Incident Commander Sheet
Use this page to assign clear ownership during a cyber incident, outage, or urgent business disruption. One person should coordinate the response, track decisions, and keep everyone aligned.
Incident Summary
Date opened
Time opened
Incident name or short description
Incident severity
Incident commander
Primary business decision-maker
Assigned Roles
| Role | Name | Phone | Backup / Alternate | |
|---|---|---|---|---|
| Incident Commander | ||||
| Technical Lead | ||||
| IT / MSP Contact | ||||
| Executive Sponsor | ||||
| Communications Lead | ||||
| Legal / Counsel | ||||
| Cyber Insurance |
Immediate Priorities
- Confirm who is leading the response
- Confirm what systems, users, or locations are affected
- Isolate affected systems if appropriate
- Notify internal IT, MSP, or technical support
- Notify cyber insurance and other required parties
- Begin an incident log and decision log
- Keep staff aligned on who is authorized to make decisions and communicate updates
Current Situation
What is happening right now? Business impactDecisions and Priorities
| Date / Time | Owner | Decision, priority, or direction given |
|---|---|---|
Communication Guidance
Internal update owner
External update owner
Next scheduled update time
Approved spokesperson