Who is allowed to say yes at 3 a.m.?
The fastest containment in the world is useless if the person holding the phone isn't sure they're allowed to press the button. Decide before the incident.
Most incident response plans fail in the same place: not detection, not tooling, but the thirty minutes where a tired human stares at a containment option and wonders if they're authorized to use it. Revoking a director's sessions at 3 a.m. feels career-limiting until you've agreed in advance that it's fine.
Decide the boring parts now
- Name the approvers. A primary and a backup, by name, per severity level. "Someone from IT" is not an approver.
- Pre-authorize the reversible actions. Session revocation, MFA reset, OAuth grant removal — agree today that these are always allowed when the evidence supports them. They're reversible; hesitation is not.
- Write down the irreversible ones. Anything that deletes data or takes a system down gets a higher bar and a second person. Say which is which before it matters.
- Log who approved what. Attribution protects the approver as much as the company. "I approved it because the evidence said X" is a complete answer in the post-incident review.
- Practice the page. Send a test incident to the on-call phone twice a year. The first time anyone sees your alerting should not be during a breach.
The pattern underneath all of this: humans are good at judgment and bad at being woken up to exercise it cold. So the system should do the reading, present one card with the evidence and the recommended action, and make approval one tap — with every action logged, attributed and reversible. That's the deal BlackPing's containment is built around: nothing happens without a yes, and yes is easy to give.