KLKin Levi
Resources

Cyber incident decision matrix for CEO, CISO and CTO

Map who can authorize six critical incident decisions, the limits of delegated action and the conditions that require escalation. Edit and download the matrix as CSV.

Kin Levi

A job title alone does not establish authority during a crisis. This matrix helps a leadership team turn its response plan into explicit decision rights. Complete it for a defined service and scenario, review it with the incident lead and business owners, and approve the delegation through your organization’s own process.

Download blank matrix (.csv)

Define authority before the pressure rises

  1. Distinguish the roles

    Separate incident coordination, technical execution, business risk acceptance and external communication. Discuss where the CEO, CISO, CTO, service owner and incident lead contribute. Assign the actual approving role and an alternate for each decision; the same person may hold several roles in a small organization.

  2. Bound the delegated action

    Specify the services, tenants, access changes, duration and customer impact covered by a delegation. Name the evidence required and the point at which the action exceeds that authority. An approval to isolate one workload should not silently become approval to stop every service.

  3. Rehearse an unavailable approver

    In a tabletop exercise, make the primary approver unreachable and introduce a conflicting business priority. Check whether the alternate can act, whether an independent channel works and whether the decision is recorded. A contact list becomes useful when the authority behind each contact is clear.

Example: containment with a service boundary

In a hypothetical hosted service, suspicious access affects one tenant. The team’s approved plan permits the incident lead to isolate that tenant for a defined period, while a platform specialist executes the change. Evidence of access spanning other tenants triggers escalation to the designated business authority and technical leadership. If the primary approver is unavailable, the documented alternate acts within the same limits. The decision record retains the evidence, authorization, affected scope and review time. This example illustrates a delegation design; it is not a claim that every organization should use those roles or that containment succeeded.

Build the decision matrix

Your entries stay in this page and are used in your browser to create the file. Download before closing or reloading; this worksheet is not saved by the site.

Name the service, scenario, applicable response plan and the review or expiry condition for this delegation.

1. Declare the incident and appoint its lead

Evidence to consider: Observed events, affected services, confidence in the assessment and the criteria in the response plan.

Which approved role may decide? Who replaces it if unavailable, and how is that person reached?

What may be authorized without another approval? Define boundaries, duration and acceptable operational effects.

What evidence, impact or elapsed time exceeds the delegation? Identify the destination and the next review.

2. Contain access or isolate a service

Evidence to consider: Suspected access, affected scope, customer harm, technical feasibility, reversibility and continuity alternatives.

Which approved role may decide? Who replaces it if unavailable, and how is that person reached?

What may be authorized without another approval? Define boundaries, duration and acceptable operational effects.

What evidence, impact or elapsed time exceeds the delegation? Identify the destination and the next review.

3. Preserve evidence before a destructive change

Evidence to consider: Relevant artifacts, acquisition constraints, custody, urgency and what a reset or rebuild could destroy.

Which approved role may decide? Who replaces it if unavailable, and how is that person reached?

What may be authorized without another approval? Define boundaries, duration and acceptable operational effects.

What evidence, impact or elapsed time exceeds the delegation? Identify the destination and the next review.

4. Authorize external updates and notifications

Evidence to consider: Verified facts, affected audiences, communication owner and obligations assessed by the responsible specialists.

Which approved role may decide? Who replaces it if unavailable, and how is that person reached?

What may be authorized without another approval? Define boundaries, duration and acceptable operational effects.

What evidence, impact or elapsed time exceeds the delegation? Identify the destination and the next review.

5. Return a service to production

Evidence to consider: Identity and data checks, restoration tests, remaining restrictions, monitoring, rollback and business acceptance.

Which approved role may decide? Who replaces it if unavailable, and how is that person reached?

What may be authorized without another approval? Define boundaries, duration and acceptable operational effects.

What evidence, impact or elapsed time exceeds the delegation? Identify the destination and the next review.

6. Close the incident and assign follow-up work

Evidence to consider: Open exposure, customer commitments, temporary controls, corrective-action owners and their deadlines.

Which approved role may decide? Who replaces it if unavailable, and how is that person reached?

What may be authorized without another approval? Define boundaries, duration and acceptable operational effects.

What evidence, impact or elapsed time exceeds the delegation? Identify the destination and the next review.

Validate the delegation in your organization

Completing this page does not grant authority or replace an approved response plan. Review the matrix with the relevant business, technical, legal and communication owners. Missing or conflicting authority is an issue to resolve before an exercise becomes a real incident. Keep an accessible copy and revise it when services, people or decision rights change. Entries remain in your browser until you download; the site does not save the completed matrix.

Method and references

An original decision worksheet with primary incident-response references. It is not an official NIST or CISA template.

Continue reading

Cybersecurity board briefing template →