IncidentResponsev2

Partner Engagements Task

Conditions

• Given a mission to deploy an IR Team in support of Guardnet, State IT systems, or other organization as directed by the Governor.
• Response effort is localized and a Type I / II Federal Disaster Response has not been declared.

Standards

• Verify personnel status: State Active Duty (SAD) or T32.
• Work with mission partner POC to understand support requirements.
• Recognize mission partner authority.
• Coordinate MOUs and NDAs.
• Provide updates to mission partner POC.
• Make recommendations as appropriate.
• Avoid interacting with mission partner systems without approval.
• Prepare to share all findings.
• Report any illegal activity immediately to mission partner and authorities.

Procedural Steps (Checklist)

Verify Personnel Status

• Confirm team members’ duty status and readiness.
• Share personnel summary with mission partner for accountability.

Work with Mission Partner POC

• Identify and document primary POC.
• Conduct initial meeting to gather requirements and expectations.
• Clarify reporting expectations and meeting cadence.

Respect Mission Partner Authority

• Ensure IR team members know the mission partner is in charge.
• Document and escalate any disagreements professionally.

Coordinate MOUs and NDAs

• Engage legal and partner POC to draft and sign MOUs/NDAs.
• Ensure all team members have signed documents before accessing partner systems.

Tools:

• MOU/NDA templates
• DocuSign or Adobe Acrobat

Provide Regular Updates

• Establish reporting format (summary or technical).
• Send updates at agreed intervals (daily, end of shift).
• Log updates in IR mission log.

Make Recommendations

• Document observations or improvements.
• Deliver recommendations respectfully and in writing when possible.

Avoid Unauthorized System Interaction

• Obtain written permission for all system access.
• Use approved tools only.
• Log all access and actions.

Example command for safe read-only access (Linux):

mount -o ro /dev/sda1 /mnt/analysis

Prepare to Share Findings

• Document all actions, findings, and timelines.
• Prepare both technical and executive summaries.
• Validate findings with partner before release.

Report Illegal Activity

• If identified, notify mission partner immediately.
• Pause affected IR activities until advised.
• Document reporting and responses.

References

• FM 3-13: Information Operations (Chapter 9, Soldier and Leader Engagements)

Revision History

Date	Version	Description	Author
2025-05-02	1.0	Expanded standards and detailed checklist for partner coordination	Leo