<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-incident-response-governance
description: >-
  Establish incident response governance frameworks including escalation
  matrices, severity classification, communication protocols, regulatory
  notification workflows, and post-incident review processes.
domain: cybersecurity
subdomain: security-leadership
tags:
  - incident-response
  - governance
  - escalation
  - severity-classification
  - communication
  - regulatory-notification
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Building Incident Response Governance

## Overview

IR governance establishes the organizational framework around incident response
— who decides severity, when to escalate, how to communicate, and when to
notify regulators. Without governance, even skilled IR teams flounder during
high-pressure incidents.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Executive sponsorship | Authority for IR governance |
| Legal counsel access | Regulatory notification guidance |
| Communication templates | Pre-approved messaging |
| IR team structure | Defined roles and responsibilities |

## Key Concepts

- **Severity classification**: Standardized criteria for incident severity
- **Escalation matrix**: Time-bound triggers for escalating to leadership
- **Communication protocol**: Internal and external messaging cadence
- **Regulatory notification**: GDPR 72h, SEC 4-day, state breach laws
- **Post-incident review**: Blameless retrospective process

## Workflow

### Step 1: Define Severity Classification

```python
SEVERITY_LEVELS = {
    "SEV1": {
        "name": "Critical",
        "criteria": "Active data exfiltration, ransomware, complete service outage",
        "response_time": "15 minutes",
        "escalation": "CISO + CEO + Legal immediately",
        "communication": "Every 30 minutes",
    },
    "SEV2": {
        "name": "High",
        "criteria": "Confirmed compromise, partial outage, credential theft",
        "response_time": "1 hour",
        "escalation": "CISO within 1 hour",
        "communication": "Every 2 hours",
    },
    "SEV3": {
        "name": "Medium",
        "criteria": "Suspicious activity, vulnerability exploitation attempt",
        "response_time": "4 hours",
        "escalation": "Security Director within 4 hours",
        "communication": "Daily",
    },
    "SEV4": {
        "name": "Low",
        "criteria": "Policy violation, phishing attempt blocked",
        "response_time": "24 hours",
        "escalation": "Team lead during business hours",
        "communication": "Weekly summary",
    },
}
```

### Step 2: Build Escalation Matrix

```python
ESCALATION_MATRIX = {
    "15_min": ["IR_lead", "SOC_manager"],
    "30_min": ["Security_director"],
    "1_hour": ["CISO"],
    "2_hour": ["CTO", "legal_counsel"],
    "4_hour": ["CEO", "board_notification"],
    "triggers": {
        "data_breach_confirmed": "immediate_CISO",
        "ransomware_detected": "immediate_CEO",
        "regulatory_data_involved": "immediate_legal",
        "customer_impact": "immediate_communications",
    },
}
```

### Step 3: Implement Notification Workflows

```bash
node agent.js classify --incident INC-2026-0142 --evidence evidence.json
node agent.js escalate --incident INC-2026-0142 --severity SEV1
node agent.js notify --incident INC-2026-0142 --check-regulatory
node agent.js review --incident INC-2026-0142 --generate-retro
```

## Verification

| Check | Method |
|---|---|
| Severity criteria clear | No ambiguous classification scenarios |
| Escalation tested | Tabletop exercise validates matrix |
| Notification timelines met | Regulatory deadlines tracked |
| Post-incident reviews completed | All SEV1/SEV2 incidents reviewed |

## References

- [NIST SP 800-61 — Incident Handling Guide](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)
- [SANS Incident Handler's Handbook](https://www.sans.org/)
- [GDPR Article 33 — Notification](https://gdpr-info.eu/art-33-gdpr/)
