A zero-day response needs six roles: an incident owner, a technical lead, system owners, a communications lead, a legal or compliance contact, and an executive sponsor. In a small company one person may hold several roles. What matters is that each job has a named person before the event.
The roles
| Role | Core job | Hands off to |
|---|---|---|
| Incident owner | Keeps the list, log, clock and decisions | Executive sponsor |
| Technical lead | Decides on patch, mitigation, isolation | System owners |
| System owners | Apply changes, report status | Technical lead |
| Communications lead | Writes customer, staff and public updates | Legal, executive sponsor |
| Legal or compliance contact | Judges notification duties | Incident owner |
| Executive sponsor | Approves downtime and spend, signs off notices | Board if needed |
NIST SP 800-61 Rev. 3 treats incident response as part of wider cybersecurity risk management and stresses preparation. Naming roles in advance is one concrete act of preparation.
What the incident owner does not do
The incident owner should not be the person typing commands. When the person running the response also patches servers, updates stop and decisions pile up. Separate coordination from execution even if the team is only three people.
Handoffs that fail
Three handoffs break most often.
Technical lead to communications. Engineers write precise but unreadable text. Give the communications lead a standing right to ask "what does that mean for a customer?"
System owners to technical lead. Owners say "done" without proof. Ask for a version number or a scan result with each report.
Legal to incident owner. Legal needs facts early, such as whether personal data sat on an affected host. Put a short "data on affected systems" line in the first status update.
Cover for absence
Name a deputy for each role. Zero-days do not wait for holidays. Keep a contact list outside your own email and chat systems in case those are affected.
Practice once
A 60-minute tabletop that walks through a made-up advisory shows which role is missing. See a tabletop exercise for a zero-day.
Roles in a small company
With a team of three, the founder may be executive sponsor and legal contact, one engineer technical lead, and another incident owner. That works if the duties are written down and each person knows which hat they wear during an event. Add outside counsel and a trusted vendor contact to the list before you need them.
Quick check
We are a team of five. Do we need all six roles?
You need all six jobs covered, not six people. Write down who holds each job and who is the deputy.
Who should approve downtime?
The executive sponsor, on the technical lead's recommendation, with the business cost stated.
Sources
Last reviewed: 19 October 2026.
