IncidentResponsev2

Establish Mission Owner Priorities and Objectives Task

Purpose

Understand mission owner’s objectives and define success criteria and minimum viable services to guide incident response decisions.

Standards

The IR Team should interview the business or mission owner to understand:

• The mission priorities
• What is required to avoid mission failure
• What is required to succeed
• Critical capabilities (services, ports, software/hardware, connectivity, confidentiality/integrity/availability requirements)

Procedural Steps (Checklist)

Prepare for the Interview

• Assign lead interviewer.
• Prepare list of questions to define minimum viable services and objectives.

Conduct Interview with Mission Owner

• Ask about:
  • Bare minimum requirements to avoid mission failure
  • Desired outcomes and success definition
  • Critical business processes
  • Acceptable downtime windows
  • Priority levels for recovery

Example Interview Questions

1. Which systems and services must remain online no matter what?
2. What would constitute mission failure?
3. What is tolerable downtime for each service?
4. Which systems are "nice to have" vs mission essential?

Document and Confirm Priorities

• Create mission owner priority matrix.
• Validate with owner and record approval.

Disseminate to IR Team

• Share documented objectives and priorities.
• Incorporate into response planning and playbooks.

Tools and Resources

Purpose	Tools
Documentation	Google Docs, Confluence
Communication	MS Teams, Email

Revision History

Date	Version	Description	Author
2025-05-02	1.1	Expanded with procedural checklist and interview examples	Leo