<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-multi-team-incident-coordination
description: >-
  Establish and manage cross-functional incident coordination across
  security, engineering, operations, legal, and communications teams
  with structured roles, communication protocols, and escalation paths.
domain: cybersecurity
subdomain: incident-management
tags:
  - coordination
  - cross-functional
  - incident-command
  - communication
  - escalation
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.CO-1", "RS.CO-2", "RS.CO-3", "RS.CO-4"]
  frameworks: ["NIST SP 800-61", "ICS/NIMS", "PagerDuty Incident Response"]
---

# Implementing Multi Team Incident Coordination

## Overview

Multi-team incident coordination ensures that security, engineering,
operations, legal, communications, and executive teams collaborate
effectively during incidents. The Incident Command System (ICS) adapted
for cybersecurity provides clear roles, communication channels, and
decision authority to prevent chaos during high-severity events.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Incident command structure | Defined roles and authority levels |
| Communication platform | Slack/Teams with dedicated channels |
| Escalation matrix | Contact trees by severity and type |
| Stakeholder registry | Team leads and alternates for each function |

## Key Concepts

### Incident Command Structure

```
                    ┌──────────────────┐
                    │ Incident Commander│
                    │ (Overall authority)│
                    └────────┬─────────┘
                             │
        ┌────────────────────┼────────────────────┐
        │                    │                     │
┌───────▼───────┐  ┌────────▼────────┐  ┌────────▼────────┐
│ Operations    │  │ Communications  │  │ Planning &      │
│ Section Chief │  │ Lead            │  │ Intelligence    │
│ (Tech response│  │ (Stakeholder    │  │ (Threat analysis│
│  containment) │  │  updates)       │  │  scoping)       │
└───────┬───────┘  └─────────────────┘  └─────────────────┘
        │
   ┌────┼────┐
   │    │    │
┌──▼┐ ┌▼──┐ ┌▼──┐
│SOC│ │ENG│ │OPS│
└───┘ └───┘ └───┘
```

### Communication Protocol

| Channel | Purpose | Update Frequency |
|---------|---------|-----------------|
| #inc-{id}-war-room | Technical response | Real-time |
| #inc-{id}-leadership | Executive updates | Every 30 min |
| #inc-{id}-external | Legal/comms/PR | As needed |
| Bridge call | Voice coordination | On severity escalation |

### RACI by Severity

| Function | S1 Critical | S2 High | S3 Medium |
|----------|------------|---------|-----------|
| Security | Responsible | Responsible | Responsible |
| Engineering | Consulted | Informed | — |
| Legal | Responsible | Consulted | — |
| Communications | Responsible | Consulted | — |
| Executive | Informed | Informed | — |

### Escalation Triggers

| Condition | Escalation Action |
|-----------|------------------|
| S1 severity | Page IC, activate war room, notify legal |
| Data breach confirmed | Legal holds, regulatory notification prep |
| Customer impact | Communications team activation |
| > 4 hour resolution | Executive briefing |
| Media inquiry | PR team activation |

## Workflow

1. Activate incident command structure based on severity
2. Open communication channels (war room, bridge call)
3. Assign roles using ICS structure
4. Establish update cadence per channel
5. Coordinate containment actions across teams
6. Manage escalation triggers and stakeholder notifications
7. Conduct handoffs for sustained incidents

```bash
# Activate incident coordination
node agent.js activate --incident-id INC-2026-0200 \
  --severity S1 --commander "jane.smith"

# Send status update to all channels
node agent.js status-update --incident-id INC-2026-0200 \
  --message "Containment in progress, estimated 2hr to resolution"

# Generate coordination roster
node agent.js roster --incident-id INC-2026-0200
```

## Verification

- [ ] ICS roles assigned within 15 minutes of S1 declaration
- [ ] Communication channels created and populated
- [ ] Status updates delivered on schedule
- [ ] Escalation triggers monitored and acted upon
- [ ] Handoff procedures documented for shift changes

## References

- NIST SP 800-61 Rev. 2 — Computer Security Incident Handling Guide
- MITRE ATT&CK Framework — https://attack.mitre.org/
- NIST SP 800-61
