Cyber Incident Command System (CICS): A people orchestration layer

The talk starts from a common problem in incident response: a small group of people ends up solving the problem and cannot rest, hand off work or easily bring in replacements. That strains staff, and fatigue leads to mistakes that make incidents worse. The speakers propose a lighter version of the National Incident Management System, the command standard that emergency responders already use across the United States, adapted for cyber and IT teams.

The middle of the talk focuses on command and control. It covers modular organization and manageable span of control, with supervisors overseeing three to seven people and five as the preferred number. The structure separates an incident commander from operations, planning, logistics, and finance and administration, and adds roles such as a public information officer, a legal officer and a mental health officer. A hospital ransomware example shows the structure growing as the incident does, with existing technical playbooks plugging into the IT operations section unchanged and medical teams added as another operations branch. A tabletop exercise with public health officials is described as showing that people from different organizations quickly settled on this structure.

The question period raised concerns about staffing shortages, uninvited volunteers, corporate reluctance to add mental health roles and whether companies would accept work-rest limits. The speakers suggested taking the roles and work-rest ratios from wildfire guidance, using free federal training, and running exercises to show leadership who needs to be involved. The main takeaway is to define roles and shift limits before an incident so that outside responders can join using a shared structure.