Emphasize the use of an alert roster as the first line of defense and step that is taken once a CSIRT determines that an incident is in progress.
Examine the two ways an alert roster is activated:
Sequentially: This option requires that a designated contact person initiate contact with each person on the roster using the identified method.
Hierarchical: The alternate option is where the roster requires a specific number of people to be contacted who, in turn, do the same thing, and so on until all are notified.
Compare and contrast the advantages and disadvantages of sequentially or hierarchically contacting people within the CSIRT when an incident is in progress.
Detail the purpose of an alert message and why it is important to broadcast to persons within the CSIRT so the incident can be dealt with quickly and efficiently. Note that other departments such as general management, legal, communications, and human resources are notified prior to external sources using this method.
Report that other organizations may be required to be notified should the incident be part of a larger-scale assault, or it may affect them as a result.