Policy 7230A - Department of Administration

8.1.1.b IR Roles
• IR Team Managers should be assigned primary responsibilities
of coordination and communication. Secondary
responsibilities can extend into the various technical areas
according to the skill set of the individual.
• IR Network Leads should be assigned primary responsibilities
of network analysis and trouble-shooting. Secondary
responsibilities can extend into any area according to the skill
set of the individual but are likely to match best to security
infrastructure management.
• IR Systems Leads should be assigned primary responsibilities
of specific system analysis and trouble-shooting. Secondary
responsibilities can extend into any area according to the skill
set of the individual but are likely to match best to system
management of alternate systems.
• IR Security Leads should be assigned primary responsibilities
of security infrastructure analysis and trouble-shooting.
Secondary responsibilities can extend into any area according
to the skill set of the individual.
8.1.1.c IR Training
• IR training should, at a minimum, address the following:
o How to recognize an incident.
o How to analyze an incident.
o How to contain and eradicate an incident.
o How to return to normal operations.
o How to communicate and escalate during an incident.
o How to operate all IR tools and resources.
8.1.1.d IR Training Scheduling and Frequency
• IR training should be provided for all IR team members within
30 days of initial assignment of the individual to the IR team.
• IR training should be provided thereafter for all IR team
members on an at least annual basis. Where possible, team
members will be trained together as a group.
25