What leadership decides during a cyber incident, and who acts

What does leadership decide during a cyber incident?

Leadership makes the business and risk decisions during a cyber incident. Responders investigate and contain the threat, and leaders decide how the organization responds.

NIST's SP 800-61 Rev. 3 (2025) says leadership oversees incident response, allocates funding and may hold decision-making authority on high-impact actions such as shutting down or rebuilding critical services.

Many of these decisions come before an attack. Leaders pick which operations are critical, approve how much authority responders have and name primary and backup contacts for after-hours escalation.

NIST's SP 800-61 Rev. 3 (2025) spreads incident work across several roles:

Who can shut down systems during an attack?

Leadership decides who can shut down systems, and it's best to settle that before an attack. Responders can take smaller containment steps under agreed rules, while NIST's SP 800-61 Rev. 3 (2025) notes that leadership may keep authority over shutting down or rebuilding critical services.

Outside providers need the same clarity in writing. NIST's SP 800-61 Rev. 3 (2025) says a provider's contract should define duties, information flows and its authority to act for the organization, including limits such as immediately deactivating certain services.

At FunctionOne, those rules come out of the first step, a security assessment. Systems and accounts get reviewed, and leadership agrees on scope and response rules: which actions analysts may take, which sensitive systems need approval, who the primary and backup contacts are and how after-hours escalation works.

Within the authority the client approves, 24/7 analysts can isolate a computer, stop a malicious process, require a password reset or disable an account. Named contacts then receive findings, evidence, actions taken and next steps. Client leadership makes the business and risk decisions from there.

Events that need more than monitoring and containment move to incident response, which FunctionOne scopes separately.

Who should communicate during a cyber incident, and to whom?

Leadership should direct what the organization says to the outside world. Inside, the people with response roles keep coordinating so decisions rest on current facts.

NIST's SP 800-61 Rev. 3 (2025) describes four kinds of incident communication: coordination among parties with roles; notification of affected customers, employees, partners and regulators; public communication such as media inquiries; and sharing threat information. NIST's SP 800-61 Rev. 3 (2025) also calls for regular updates to senior leadership on major incidents.

In NIST's SP 800-61 Rev. 3 (2025), legal advises on legal ramifications and public affairs and media relations shape the media engagement strategy.

For ransomware, the #StopRansomware Guide (2023) from CISA, the FBI, NSA and MS-ISAC says the CEO or equivalent should approve the ransomware response plan and communications plan in writing, and organizations should report to CISA and the local FBI field office.

Don't leave the contact list for later. Write down who approves a public statement, who notifies regulators and partners, and who updates asset owners on recovery.

Should we pay a ransom?

The #StopRansomware Guide from CISA, FBI, NSA and MS-ISAC (2023) recommends against paying a ransom, because paying doesn't ensure your data gets decrypted.

That 2023 guide from CISA and its partners asks the CEO or equivalent to approve the ransomware plan and its communications plan in writing. CISA and its partners also advise, in the 2023 #StopRansomware Guide, reporting ransomware to CISA and the local FBI field office.

NIST SP 800-61 Rev. 3 (2025) lists legal staff among the roles that advise on legal ramifications.

What is an after-action review?

An after-action review is a meeting or report, held as recovery wraps up, that looks at what happened, what your team did and how well it worked. NIST SP 800-61 Rev. 3 (2025) calls this step lessons learned.

NIST SP 800-61 Rev. 3 (2025) recommends follow-up reports or lessons learned meetings as recovery concludes, especially for major incidents. The same NIST report, SP 800-61 Rev. 3 (2025), says the review should hear from all parties and that teams should share lessons as soon as they find them.

Invite the staff and outside providers who had a role in the response.

Write the findings down. A short report gives the next team a record of what worked and what failed.

Where can we find incident response help in Syracuse, NY, or Tampa, FL?

FunctionOne works from offices at 6216 Thompson Road in Syracuse and at Industrious Downtown, 401 East Jackson Street, in Tampa. Call 315-437-6714 to start with a security assessment.

During the assessment, the team reviews systems and accounts and agrees scope and response rules with leadership. Those rules cover the actions analysts may take, approvals for sensitive systems, primary and backup contacts, and after-hours escalation. Incident response for events that need more than monitoring and containment is scoped separately.

Whichever provider you choose, NIST SP 800-61 Rev. 3 (2025) says the contract should define duties, information flows and the provider's authority to act for the organization, with limits such as immediately deactivating certain services.

Leadership should settle these decisions before an incident:

1. Approve the written incident response plan.
2. Set response authority and the approvals required for sensitive systems.
3. Name who may shut down or rebuild critical services.
4. List primary and backup contacts and the after-hours escalation path.
5. Assign who handles notification and media inquiries.
6. Decide how and when senior leadership gets updates during a major incident.
7. Choose when the after-action review happens.

Write the answers into the plan.