Cybersecurity buying researchThe answer should name a provider role and an internal decision maker, with backups for both. A monitoring service can be continuously staffed while your approval path is unavailable.
Use the incident-response planning context in NIST SP 800-61 Rev. 3 to build an original, one-page authority table:
| Event | Provider action allowed in advance | Customer approval | Backup path |
|---|---|---|---|
| Confirmed compromised ordinary workstation | Agreed isolation, if technically supported | Notify duty contact | Secondary contact and incident bridge |
| Suspected privileged identity compromise | Investigate and preserve relevant evidence | Named identity owner for disruptive action | Executive delegate |
| Clinical or industrial system affected | Follow operationally approved playbook | Clinical/plant authority | Safety and continuity leader |
| Application restore | Provide investigation findings | Recovery owner and business owner | Alternate restore operator |
Do not fill the table with generic “IT.” Rehearse an unreachable primary contact. Record how the service continues investigating while approval is pending and who decides whether the business can tolerate interruption.
Working view: explore the first table
Event
Confirmed compromised ordinary workstation
- Provider action allowed in advance
- Agreed isolation, if technically supported
- Customer approval
- Notify duty contact
- Backup path
- Secondary contact and incident bridge
Sources cited on this page
- NIST SP 800-61 Rev. 3 ↗csrc.nist.gov