Policy 7230A - Department of Administration

work well in such high-stress environments should be
considered.
• IR responsibilities can require the taking of quick, decisive
actions based on minimal information and so only those staff
that can communicate efficiently to share maximum
information should be considered.
8.1.1.3 Identify IR Responsibilities of those Roles
Once individual employees have been associated with particular
roles, it is important to define and assign specific responsibilities so
that in the event of an incident all members of the team know who
will be handling what.
8.1.1.4 Build and Deliver an IR Training Program
To ensure that all members of the IR team are able to execute their
responsibilities in the most efficient manner possible a training
program must be devised and delivered:
• Determine needs and design a program accordingly.
• Create the materials to support the delivery of the training
program.
• Provide instructive training in IR operations as per the
program.
• Provide training support materials in IR operations as per the
program.
8.1.2. Build an Incident Response Capability
Incident response planning requires the identification of assets to be protected
by the plan, determination of the strategies applicable to the execution of the
plan and the documentation of the plan itself:
8.1.2.1 Create an Incident Response (IR) Plan
Develop a formal plan that outlines organizational intent in regards to
incidents and the manner in which they will be handled:
• Determine the overall purpose and scope of the IR capability.
• Establish the goals of the IR capability and the strategies that
will be used to achieve those goals.
• Define appropriate internal and external communications
requirements and mechanisms.
• Define the metrics by which the IR capability will be measured
to determine effectiveness and indicate opportunities for
enhancement.
30