SANS Incident Handler's Handbook and PICERL Methodology P-e: P-e Multidisciplinary response team including legal, HR, public relations and IT specialists

The response team draws on several disciplines to handle the range of problems an incident can raise, for example legal counsel, HR, public relations and specialist IT staff, keeping an open mind about members who are not obviously technical.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Phase 1: Preparation – SANS Incident Handler's Handbook and PICERL Methodology

P-a P-a Written security policy that tells staff what is expected and lets the team judge whether an incident occurred
P-b P-b Incident response plan that ranks incidents by organizational impact
P-c P-c Communication plan: who the team contacts, when and why, including when to involve law enforcement
P-d P-d Document every action taken so records answer who, what, when, where, why and how
P-f P-f Response team can be granted the permissions it needs during an incident and have them removed afterwards
P-g P-g Ready tools in a jump bag: journal, contact list, bootable media, forensic laptop, tool kits, write-blocking duplicators
P-h P-h Regular drills so every team member knows and can perform their duties

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All SANS Incident Handler's Handbook and PICERL Methodology controls