Determines escalation/de-escalation

TECHNICAL LEAD:
├── Leads investigation and analysis
├── Directs containment execution
└── Reports findings to IC

SCRIBE:
├── Documents ALL decisions in real-time
├── Maintains timeline, captures action items
└── Records attendees and roles

COMMUNICATIONS LEAD:
├── Drafts stakeholder updates
├── Coordinates with PR/Legal
└── Manages communication cadence

LIAISON:
├── Interfaces with affected business units
└── Reports business impact to IC
```

## Cadence

```
ACTIVATION (T+0): IC opens room → Roles assigned → Situation brief → Tasks assigned
ACTIVE: Check-ins every 30 min (S1) or 60 min (S2)
  Format: "What learned? What doing? What need?"
HANDOFF: Shift change briefing with written summary
DE-ESCALATION: IC declares → Transition to async → Close room
```

## Status Board

```
INCIDENT: INC-YYYY-NNNN | SEVERITY: S1 | STATUS: ACTIVE
IC: {name} | TECH LEAD: {name} | SCRIBE: {name}
CURRENT ACTIONS: {list} | BLOCKED: {list} | NEXT UPDATE: {time}
```

## Workflow

Follow the structured procedure outlined in Key Concepts above.

## Verification

- [ ] Roles defined and trained
- [ ] Virtual bridge and Slack channel pre-configured
- [ ] Status board template ready
- [ ] Cadence schedule documented
- [ ] War room exercised quarterly
