Cyber incident management

A senior leadership skill. You can: - implement cyber incident management processes that reflect the level of risk accepted by the organisation - ensure the organisation is prepared for and can effectively respond to incidents - determine the impact of critical incidents on the organisation’s technology - lead the response to critical incidents that affect the whole organisation Examples of leadership using this skill: - helping the incident management team build relationships with senior leaders - leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents - assessing what to communicate to the board, ministers or the whole organisation, and when to do it

Quoted from the UK GDaD PCF.

Levels

1. Awareness: *Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level.* You can: Examples of leadership using this skill:

implement cyber incident management processes that reflect the level of risk accepted by the organisation
ensure the organisation is prepared for and can effectively respond to incidents
determine the impact of critical incidents on the organisation’s technology
lead the response to critical incidents that affect the whole organisation
helping the incident management team build relationships with senior leaders
leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents
assessing what to communicate to the board, ministers or the whole organisation, and when to do it
2. Working: *Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level.* You can: Examples of leadership using this skill:

implement cyber incident management processes that reflect the level of risk accepted by the organisation
ensure the organisation is prepared for and can effectively respond to incidents
determine the impact of critical incidents on the organisation’s technology
lead the response to critical incidents that affect the whole organisation
helping the incident management team build relationships with senior leaders
leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents
assessing what to communicate to the board, ministers or the whole organisation, and when to do it
3. Practitioner: *Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level.* You can: Examples of leadership using this skill:

implement cyber incident management processes that reflect the level of risk accepted by the organisation
ensure the organisation is prepared for and can effectively respond to incidents
determine the impact of critical incidents on the organisation’s technology
lead the response to critical incidents that affect the whole organisation
helping the incident management team build relationships with senior leaders
leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents
assessing what to communicate to the board, ministers or the whole organisation, and when to do it
4. Expert: *Senior leadership skill: the UK GDaD PCF defines it with one statement, not by level.* You can: Examples of leadership using this skill:

implement cyber incident management processes that reflect the level of risk accepted by the organisation
ensure the organisation is prepared for and can effectively respond to incidents
determine the impact of critical incidents on the organisation’s technology
lead the response to critical incidents that affect the whole organisation
helping the incident management team build relationships with senior leaders
leading simulation exercises with the board so they understand their role in incident response processes and the implications of potential incidents
assessing what to communicate to the board, ministers or the whole organisation, and when to do it

Contains public sector information from the UK Government Digital and Data Profession Capability Framework (https://understand-digital-data-roles-skills.service.gov.uk/), licensed under the Open Government Licence v3.0. © Crown copyright.

Closest ESCO skills

handle cybersecurity incidents (close match)
manage major incidents (narrow match)
respond to incidents in cloud (narrow match)

Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.

Role levels that expect this skill

Role level	Role	Band	Expected level
Cyber security manager	Cyber security manager	8a	Practitioner
Senior cyber security manager	Cyber security manager	8b	Practitioner
Head of cyber security	Cyber security manager	8c	Practitioner
Chief information security officer	Cyber security manager	8d	Expert
Security engineer	Security engineer	6	Awareness
Junior security operations analyst	Security operations analyst	5	Awareness
Security operations analyst	Security operations analyst	6	Working
Senior security operations analyst	Security operations analyst	7	Practitioner