When a security incident starts, who is actually allowed to decide to take a system offline, bring in legal, or tell the executives? In this CISSP Blueprint episode, Professor Simon looks at incident management through a security manager’s lens, using a fictional healthcare provider, IncidentSecure Inc., as a teaching scenario.

He organizes the management side of the work into three questions: who decides, what is at stake, and what the organization will be able to show afterward. Along the way, he covers the difference between a role and the authority to decide, why severity should follow business impact, how legal, compliance, and communication planning fit in, and what evidence can show about an organization’s preparation and response. This is original teaching, not official ISC2 material, and it contains no exam questions.

In this episode you'll learn:

- Why incident management starts with authority and evidence, not tools

- Where incident management sits in the published CISSP exam outline (Domain 7, Security Operations)

- The difference between a role and the authority to decide, and why it matters during an incident

- Why severity should follow business impact

- Why legal, compliance, and communication planning belong in incident management

- How an organization can demonstrate preparation and follow-through, including why drills need a record

- Three questions to ask about any incident scenario, and what changes when you move toward security management

▶️ Companion YouTube Video: https://youtu.be/glg8OT8ei8w

📝 Companion Blog Post: https://professorsimon.com/blog/who-decides-during-a-security-incident

🎧 More Podcast Episodes: https://professorsimon.com/podcast

👉 Need help with your IT or cybersecurity career? Work with me: https://professorsimon.com/guidance

🔗 Resources, blog & more: https://professorsimon.com/links

🌐 Website: https://professorsimon.com

💼 LinkedIn: https://www.linkedin.com/in/leonardsimon

📸 Instagram • X • TikTok: @profsimononline

If you found this episode helpful, please follow the podcast, leave a rating or review, and share it with someone who would benefit.