IncidentResponsev2

Create and Execute IR Team Orders Task

Conditions

• Given an OPORD for IR Team Operations

Standards

Create and execute Defensive Cyber Operations (DCO) Orders:

• Enter Request for Orders
• Establish Rules of Engagement (ROE)
• Execute supporting documents

Procedural Steps (Checklist)

Enter Request for Orders

• Identify operational requirement through mission planning.
• Draft order request specifying:
  • Scope of operation
  • Participating personnel and units
  • Mission start and end times
  • Tools/authorities required
• Submit draft to Incident Commander and legal for review.
• Send formal request via chain of command system (e.g. JOCS or email).
• Track submission and approval status.

Establish Rules of Engagement (ROE)

• Work with Legal Support and Operations to define ROE.
• ROE must clarify:
  • What actions are authorized
  • What actions require escalation
  • Any non-permissible actions
• Disseminate ROE to all IR team members.
• Store ROE document in mission folder.

Execute Supporting Documents

• Develop supporting documents such as:
  • Concept of Operations (CONOPS)
  • Execution checklist
  • Communication plan
• Review documents with team during briefing.
• Maintain version control and archive in mission log repository.

Tools

• Microsoft Word or Markdown for orders
• Email or Command and Control platforms (JOCS, Slack Ops Channel)
• File storage: SharePoint, Confluence

References

• NIST Cyber Security Framework
• NIST SP 800-184: Guide to Cyber Event Recovery

Revision History

Date	Version	Description	Author
2025-05-02	1.0	Expanded procedural checklist for orders process	Leo