Glossary
Incident commander
The person with overall authority for managing an incident response: setting priorities, assigning tasks and coordinating decisions and communications.
The incident commander (IC) is the individual with overall responsibility for managing an incident. The role comes from the Incident Command System used in emergency management and is widely used in cybersecurity and site-reliability engineering.
The incident commander's job is coordination, not hands-on technical work. Typical responsibilities include declaring or confirming severity, setting objectives and priorities, assigning tasks to responders, running the incident bridge or meeting cadence, making or escalating key decisions, ensuring an incident log is kept, and coordinating with legal, communications and leadership.
Good incident-response plans name who can act as incident commander, their deputies and when the role is handed over. For major incidents, the technical incident commander often works alongside an executive crisis team that handles business-level decisions such as public disclosure or ransom questions.
Tabletop exercises regularly reveal that this role is unclear, especially outside business hours. See tabletop exercise roles and the ransomware scenario.