Your cyber policy demands prompt notice and panel counsel, and only the CISO may declare — how do you make out-of-hours declaration workable?

## Why the default arrangement fails Most response plans reserve the declaration to a senior named individual, which reads well in a policy document and collapses in practice. A one-analyst team with a co-managing provider will meet its first real intrusion out of hours, and the duty officer will face a choice between acting without authority and waiting. Waiting is not neutral: evidence rotates out of appliance logs, an intruder consolidates, and the organisation later has to explain a gap between first evidence and first action. The fix is not to loosen the rules but to notice that a declaration bundles several different authorities together and that only some of them genuinely need an officer of the company. ## Separate the authority to act from the authority to bind **Operational authority** — stating that activity is adversarial, opening the case, preserving evidence, isolating a host, disconnecting an internet-facing appliance, forcing credential resets — is technical judgment applied under time pressure. It belongs with the person holding the duty phone. Write it as a standing delegation signed by the CISO: named roles, the threshold that activates it, the actions pre-authorised, and the systems where a business owner must still be woken rather than overridden. **Binding authority** — notifying the insurer, instructing outside counsel, committing money against a retainer, and anything said to a customer or regulator — carries contractual and legal consequences. It stays with executives, but it can be made fast. Pre-agree who the second and third contacts are, by name and personal number, and make it explicit that the duty officer works through the list rather than stopping at the first no-answer. ## Pre-clearing the insurance path is the real work The painful version of this scenario is discovering the panel clause during the incident. Do the work while it is quiet: - Get the insurer's out-of-hours notification channel and confirm what constitutes valid notice. Confirm in your own wording whether notifying a **circumstance** that may give rise to a claim is distinct from making a claim, since in many professional-lines wordings it is, and that distinction is what makes early notice affordable rather than something teams avoid. - Establish whether the DFIR firm you already retain is on the panel. If it is not, seek written consent in advance to use it, or accept that you have two firms and know which one you call first. - Put panel counsel's actual after-hours number in the runbook, tested. A firm you have never spoken to is not a resource at 02:00. - Agree internally what the duty officer may authorise in spend before an executive is reached, so containment is never blocked on a purchase decision. ## Where the provider fits A co-managing MSSP will often be first to see it and may hold contractual rights to contain. Two things should be written down. First, their escalation is an input to your declaration, not a substitute for it: they can contain under the contract, but only your organisation can notify your insurer or instruct your counsel. Second, define what they are permitted to do unilaterally at 02:00 and what requires your duty officer, because an ambiguous boundary produces either a provider that waits or a provider that isolates a production system nobody agreed to lose. ## Make the word cheap enough to use Every mechanism above exists to remove reasons not to declare. If notice is expensive, socially or financially, people will keep an investigation open instead, and dwell time becomes the price of a governance choice. Deliberately accept some over-declaration. Say so out loud to the executives who will hear about a retracted call, before it happens, so that the first retraction reads as the system working rather than as a failure that justifies tightening the bar. ## What you measure Three numbers keep this honest. **Time from first evidence to declaration**, which is the one an adversary cares about. **Declarations and retractions**, tracked together — zero retractions over a year is not a sign of precision, it is a sign nobody dares declare. And **how often the delegation was actually exercised versus escalated upward**, which tells you whether the written delegation is real or whether duty officers still believe they need permission. Test the whole chain the way you would test any other cold path: call the numbers, on a weekend, before you need them. ## The judgment being examined The interviewer is looking for someone who treats declaration authority as a designed system with contractual constraints rather than as a line in a policy, who can name the specific clause that will hurt them at 02:00, and who accepts a known rate of embarrassment as the price of not discovering an intrusion on day nine.