<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-war-room-procedures
description: >-
  Establish war room coordination with role assignments, meeting cadence, decision logging, status boards, and virtual/physical setup for major incidents.
domain: cybersecurity
subdomain: incident-management
tags:
  - war-room
  - incident-command
  - coordination
  - roles
  - cadence
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["TA0040"]
  nist-csf: ["RS.CO-1", "RS.RP-1", "RS.MI-1"]
  frameworks: ["NIST SP 800-61", "ICS/NIMS"]
---

# Building War Room Procedures

## Overview

War rooms provide focused, structured coordination for S1/S2 incidents. Clear role definitions, a fixed cadence, and real-time decision logging prevent the chaos that turns manageable incidents into business-impacting crises.

Mode: `[MODE: INCIDENT]` — Establish command structure before diving into technical analysis.

## Role Assignments

| Role | Primary Responsibility | Who Fills It |
|---|---|---|
| Incident Commander (IC) | Single decision authority; not the investigator | Senior responder or manager |
| Technical Lead | Directs investigation and containment execution | Most senior technical responder |
| Scribe | Real-time documentation of all decisions and timeline | Available analyst or manager |
| Communications Lead | Stakeholder updates, PR/Legal coordination | Security manager or designated comms |
| Liaison | Business unit interface, impact reporting to IC | Business relationship owner |
| Subject Matter Expert | On-call depth expertise (network, cloud, identity) | Called in as needed |

## Meeting Cadence

| Phase | Frequency | Format | Duration |
|---|---|---|---|
| Activation (T+0) | Once | Situation brief → roles → tasks assigned | 15 min |
| Active response (S1) | Every 30 min | "What learned? What doing? What blocked?" | 10 min |
| Active response (S2) | Every 60 min | Same format | 10 min |
| Shift handoff | Per shift change | Written summary + verbal brief | 20 min |
| De-escalation | Once | IC declares, transition to async, close room | 10 min |
| Post-incident | 24-48h post-close | Lessons learned, timeline review | 60 min |

## Status Board Fields

| Field | Content | Owner |
|---|---|---|
| Incident ID | INC-YYYY-NNNN | Scribe |
| Severity | S1/S2/S3/S4 (can escalate/de-escalate) | IC |
| Status | ACTIVE / CONTAINED / MONITORING / CLOSED | IC |
| Current IC | Name and contact | IC |
| Technical Lead | Name and contact | IC |
| Current working theory | One sentence on attack path | Tech Lead |
| Active actions | What is in-progress right now | Scribe |
| Blocked items | What needs a decision or resource | IC |
| Next update | Scheduled check-in time | IC |
| Regulatory flag | Yes/No — DPO and Legal engaged? | Comms Lead |

## Virtual War Room Requirements

- Dedicated incident bridge (static URL/dial-in — pre-configured, not created ad-hoc)
- Dedicated Slack/Teams channel per incident (format: `#inc-YYYY-NNNN`)
- Shared document for timeline and decisions (auto-created from template on activation)
- Screen share capability for tool output visibility
- Recording capability for audit trail (with participant consent)

## Workflow

1. IC opens the war room and sends activation notification to all roles
2. Scribe creates incident document from template and posts link to channel
3. IC conducts 15-minute situation brief — share known facts, not speculation
4. Roles confirmed, tasks assigned with owner and 30-minute checkpoint
5. Status board populated and pinned to channel
6. Cadence clock starts — IC owns the timer
7. Every decision logged by Scribe with timestamp, decision, and rationale
8. IC continuously assesses: escalate, de-escalate, request more resources?
9. Shift handoff: outgoing lead records written summary before disconnecting
10. IC declares de-escalation when threat is contained and monitoring is sufficient

## Verification

- [ ] Roles defined and contact list current
- [ ] Bridge URL and Slack channel naming convention documented
- [ ] Status board template ready for activation
- [ ] Incident document template tested
- [ ] Cadence schedule posted and understood by all responders
- [ ] War room exercised in tabletop quarterly

## Related Techniques

- [Performing Stakeholder Notification](../performing-stakeholder-notification/SKILL.md)
- [Performing Post-Incident Review](../implementing-lessons-learned-processes/SKILL.md)
