Command Is a Role

Before the detail — Decision: assign the incident-command roles to named people before the first page, not during it. Outcome: a commander who decides and does not fix, and an operations group that is the only one allowed to touch the running system. Artifact: role cards, one per seat, valid only when every seat names a real, reachable person. Status of what follows: common baseline. Unified Command applies only when the responsible authorities establish it; a federal participant’s presence alone does not make this role model binding.

Prompt first: draft role cards, expose the gaps

Here is our current on-call rota [paste] and the org chart for the
service that would page [paste - names and titles only].

Draft ROLE CARDS for an incident on this service: Incident Commander,
Deputy, Scribe, Subject Matter Expert/Resolver (SME — the specialist executing the fix), Customer Liaison, Internal Liaison. For
each, one line on what it owns and one line on what it may NOT do -
the Commander's line should say it may not personally run a fix.

Where the rota or org chart has no plausible person for a seat, write
MISSING. Do not invent a name to fill a gap.

Then answer directly: right now, at 02:14, which of these six seats
has a real person who would actually pick up a page?

The exercise earns its keep only when it exposes MISSING seats instead of inventing names.

The six seats, and one rule that overrides all of them

The paging vendor’s incident-command model names six seats. The Incident Commander (IC — never a rank, a seat with a job description) is “the single source of truth of what is currently happening and what is going to happen.” Alongside the IC sit a Deputy (a hot standby who can take the seat without a restart), a Scribe (the timeline is being written as it happens, not reconstructed afterward), an SME/Resolver (the person actually touching the system), a Customer Liaison, and an Internal Liaison.

One line governs all six: “Delegate all repair actions, the Incident Commander is NOT a resolver.” The Commander assigns the fix; the Commander does not run it. That single sentence is the difference between a seat that manages the incident and a seat that just does the loudest task in the room — and it is the rule 3.2 depends on when the call is to roll back before the cause is known.

Decide, don’t fix - why the split holds under pressure

One widely cited incident-management model, IMAG (Incident Management At Google — the four-group structure behind these role cards), draws the same line differently: Incident Command, Operational Work, Communication, and Planning, with one rule that reads like a constraint but is actually a control: “The operations team should be the only group modifying the system during an incident.”

The reason is not etiquette. A commander who is also typing commands is reconstructing two things after the fact instead of one: what changed, and why it was decided. Keep them separate and the review has a clean decision log to read against a clean change log; collapse them and the review first has to work out which typed command was a decision and which was just someone trying something — the exact ambiguity 3.2’s decision log exists to remove.

This training turns the same separation into a hard rule for the rehearsal in 6.1’s drill: the commander has no terminal. No laptop open, no shell, nothing to type into. If not-a-resolver is a real property of the seat, it should survive losing the keyboard entirely — and if it doesn’t survive, the role card was aspirational, not actual.

Meridian’s grid-analytics exchange runs under the same six seats day to day as FieldDesk does; nothing about a federal-facing system changes who may touch it during an ordinary incident. What changes, covered next, is the rare moment a federal counterpart is actually in the room.

What incident command honestly borrows from NIMS

Some of this vocabulary comes from NIMS (the National Incident Management System — FEMA’s federal framework for coordinating a response), specifically its 2017 third edition; that edition’s current status is itself unverified, so treat it as “the 2017 edition,” not as settled current doctrine. The 2017 NIMS edition says “the optimal span of control … is one supervisor to five subordinates … The 1:5 ratio is a guideline.” Do not convert that guideline into a mandate.

NIMS also names Unified Command for the moment a federal party is actually in the room: “there is no one ‘commander’ … jointly approved objectives.” That is not every incident touching a federal-facing system — it is the specific moment a federal counterpart shows up to co-decide, and the command structure changes shape to fit, rather than Meridian’s own six seats simply absorbing a seventh silent observer.

One more line matters more than either number: NIMS is not mandated for cyber. Presidential Policy Directive 41 (PPD-41 — the policy naming lead federal agencies for major cyber incidents) names federal coordination roles for significant cyber incidents and provides for a Cyber Unified Coordination Group (UCG — the federal cross-agency incident-response body PPD-41 creates); it does not replace every organization’s command model for every cyber incident. Calling a cyber incident’s structure “NIMS” when nothing NIMS-specific has actually been invoked is the kind of contract or revenue risk that surfaces the day someone with federal cyber-response experience reads the after-action report and asks which authority was actually exercised.

Stop and escalate when no named person will pick up the Commander seat inside the rota’s escalation window. This reopens 1.3’s coverage decision. If a binding floor exists, activate funded backup or contracted coverage, or route a written modification to contract authority; only where no binding floor exists may the named risk acceptor accept degraded coverage.

The commercial starting practice is the six-seat incident-command model above — commander, deputy, scribe, resolver, and two liaisons — run identically whether or not a federal-facing system is involved. The federal delta is Unified Command: when a party from PPD-41’s Cyber Unified Coordination Group, or another responsible authority, actually joins the response, command becomes joint, on objectives approved together, not a role Meridian’s own six seats simply absorb. The handoff artifact is the role card that names, in advance, which liaison seat carries a federal-facing system like the grid-analytics exchange, so nobody has to invent that contact under pressure. What is not equivalent: NIMS is doctrine written for physical emergencies — floods, fires, mass-casualty events — applied to cyber incident structure by analogy, not a cyber mandate in its own right.

Practice status — among organizations running an incident-command role model, commercial and federal

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

Six named seats, one governing rule: the Incident Commander decides and does not fix, and operations is the only group that touches the running system while an incident is open. NIMS lends a span-of-control guideline — one supervisor to five subordinates — and Unified Command for the moment a federal party actually joins — cyber incidents run under PPD-41’s Cyber Unified Coordination Group instead. The next lesson puts the commander to work on the hardest call of the incident: deciding before the cause is known.

LEADERSHIP DECISION   name the six seats against real people before
                      the first page, and fund the gap 1.3 surfaces
                      rather than discovering it live
PRACTITIONER ACTION   build role cards from the actual rota and org
                      chart, mark every unfilled seat MISSING, and
                      run 6.1's no-terminal drill against the commander
                      seat specifically
SUCCESS MEASURE       every seat on the current rota has a named,
                      reachable person - zero MISSING seats discovered
                      for the first time during a live incident