Software Engineering Institute

Responding to some future incident might require significant cooperation by multiple teams or organizations within an incident response community. To study the effectiveness of that cooperation, the Carnegie Mellon® Software Engineering Institute (SEI) conducted a study using a group of volunteer, autonomous incident response organizations. These organizations completed special SEI-designed tasks that required them to work together. The study identified three factors as likely to help or hinder the cooperation of incident responders: being prepared, being organized, and following incident response best practices. This technical note describes those factors and offers recommendations for implementing each one.