An incident management team is the group named, before anything is wrong, to run the response once an incident is declared. It has a lead, a record of decisions, and people assigned to communications, operations, and the technical work. The team exists for the duration of the incident and then stands down.
The technical people who contain the intrusion are an Incident Response Team (IRT). The management team directs the wider response: who is told, what is shut down, and when service returns. The response team does the hands-on work the management team has prioritized.
What the Management Team Owns
- The lead. One person who can decide when the others disagree.
- The log. Decisions and times are written down as they happen.
- The handback. Service is restored on purpose, not by whoever finishes first.
Managing the Incident and Doing the Technical Work
| Compared | Management Team | Technical Response |
| Decides priorities | Yes | Carries out the chosen priority |
| Touches the affected system | Not as its main job | Yes |
| When it ends | When the incident is closed | When the containment work is done |