The major incident is often where the problem becomes visible. It is not necessarily where the problem began.
In cybersecurity, that compensatory period may be substantial and the early warning signs may not be dramatic. They can appear in the margins of performance. Recovery between demanding periods becomes poorer and maintaining concentration requires more effort. People may fall back on familiar ways of working, while communication becomes more effortful and tolerance for ambiguity or challenge reduces. At the same time, it becomes progressively harder to keep sight of the bigger picture. By the time obvious mistakes appear, much of the reserve may already have gone. That is why the apparent sudden failure of performance can be misleading. The failure may be sudden but the depletion that produced it was not.
The incident is the exposure point, not the cause
The practitioners I interviewed did not generally describe pressure as something that arrived with an incident and disappeared when it was contained. They described it as a standing condition of the work and a serious incident simply adds to it.
As the incident unfolds, executive scrutiny increases and customers need answers, while regulators and legal teams may become involved. The demand for communication grows at the same time as business continuity begins to compete with containment, leaving people to make difficult decisions with incomplete information and potentially significant consequences. After containment, recovery, investigation, reporting, scrutiny and organisational learning may continue for weeks or months.
One practitioner described the acute phase of an incident as‘ a week-long fist fight with Russian organised crime’, but the acute phase was only part of the experience. Others described incidents and their consequences continuing far beyond the period we would conventionally think of as incident response. This changes the question organisations need to ask. It is no longer simply: Are our people prepared for an incident? It is: How much performance capacity will they have available when it happens? The major incident is often where the problem becomes visible. It is not necessarily where the problem began.
38 WWW. INTELLIGENTCISO. COM