Incident Response

Staffing and Training

Although the size of each team is going to vary depending on its services and its available funding, there are some staffing issues that all teams should understand. It is of paramount importance that every team member have a positive, customer service-oriented attitude. This may sound like a cliché, but it’s important to the success of any service-oriented organization. When it comes to a supplier who provides emergency services, it is even more essential. Always give customers more than they expect. Great care should be taken in selecting the right staff members.

One of the reasons that the Carnegie Mellon CERT/CC organization was successful in pioneering the incident response profession is that it spent a great deal of time selecting its personnel. Here’s how an actual interview was conducted in 1988 when the CERT/CC was recruiting its technical staff. The process consisted of nine back-to-back interviews with various managers and senior technical staff. Both hiring managers and interviewees found it to be a grueling day. However, we grew to appreciate the great effort placed in selecting staff members. Each of the key staff managing, supervising, or working with a prospective employee had the opportunity to interview the applicant. In some cases, multiple days of interviewing were called for. And, in each case, every interviewer’s responses were collected and considered in the hiring decision; everyone had a say in the process. In the after-interview discussion by all of the people who interviewed the candidate, everyone was encouraged to speak openly and candidly about the candidate. The selection process is time-consuming, but essential. Take the time prior to hiring someone to make sure that the person is a good fit in every sense.

While staffing your team, it is important to remember that the collective members have to remain current in their skills and experiences. Time and resources must be devoted to training. This issue is covered in more detail in later chapters, but when staffing your team, remember to decide what percentage of each person’s time is going to be spent in training, because that will drive the decision of how many people to put on a team. While each company’s threshold is unique with regards to percentage of time and money an employee can spend in training, the argument can be made that incident response is an emergency services profession that truly requires skilled and knowledgable practitioners. Would you be comfortable with a paramedic who only knew 1980s emergency technologies and processes?

Thus, an effective team manager ensures that every penny and minute of training is well spent. In most commercial consultancies, an employee is intended to be “utilized” (that is, billed to a client) about 75-85 percent of the time. A more effective utilization level for incident response professionals is 55-65 percent with the rest of the time available for training.