Incident › Module 2 › Lesson 3
Roles RACI
Roles RACI literacy identifies incident commander, scribe, comms lead, and technical leads — assign RACI on YOUR $IR_LAB tabletop roster before live incident roles.
Visual · t34_roles_raci
Roles RACI literacy. $IR_LAB only. Original Cyberlium.
Opening
Clear roles beat heroics — literacy names IR RACI so tabletops train coordinated response on fictional org charts you document.
IR roles include incident commander (IC) who owns decisions, scribe who logs timeline, comms lead who handles stakeholders, technical leads for forensics/network/identity, and legal liaison when required. RACI assigns Responsible, Accountable, Consulted, Informed per task — one Accountable per decision. Cyberlium maps RACI on YOUR $IR_LAB — assign roles for three fictional tabletop tasks. Next: Planning Lab.
1. IR roles and RACI (named)
Incident Commander: single decision authority during active incident. Scribe: chronological log, action items, evidence references. Comms Lead: internal and external messaging per policy. Technical Lead: containment and analysis execution on YOUR org assets.
On $IR_LAB, write RACI row — task, Responsible, Accountable, Consulted, Informed for one tabletop inject.
Command guide
Try these commands — IR roles and RACI (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
NIST SP 800-61 — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/ SANS IR — https://www.sans.org/for-organizations/incident-response/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export IR_LAB=${IR_LAB:-$HOME/cyberlium-lab/t34-ir}
cat > "$IR_LAB/planning/raci-matrix.md" <<'EOF'
# RACI Matrix — YOUR IR roles (tabletop literacy)
| Activity | IR Lead | SOC | IT Ops | Legal | Comms | Exec |
|----------|---------|-----|--------|-------|-------|------|
| Triage & classify | A | R | C | I | I | I |
| Containment (authorized) | A | C | R | C | I | I |
| Evidence collection | A | R | C | C | I | I |
| External notification | C | I | I | A/R | C | I |
| Post-incident review | A | R | R | C | C | I |
R=Responsible A=Accountable C=Consulted I=Informed
Lab: assign fictional names — no real employee PII
EOFCommand — copy this
grep -E 'RACI|Containment|Post-incident' "$IR_LAB/planning/raci-matrix.md" curl -sS https://www.first.org/ | head -8
Primary tools to practice this lesson: grep, curl. Reference sites: NIST SP 800-61 (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/); SANS IR (https://www.sans.org/for-organizations/incident-response/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why RACI literacy prevents duplicate command and gaps
Two ICs issuing conflicting containment orders delay response. Missing scribe loses evidence for post-incident review. RACI on paper clarifies who decides vs who executes before stress hits.
Students assign lab roles on notes — production RACI follows org chart and on-call rotation.
3. Lab boundary
Forbidden: assigning yourself IC over stranger org incidents without authorization. Allowed: roles RACI card — four roles with $IR_LAB fictional assignments for tabletop tasks.
Ship: roles RACI card for YOUR lab roster. Next: Planning Lab.
4. What you ship: roles RACI card for $IR_LAB
Four roles with RACI rows for tabletop tasks. $IR_LAB named. chmod 600.
5. What you record before the next lesson
Date. Roles RACI card. $IR_LAB named. File t34-m02-l03-roles-raci.txt chmod 600.
6. Wrong vs right: stranger networks vs YOUR IR tabletop
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run tabletop with no IC and no scribe. Claim IC authority over stranger networks.
Right
Write roles RACI card for YOUR $IR_LAB. Next: Planning Lab.
Mission: assign RACI on YOUR lab tabletop
1) Define IC, scribe, comms, technical lead in one sentence each. 2) Write RACI for three tabletop tasks. 3) Confirm one Accountable per task. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
One IC — many contributors. RACI on paper saves arguments under pressure.
Knowledge Check
APPLY: Incident Commander primarily:
Multiple choice
Knowledge Check
APPLY: True or False: RACI assigns one Accountable party per decision or task.
True or False
Knowledge Check
APPLY: Roles RACI literacy on Cyberlium uses:
Multiple choice