1. Purpose
The Incident Response Team RACI defines who is Responsible, Accountable, Consulted, and Informed (RACI) during information security incident management.
It prevents confusion during an incident by establishing:
- Who performs the response activity
- Who owns the decision
- Who provides specialist input
- Who must be kept informed
- Who can authorize escalation, containment, recovery, and closure
The RACI should be aligned with the organization’s Incident Management Policy, Incident Response Procedure, Incident Severity Matrix, and Incident Escalation Matrix.
2. RACI Definitions
| RACI | Meaning | Description |
|---|---|---|
| R – Responsible | Performs the work | Person/team carrying out the activity |
| A – Accountable | Owns the decision/outcome | Person ultimately responsible for the result |
| C – Consulted | Provides expertise/input | Person whose advice is required |
| I – Informed | Kept informed | Person who needs status or outcome information |
RACI Rule
Each major activity should normally have one clear Accountable role.
Multiple people may be Responsible, Consulted, or Informed where appropriate.
3. Incident Response Team Structure
A practical startup incident response structure can include:
- Incident Commander
- Security Lead
- IT / Cloud Engineering Lead
- Application / DevOps Lead
- Incident Investigator
- Privacy / Data Protection Lead
- Legal / Compliance
- Business Owner
- Customer Success / Communications
- HR
- Supplier / Vendor Owner
- Executive Management
- Business Continuity / Disaster Recovery Lead
One person may hold multiple roles in a small organization.
4. Core Incident Response RACI
| Activity | Incident Commander | Security Lead | IT / Cloud | App / DevOps | Privacy / Legal | Business Owner | Executive | Communications |
|---|---|---|---|---|---|---|---|---|
| Detect security event | I | A/R | R | R | I | I | I | I |
| Report incident | I | A/R | R | R | I | I | I | I |
| Validate incident | A | R | R | R | C | I | I | I |
| Classify severity | A/R | R | C | C | C | C | I | I |
| Activate response team | A/R | R | I | I | I | I | I | I |
| Assign incident owner | A/R | C | I | I | I | I | I | I |
| Preserve evidence | A | R | R | R | C | I | I | I |
| Contain incident | A | R | R | R | C | I | I | I |
| Investigate incident | A | R | R | R | C | C | I | I |
| Assess data exposure | A | R | C | C | R | C | I | I |
| Assess business impact | A | C | C | C | C | R | C | I |
| Determine root cause | A | R | R | R | C | C | I | I |
| Eradicate threat | A | R | R | R | C | I | I | I |
| Restore systems | A | C | R | R | C | C | I | I |
| Verify recovery | A | R | R | R | C | C | I | I |
| Assess notification requirements | A | C | C | I | R | C | I | I |
| Customer communication | A | C | I | I | C | R | C | R |
| Regulatory communication | A | C | I | I | R | C | C | I |
| Supplier communication | A | C | C | C | C | R | I | I |
| Executive escalation | R | C | I | I | C | C | A | I |
| Business continuity activation | A | C | R | R | C | R | C | I |
| Corrective actions | A | R | R | R | C | C | I | I |
| Lessons learned | A/R | R | R | R | C | C | I | C |
| Incident closure | A/R | C | C | C | C | C | I | I |
| Management review | C | C | I | I | C | C | A/R | I |
5. Incident Commander
The Incident Commander coordinates the overall response.
Responsibilities
- Activate the incident response process
- Establish incident objectives
- Confirm incident severity
- Assign response roles
- Coordinate technical and business teams
- Ensure escalation occurs when required
- Coordinate major decisions
- Maintain incident status
- Resolve response conflicts
- Ensure evidence and decisions are documented
- Coordinate recovery
- Confirm closure criteria
- Lead lessons learned
The Incident Commander does not necessarily perform the technical investigation.
Their primary responsibility is to coordinate the response and ensure the incident is controlled.
6. Security Lead
The Security Lead is responsible for security analysis and technical security direction.
Responsibilities
- Validate security incidents
- Analyze alerts and indicators
- Investigate attack activity
- Assess compromise
- Coordinate evidence preservation
- Analyze identity and access activity
- Assess lateral movement
- Identify persistence
- Coordinate containment
- Coordinate eradication
- Assess security control effectiveness
- Support root-cause analysis
- Recommend severity changes
7. IT / Cloud Engineering Lead
The IT/Cloud team manages infrastructure-level response.
Responsibilities
- Isolate affected systems
- Disable compromised accounts
- Revoke sessions
- Rotate credentials
- Restrict network access
- Review cloud configuration
- Preserve infrastructure logs
- Restore systems
- Rebuild compromised infrastructure
- Validate secure configuration
- Support backup and recovery
- Monitor recovered systems
8. Application / DevOps Lead
The Application/DevOps team manages application and development environments.
Responsibilities include:
- Investigating application compromise
- Reviewing application logs
- Reviewing CI/CD activity
- Investigating source-code changes
- Checking deployment activity
- Reviewing secrets and credentials
- Assessing application vulnerabilities
- Blocking malicious deployments
- Rebuilding affected workloads
- Validating application recovery
- Supporting secure development remediation
9. Privacy / Data Protection Lead
The Privacy/Data Protection role becomes important when personal or regulated information may be involved.
Responsibilities include:
- Identify potentially affected information
- Assess whether personal data is involved
- Determine affected individuals or categories
- Assess privacy impact
- Coordinate with legal counsel
- Assess notification requirements
- Support regulatory communication
- Support customer notification decisions
- Maintain privacy-related incident records
10. Legal / Compliance
Legal and Compliance provide advice on legal, contractual, regulatory, and compliance implications.
Responsibilities include:
- Interpret contractual requirements
- Assess legal obligations
- Assess regulatory requirements
- Support notification decisions
- Review external communications
- Coordinate legal counsel
- Assess evidence preservation requirements
- Support law-enforcement engagement where applicable
- Assess insurance requirements
- Support compliance reporting
11. Business Owner
The Business Owner represents the affected business process or service.
Responsibilities include:
- Assess business impact
- Identify critical business processes
- Determine customer/service impact
- Support prioritization of recovery
- Identify business dependencies
- Approve business recovery priorities
- Support customer-impact assessment
- Confirm business service restoration
12. Customer Success / Communications
Communications should be coordinated and controlled during significant incidents.
Responsibilities include:
- Prepare approved customer communications
- Coordinate customer updates
- Maintain communication records
- Ensure consistent messaging
- Coordinate with Legal and Privacy
- Support executive communications
- Monitor customer questions and concerns
Technical teams should not independently issue external incident communications unless explicitly authorized.
13. Executive Management
Executive Management provides organizational authority for major incidents.
Responsibilities include:
- Receive SEV-1 escalation
- Approve major business decisions
- Provide resources
- Support business continuity decisions
- Approve significant external communications where required
- Support customer-impact decisions
- Review major residual risks
- Review lessons learned
- Ensure corrective actions receive appropriate priority
14. Supplier / Vendor Owner
When a third party is involved, the Supplier Owner coordinates with the supplier.
Responsibilities include:
- Notify supplier
- Obtain supplier incident information
- Coordinate supplier investigation
- Review supplier evidence
- Track supplier corrective actions
- Assess contractual obligations
- Coordinate supplier recovery
- Update supplier risk records
15. Business Continuity / Disaster Recovery
This role becomes important when the incident affects availability or critical business operations.
Responsibilities include:
- Assess business continuity impact
- Determine whether BCP should be activated
- Coordinate alternate processing arrangements
- Coordinate disaster recovery
- Prioritize critical services
- Track recovery objectives
- Validate restored business services
16. RACI by Incident Lifecycle
| Incident Phase | Primary Accountable Role | Main Responsible Teams |
|---|---|---|
| Preparation | Security Lead | Security, IT, Engineering |
| Detection | Security Lead | Security, IT, Engineering |
| Reporting | Security Lead | All personnel |
| Validation | Security Lead | Security, IT |
| Classification | Incident Commander | Security + Business |
| Escalation | Incident Commander | Security + Management |
| Containment | Incident Commander | Security + IT/Engineering |
| Investigation | Incident Commander | Security + Technical Teams |
| Eradication | Incident Commander | Security + IT/Engineering |
| Recovery | Incident Commander | IT + Engineering + Business |
| Verification | Security Lead | Security + Technical Teams |
| Notification Assessment | Legal/Privacy | Legal + Privacy + Business |
| Communication | Business/Communications | Legal + Privacy + Business |
| Corrective Actions | Incident Commander | Assigned Action Owners |
| Lessons Learned | Incident Commander | Response Team |
| Closure | Incident Commander | Security + Business |
| Management Review | Executive Management | Incident Commander + Relevant Owners |
17. AWS SaaS Startup Example
Scenario
An AWS IAM administrator account is suspected of compromise.
The attacker may have accessed:
- IAM
- S3
- RDS
- ECS
- Secrets Manager
- CloudTrail
- Production workloads
RACI During Response
| Activity | Accountable | Responsible |
|---|---|---|
| Incident declaration | Incident Commander | Security Lead |
| IAM containment | Incident Commander | Cloud Engineering |
| CloudTrail investigation | Security Lead | Security + Cloud Engineering |
| Application investigation | Incident Commander | DevOps |
| Data exposure assessment | Privacy/Legal | Security + Cloud |
| Business impact assessment | Business Owner | Business Team |
| Credential rotation | Cloud Engineering Lead | Cloud Engineering |
| Recovery | Incident Commander | Cloud + DevOps |
| Customer notification assessment | Legal/Privacy | Legal + Business |
| Executive escalation | Executive Management | Incident Commander |
| Root cause | Incident Commander | Security + Engineering |
| Corrective actions | Incident Commander | Assigned Owners |
| Closure | Incident Commander | Response Team |
Important Principle
The technical team should be able to contain the compromised IAM identity immediately without waiting for an executive meeting when delay would increase risk.
The RACI establishes accountability without preventing necessary emergency action.
18. Small Startup RACI Model
A startup may not have dedicated personnel for every role.
For example:
| Role | Possible Startup Owner |
|---|---|
| Incident Commander | CTO / CISO / Security Lead |
| Security Lead | Security/Compliance Lead |
| Cloud Lead | DevOps Engineer |
| Application Lead | Engineering Lead |
| Privacy | Compliance/Legal |
| Business Owner | Founder / Department Head |
| Communications | Customer Success / Founder |
| Executive | Founder / CEO |
| Supplier Owner | Procurement / IT |
| BCP/DR | Operations / IT |
One person can hold multiple roles, but the organization should avoid assigning conflicting responsibilities where independence is important.
19. RACI Rules During SEV-1 Incidents
For a SEV-1 incident:
- An Incident Commander should be appointed immediately.
- Security should lead technical security analysis.
- Technical teams should perform containment and recovery.
- Business leadership should assess business impact.
- Legal/Privacy should assess notification obligations where relevant.
- Executive Management should receive appropriate escalation.
- Communications should be controlled.
- Decisions should be documented.
- The RACI should remain visible to the response team.
- Role changes should be recorded.
20. RACI for Specialized Playbooks
The RACI should also be applied to specialized incident playbooks.
Account Compromise
Security → Investigation
IT/Cloud → Account containment
Identity Owner → Access restoration
Legal/Privacy → Impact assessment
Ransomware
Security → Investigation
IT → Containment
Backup/DR → Recovery
Business → Continuity
Executive → Major decisions
Data Breach
Security → Investigation
Privacy/Legal → Impact and notification assessment
Business → Customer impact
Communications → Approved communication
Cloud Compromise
Security → Investigation
Cloud Engineering → Cloud containment
DevOps → Application assessment
Privacy/Legal → Data impact
Executive → Major escalation
Phishing
Security → Investigation
IT → Endpoint/account containment
Identity Team → Credential/MFA remediation
Business → Business impact
Privacy/Legal → Data exposure assessment where applicable
21. RACI Review and Maintenance
The RACI should be reviewed:
- At least annually
- After a major incident
- After significant organizational changes
- After changes to cloud architecture
- After changes to critical suppliers
- After changes to regulatory or contractual requirements
- After incident response testing
- When key personnel or responsibilities change
Contact information should be validated periodically.
22. RACI Testing
The organization should test whether the assigned roles actually work during an incident.
A tabletop exercise can simulate:
Security Alert → Incident Declaration → Severity Classification → Escalation → Containment → Investigation → Business Impact → Notification Assessment → Recovery → Closure
The exercise should verify:
- Everyone knows their role.
- Escalation contacts are reachable.
- Decision authority is understood.
- Technical teams can contain incidents.
- Privacy/legal support can be reached.
- Business owners understand their responsibilities.
- Executive escalation works.
- Evidence and decisions are documented.
23. Audit Evidence
Useful evidence includes:
- Approved Incident Response Team RACI
- Incident Response Policy
- Incident Response Procedure
- Incident Escalation Matrix
- Incident Severity Matrix
- Incident Contact List
- Incident records
- Incident investigation reports
- Escalation records
- Tabletop exercise records
- Lessons learned
- Corrective action records
- Management review records
- Evidence of RACI updates
24. ISO 27001 Connection
The RACI supports the organization’s incident-management arrangements by establishing roles, responsibilities, authority, escalation, communication, and accountability during information security incidents.
The exact structure should be determined according to the organization’s:
- Information security risks
- Business structure
- ISMS scope
- Incident types
- Regulatory obligations
- Customer requirements
- Supplier dependencies
- Organizational resources
The RACI itself is an organizational implementation tool; the organization should determine which roles and records are necessary based on its ISMS and risk environment.
25. Final Incident Response RACI Audit Trail
A practical audit trail is:
Incident Detected
→ Incident Reported
→ Incident Owner Assigned
→ Severity Classified
→ Incident Commander Assigned
→ Response Roles Activated
→ Escalation Completed
→ Containment Responsibilities Assigned
→ Investigation Responsibilities Assigned
→ Business Impact Owner Identified
→ Privacy/Legal Responsibilities Activated Where Required
→ Recovery Responsibilities Assigned
→ Notification Responsibilities Determined
→ Corrective Actions Assigned
→ Lessons Learned Conducted
→ Management Review Completed
→ Incident Closed
26. Final Principle
One Incident + One Clear Owner + Defined Responsibilities + Clear Decision Authority + Timely Escalation + Documented Accountability = Coordinated Incident Response.
The purpose of the RACI is not to create bureaucracy during an incident. It is to eliminate the question:
“Who is responsible for this?”
before that question becomes a problem.