# 📢 Role Profile: Incident Communicator

![SOC IR Communicator Avatar](../assets/SOC%20IR%20Communicator%20Avatar.png)

## 📋 Role Overview
The **Incident Communicator** owns all incident communications, creates and manages the Incident WAR Room, coordinates stakeholders, notifies executives per SLA, prepares Interim and Final Reports, manages recovery communications, and tracks recommendations—**with NO containment authority**.

---

## 🎯 Mandatory Responsibilities (SOP / Authority Matrix)
- 💬 **Own Incident Communications**: Own all internal, executive, and operational incident communications.
- 🏛️ **Create & Manage WAR Room**: Create and manage the Incident WAR Room (MS Teams/Zoom/Slack) within SLA.
- 🤝 **Coordinate Stakeholders**: Coordinate technical teams, business leads, IT infrastructure, legal, and executive stakeholders during incidents.
- ⏱️ **Executive SLA Notifications**: Notify executives according to SLA (e.g. CISO, CIO, Cyber Head within 15 minutes of SEV-1 confirmation).
- 📄 **Prepare & Distribute Interim Reports**: Draft and distribute Interim Reports during active incident phases.
- 📑 **Prepare & Distribute Final Reports**: Draft and distribute the official Final Incident Report post-incident closure.
- 🔄 **Recovery Communication**: Manage clear communications throughout the recovery and return-to-service phase.
- 📌 **Track Action Items**: Track post-incident recommendations, PIR corrective actions, and owner assignments.
- 🚫 **NO Containment Authority**: Has **NO** technical containment authority (focuses purely on command logistics & communications).

---

## 🎮 TTX Scenario Responsibilities (Loan Ransomware Incident)
- Open Incident WAR Room immediately upon SEV-1 confirmation.
- Phone alert to CISO, CIO, and Head of Cybersecurity within 15 minutes.
- Issue status updates every 30–60 minutes and maintain the master incident timeline log.

---

## 📝 Action Checklist
- [ ] Launch WAR Room and invite key responders.
- [ ] Notify CISO, CIO, and Cybersecurity Head per SLA.
- [ ] Track incident log & timelines.
- [ ] Publish 30-60 minute status updates.
- [ ] Distribute Interim Report (6-12h).
- [ ] Distribute Final Incident Report (5 business days).
- [ ] Maintain action item tracking log.