ArcanaIncident-response documentationBrowse the feedTemplates
Back to feed
SOP
SOP-007

Major Incident War Room Management

1. Purpose & Scope

  • Purpose: Define how to run the command channel, meeting cadence, action tracker, decision log, and status updates for a major security incident.

  • Scope: Applies to Sev 0 or major security incidents requiring cross-functional coordination, executive visibility, multiple technical workstreams, or extended response across teams and geographies.

2. Definitions

  • War Room: Dedicated communication channel and meeting bridge used for real-time incident coordination.
  • Action Tracker: Authoritative list of open actions, owners, priorities, due times, and status.
  • Decision Log: Record of material decisions, approvers, rationale, timestamps, and follow-up actions.
  • Operating Cadence: Agreed schedule for technical syncs, leadership updates, handoffs, and stakeholder briefings.

3. Roles & Responsibilities

  • Incident Commander: Owns war room structure, cadence, priority setting, decision logging, and command transitions.
  • Deputy Incident Commander: Maintains action tracker, follows up on blockers, and supports continuity during long-running incidents.
  • Technical Lead: Coordinates technical workstreams and reports investigation, containment, and recovery status.
  • Communications Lead: Coordinates approved stakeholder updates and ensures messaging aligns with Legal/Compliance.
  • Scribe: Captures timeline, decisions, actions, owners, status updates, and evidence locations.

4. Procedure

4.1 Prerequisites

  • Major incident declared or likely to be declared
  • Incident Commander assigned
  • Incident ticket created
  • War room channel and meeting bridge available
  • Initial severity, scope, and active workstreams identified

4.2 Step-by-Step Instructions

  1. Open the War Room

    • Create or activate the incident channel and meeting bridge.
    • Pin links to the incident ticket, action tracker, decision log, evidence repository, and active playbooks.
    • State the current Incident Commander, Technical Lead, Communications Lead, and Scribe.

  2. Establish Operating Cadence

    • Define cadence for:
      • Technical syncs
      • Executive updates
      • Legal/communications reviews
      • Geo handoffs
      • Recovery checkpoints
    • Publish the cadence in the war room.

  3. Create the Action Tracker

    • Track each action with:
      • Owner
      • Priority
      • Due time
      • Status
      • Blockers
      • Link to evidence or ticket
    • Review open actions at each technical sync.

  4. Maintain the Decision Log

    • Record material decisions including:
      • Decision made
      • Approver
      • Rationale
      • Timestamp
      • Risks accepted
      • Follow-up actions

  5. Coordinate Workstreams

    • Track workstreams such as investigation, containment, recovery, communications, legal, vendor, and customer support.
    • Ensure each workstream has an owner and next update time.
    • Escalate blockers to the Incident Commander.

  6. Publish Status Updates

    • Use concise updates covering:
      • Current status
      • Impact
      • Actions completed
      • Open risks
      • Next milestones
      • Decisions needed
    • Do not include unapproved external messaging or sensitive details outside approved channels.

  7. Execute Command Handoffs

    • Use the geo handoff SOP when command changes across shifts or regions.
    • Confirm the incoming Incident Commander accepts command in the war room and incident ticket.

  8. Close or Downgrade the War Room

    • Confirm containment, recovery status, communications status, and open follow-up items.
    • Downgrade or close the war room only with Incident Commander approval.
    • Preserve the action tracker, decision log, and timeline in the incident record.

5. Compliance & Auditability

  • War room actions, decisions, command changes, and status updates must be retained in the incident record.
  • Decision logs must include approver, rationale, timestamp, and follow-up owner.
  • External communications must follow approved legal and communications processes.
  • This SOP's execution is reviewed during the Post-Incident Review.

6. Communication & Escalation

  • Internal Communication:

    • War room is the primary coordination channel for the major incident.
    • Executive and stakeholder updates follow the cadence approved by the Incident Commander and Communications Lead.

  • Escalation Criteria:

    ConditionAction
    Workstream blockedEscalate to Incident Commander and workstream owner
    Decision required from leadershipAdd to decision log and escalate to executive sponsor
    Legal or external communication requiredEngage SOP-003 process
    Vendor support requiredEngage SOP-005 process
    Shift or geo transition requiredEngage SOP-002 process

7. References & Linked Resources

8. Appendices

Appendix A: Status Update Template

Status: [Investigating / Containing / Recovering / Monitoring]
Severity: [Sev]
Impact: [business/customer/service/data impact]
Current hypothesis: [brief]
Completed actions: [top 3]
Open actions: [top 3 with owners]
Risks/blockers: [brief]
Decisions needed: [owner + deadline]
Next update: [time/timezone]

Appendix B: Decision Log Fields

  • Timestamp
  • Decision
  • Approver
  • Rationale
  • Risk accepted
  • Follow-up owner
  • Review time

9. Review & Maintenance

  • Review Cycle: This SOP should be reviewed annually or after any major incident where coordination, handoff, action tracking, or decision logging caused delay or confusion.

  • Feedback Process: Feedback is collected during the PIR from the Incident Commander, Deputy Incident Commander, Technical Lead, Communications Lead, and Scribe.

Contributor

Jayden Vo GitHub: https://github.com/jayden-vo

Contributed to the Arcana Incident Response Documentation Framework.