title = "Crisis Management for Major Cyber Incidents"

content = """
A major cyber incident — one that significantly degrades mission-critical systems,
results in substantial data exfiltration, or attracts public attention — requires
a structured crisis management approach that goes beyond routine incident response
procedures. Crisis management coordinates technical response with command decisions,
legal requirements, communications, and resource mobilization.

**Crisis Declaration:** The unit commander declares a cyber crisis when an incident
exceeds routine response capacity, affects multiple systems simultaneously, or meets
the Significant Cyber Event (SCE) threshold. Crisis declaration activates the unit's
crisis action team (CAT), which includes the unit commander, Cyber Operations Officer,
ISSO, legal advisor, and public affairs officer as appropriate.

**Crisis Action Team Responsibilities:** The CyOps O leads technical response and
provides periodic situation reports to the commander every two hours during active
crisis operations. The legal advisor monitors authority boundaries and advises on
notifications to oversight bodies. The commander approves resource surges, requests
for external support, and all public communications.

**External Support Requests:** When organic capability is insufficient, the unit can
request support from the service CERT, JFHQ-DODIN, or NSA Cybersecurity Directorate.
Support requests are submitted through the chain of command with a clear description
of the gap and the support required. External teams are integrated under a unified
command structure with a single designated incident commander.

**Communications Management:** External communications during a cyber crisis — including
statements to media, notifications to oversight bodies, and notifications to affected
individuals — are coordinated through the public affairs officer and legal advisor.
No team member provides unauthorized public statements about an ongoing investigation.

**Recovery Decision Authority:** The decision to bring a compromised system back online
rests with the authorizing official (AO) in coordination with the ISSO and the unit
commander. Systems are returned to production only after documented evidence of clean
status and updated monitoring is in place to detect re-compromise.
"""

version = "0.0.1"
