IncidentResponsev2

Receive the Mission Task

Conditions

• Given an IR Team mission to support Guardnet, State IT systems, or another organization as directed by the Governor.
• Response effort is localized and a Type I / II Federal Disaster Response has not been declared.

Standards

Successfully understand guidance from higher and deploy appropriate resources to complete the mission.

• Receive Mission
• Issue WARNO
• Conduct Mission Analysis
• Develop Courses of Action
• Estimate Manning
• Produce OPORD
• Activate Personnel and mobilize

Procedural Steps (Checklist)

Receive Mission

• Receive official mission notification.
• Document mission requirements and limitations.
• Notify IR Team leadership.
• Create mission folder.

Issue Warning Order (WARNO)

• Draft and issue WARNO with:
  • Mission overview
  • Timeline
  • Task organization
• Confirm acknowledgment by all personnel.

Conduct Mission Analysis

• Identify mission requirements and objectives.
• Assess environment (internal network, external stakeholders).
• Identify gaps and constraints.

Develop Courses of Action (COA)

• Draft multiple COAs (best case, worst case, likely case).
• Assess risks and benefits of each.
• Select optimal COA for execution.

Estimate Manning

• Identify skills needed (forensics, network, malware).
• Assign personnel and fill gaps as necessary.
• Validate all personnel are available and fit for duty.

Produce OPORD

• Utilize OPORD template.
• Ensure Annex P (Information) and Annex H (Communications) are detailed.
• Review and approve by OIC.
• Issue OPORD.

Activate Personnel and Mobilize

• Notify personnel of mission start.
• Stage equipment and prepare movement.
• Coordinate access to mission site.

Tools and Resources

Purpose	Tools
OPORD drafting	Word or Confluence
Personnel management	Google Sheet, Excel, Task Tracker
Communication	MS Teams, Email

End State

The IR Team arrives on-site with appropriate personnel and equipment, prepared to execute defensive operations.

References

• NIST Cyber Security Framework
• NIST SP 800-61r2: Computer Security Incident Handling Guide

Revision History

Date	Version	Description	Author
2025-05-02	1.1	Expanded with procedural checklist and operator guidance	Leo