IncidentResponsev2

Troop Leading Procedures Task

Conditions

• Given a mission to deploy an IR Team in support of Guardnet, State IT systems, or other organization as directed by the Governor.
• Response effort is localized and a Type I / II Federal Disaster Response has not been declared.

Standards

• Receive the Mission
• Issue a warning order
• Make a tentative plan
• Start necessary movement
• Reconnoiter
• Complete the plan
• Issue the complete order
• Supervise

Procedural Steps (Checklist)

Receive the Mission

• Confirm receipt of the mission from higher headquarters.
• Document the mission parameters (who, what, where, when, why).
• Notify all IR Team leadership and key staff.
• Create initial mission folder (digital or physical).

Issue a Warning Order

• Notify all team members that a mission is pending.
• Provide known details:
  • Expected mission start
  • Location
  • Initial support needs
• Confirm acknowledgement from each member.

Make a Tentative Plan

• Conduct initial mission analysis.
• Identify tasks, constraints, and resources.
• Draft preliminary COA (Course of Action).
• Consult SME if available.

Start Necessary Movement

• Initiate movement prep (gear, transportation, documentation).
• Assign movement officer.
• Coordinate with logistics and mission partner for site access.

Reconnoiter

• Conduct remote or physical site recon (network topology, owner engagement).
• Validate assumptions in tentative plan.
• Update plan based on recon findings.

Complete the Plan

• Finalize OPORD or verbal orders.
• Coordinate support requirements.
• Validate plan with mission owner if applicable.

Issue the Complete Order

• Issue OPORD or verbal orders to IR Team.
• Conduct mission brief to cover:
  • Situation
  • Mission
  • Execution
  • Sustainment
  • Command/Signal

Supervise

• Monitor execution.
• Adjust orders as needed (FRAGOs).
• Ensure after-action capture and reporting.

Tools and Resources

Purpose	Tools
OPORD creation	Word template or Confluence
Mission tracking	SharePoint, IR Tracker
Communication	MS Teams, Phone, Radio

End State

As time allows, conduct MDMP, develop OPORD (and/or FRAGOs), and on-premises recon. If time does not allow, verbal orders are issued and documented during Cyber Incident Tracking.

References

• CALL Handbook 15-06: MDMP
• 150-LDR-5012: Troop Leading Procedures
• ADP 6-22: Army Leadership

Revision History

Date	Version	Description	Author
2025-05-02	1.1	Expanded with procedural checklist and operator details	Leo