Processes and Tools
Establish an ICS4ICS program and enable your team to perform during an incident with proven procedures.
Processes
Teams and Processes that Support ICS4ICS
ICS4ICS processes must be integrated with other related teams and their processes such as:
Crisis Management Team (CMT)
The Crisis Management Team (CMT) manages crisis events that threaten the operations, reputation, and any major impacts to the company. The CMT empowers the ICS4ICS Incident Commander and provides direction as needed. The Crisis Management Team consists of senior executives like the Chief Executive Officer (CEO), Chief Operations Officer (COO), Chief Financial Officer (CFO), Chief Information Officer (CIO), Health-Environment-Safety representative, and Chief Legal Counsel. There may be CMT(s) for major company divisions, particularly in other countries or geographies.
Industrial Control System/Operational Technology
The Industrial Control System/Operational Technology (ICS/OT) Team often manages many aspects of the ICS/OT Systems including system configuration and maintenance, cybersecurity settings, system recovery (DR), business recovery (BCP), and many other aspects of these systems.
Computer Incident Response Team
The Computer Incident Response Team monitors systems and data from other sources like helpdesks. This group will identify events that need to be escalated to an authorized Incident Commander who determines if an incident will be declared. This team is typically part of the IT organization.
IT Team
The IT Team supports the Computer Incident Response Team (CIRT) which is typically part of their organization. They may also support the Industrial Control System/Operations Technology team with enterprise IT processes, like backup/recovery, network support, and servers/desktop build.
Disaster Recovery Planning (DRP) Team
The Disaster Recovery Planning (DRP) Team develops IT backup/recovery strategies based on the BCP requirements. The DR Team is often part of the IT Team.
Business Continuity Planning (BCP) Team
The Business Continuity Planning (BCP) Team works with business teams to identify the critical business functions, Recovery Time Objectives to restore those business functions, and Recovery Point Objectives that determine how much data loss is acceptable.
Program Processes and Prerequisites
ICS4ICS Program Deployment Guide
Provides information to help deploy the ICS4ICS program at your company or organization.
- (Coming soon)
Delegation of Authority
Must be established to ensure a select group of people are designated as Incident Commanders and have the authority to declare an incident and have financial authority to make expenditure that may be required to resolve the incident.
Mutual Aid
Must be established to fill critical positions in the ICS4ICS organization when a company doesn’t have staff who can fill those positions. An assessment must be completed of company staff to identify positions that may need to be staffed externally. Then an agreement must be create with an external party to staff those positions.
ICS4ICS Job Aids
Summarize key activities that each member of the ICS4ICS team must perform. These guides are designed to ensure everyone can quickly remember their role and associated tasks so they can perform effectively and efficiently. ICS4ICS job aids were created from a subset of the USCG job aids And FEMA’s job aids.
Incident Command System Forms
Are used in the ICS4ICS process. These forms are provided by FEMA.
Cyber Insurance
May be leveraged by a company to provide coverage for cyber incidents. If cyber insurance is selected there may be unique incident management steps required by the policy, like having the insurance company staff included in cyber exercises and during an actual cyber incident.
Tools
Procedures
Escalation-Notification-Declaration Procedures
Can be used to define company escalation procedures with criteria for when an Incident Commander should be informed of a major event. The document includes sample criteria for declaring an Incident and information about notification alternatives.
External Information Sources Procedure
Provides a list of sources who can provide cyber security alters and other information that may help resolve cyber-attacks.
Coming soon
IT and OT Procedures
Help to prepare staff to make and execute IT and OT decisions during a cyber incident. For example, IT or OT procedures may be needed to isolate or shutdown ICS/OT systems that have been infected with malware. A procedure may be needed to help onsite IT and OT staff to assess problems before calling support staff.
ICS4ICS Exercise Team
Monthly Newsletter
Want to be added to the ICS4ICS monthly newsletter or join some of the eICS4ICS teams?