TABLE OF CONTENTS An organization should have effective systems to prevent incidents from occurring. This should minimize the organization s losses. However, regardless of how much effort is expended in incident prevention, some incidents will still occur. Once an incident has happened, initiating the investigation process promptly will increase the efficiency and effectiveness of the analysis.
Initiating an investigation or analysis involves many tasks, which are listed below. Each of these issues will be reviewed briefly.
Notification
Emergency response activities
Immediate response activities
Beginning the investigation
Initial incident reports and corrective action requests
Incident classification
Investigation management tasks
Assembling the team
Briefing the team
Restart criteria
Gathering investigation resources
Figure 2.1 shows where initiating an investigation falls within the context of the overall incident investigation process.
A notification process is needed to inform all appropriate personnel of the incident. Initial notification activities will trigger emergency and immediate response activities. Subsequent notifications will alert support organizations, regulators, and the public.
Designated individuals should report incidents to key individuals within an organization and outside of the organization. Statutory requirements and organizational policies usually specify the personnel who need to be notified, as well as the timing and content of such notifications.
A predefined process (often an emergency response plan or contingency plan) should be used to perform internal and external notifications. The organization should develop call...
