Who is on an incident response team?

An incident response team brings together three circles. The technical team: SOC analysts and CERT experts in investigation and remediation. The affected organisation: management, IT or the MSP, legal, the DPO and communications. And outside parties: the insurer, a lawyer, the police and the authorities. A single coordinator ties it all together.

To see how these people come in over the course of an incident, read our guide How does incident response work?.

First circle: the technical team

SOC analysts

They monitor around the clock, spot the alert, triage it and escalate. During the incident, they keep watching for any sign the attacker is coming back. See What are the roles in a SOC team?.

CERT experts

The CERT (or CSIRT) is the team that specialises in handling incidents. It typically includes:

• an incident lead, who coordinates technical work and reports to the crisis unit;
• digital forensics analysts, who rebuild the attack timeline from disks, memory and logs;
• threat intelligence analysts, who identify the attacker’s methods and the indicators of compromise to hunt for elsewhere;
• remediation specialists, particularly for Active Directory and the network, who plan how to evict the attacker and rebuild.

See CERT, CSIRT and SOC: what are the differences?.

Second circle: the affected organisation

Role	Responsibility during the incident
Senior management	Decides: shutting down a service, filing a complaint, communicating, convening the crisis unit
MSP or internal IT	Carries out actions on the systems: isolation, resets, restoration
CISO, where there is one	Bridges the technical team and management
Legal and DPO	Assess obligations: data protection authority, NIS2, contracts, police report
Communications	Prepares internal and external messages
HR	Keeps staff informed, issues instructions, manages extended hours
Business units	Identify critical activities and restart priorities

The MSP plays a central role: it knows the environment, holds the admin access and knows how to restore. In Cyna’s model, the MSP remains the client’s point of contact throughout the crisis, and Cyna’s CERT works alongside it. See Managed SOC and MSP: who does what?.

Third circle: outside parties

• The cyber insurer, to be told early: it may require or suggest a provider and sets the conditions for cover.
• A lawyer, useful for the police report, contracts and dealings with third parties.
• The police, to file a complaint. In France, cybermalveillance.gouv.fr recommends filing before reinstalling equipment.
• The authorities: the data protection authority for personal data breaches; the national authority or designated CSIRT for entities in scope of NIS2.

See Who should you contact after a cyberattack?.

The rules that make the team work

1. One coordinator. A single person sets technical priorities, so that two teams do not work against each other (for instance, one restoring while the other is still collecting evidence).
2. A shared log. Every action is timestamped: who, what, when. It feeds the investigation, the insurer and regulatory reports. cybermalveillance.gouv.fr recommends keeping this log from the very start.
3. Secure communication channels. If email is compromised, the attacker may be reading the crisis traffic. Switch to a separate channel.
4. Regular status updates between the technical team and the crisis unit.
5. Recorded decisions, especially those that trade continuity against security.

What Cyna brings to the team

Cyna provides the first circle: a 24/7 managed SOC run from France by in-house teams, and its CERT, a member of InterCERT France, which can be mobilised quickly. The CERT works with the SOC teams, and Cyna’s incident response on-call team is available 24/7 from the Report an incident page. The partner MSP keeps the relationship with its client and acts on the systems with the CERT’s support.

Talk to an expert

Want to clarify who does what in your organisation, or your clients’, before an incident happens? If you work with a Cyna partner MSP, they are your first point of contact. Otherwise, get in touch.

Under attack? Report an incident: Cyna’s on-call team is available 24/7.

Frequently asked questions

Does a small business need its own incident response team?

Rarely. It needs to know whom to call and who decides internally. Investigation expertise usually comes from an external provider, engaged through an agreement or via the MSP. See Is an in-house team enough, or do you need an external provider?.

Who decides to shut down production?

The affected organisation's management, on the response team's recommendation. The CERT and the MSP inform the decision, but the trade-off between security and business continuity belongs to leadership.

Should the DPO be involved?

As soon as a personal data breach is possible. The DPO assesses the risk to individuals and, where relevant, prepares the notification to the supervisory authority. Article 33 of the GDPR provides for notification within 72 hours of becoming aware of the breach.

What is the difference between the technical team and the crisis unit?

The technical team deals with the incident on the systems; the crisis unit manages its consequences for the organisation: decisions, communication, continuity. See Incident response vs crisis management.