No Defined Authority to Isolate Production

No one holds an explicit, pre-established, and previously exercised mandate to cut off or isolate a production system during an incident. The decision exists only implicitly: it “goes up to management,” who cannot be reached in the middle of the night, or it gets diluted across the operator (who sees the threat), the business owner (who sees the service outage), and the service provider (who has no mandate to degrade someone else’s service).

This is structural because no document creates this authority: response plans describe analysis and communication roles, but rarely the power to deliberately degrade production, the conditions under which it may be used, its limits, and who stands in when the holder is unavailable. Deciding to shut something down is a consequential act — absent a written mandate, everyone has a rational reason not to take it on themselves.

During active encryption or ongoing exfiltration, decision delay converts directly into additional impact. The mechanism is recurring: the analyst identifies the need for isolation within minutes; the decision takes hours — tracking down the decision-maker, explaining the context from scratch, obtaining a ruling under uncertainty from someone who is only just discovering the issue and is mainly weighing the cost of the shutdown.

The fundamental asymmetry is ignored in the deliberation: unnecessary isolation costs a few hours of service; delayed isolation costs weeks of rebuilding. The first cost is visible and attributable to the decision-maker; the second is diffuse — the incentive structure therefore systematically pushes toward waiting.

Observable outcome in post-mortems: isolation happens after the impact, meaning it no longer serves any purpose.

The pattern is hard to see from the inside because everyone believes the question is settled (“we’ll call management”). The absence of authority does not show up in a document — it shows up in the divergence of answers.

The test: separately ask three people involved in incident management the precise question: “who can decide alone, at two in the morning on a public holiday, to cut the site’s Internet access or shut down the core system? Under what document’s authority?” Three different answers — or three people each pointing to someone else — confirm the pattern.

Then check the edge cases:

• backup authority: what happens if the designated decision-maker is unreachable?
• conflict of interest: who decides when the system to be isolated is the one generating revenue?
• external delegation: does an operations provider have a written mandate for immediate protective actions, or must they wake someone up for every step?

Write a short decision matrix — one page is enough:

• typical protective actions: network isolation of a machine, blocking an account, cutting an external flow, stopping a service;
• for each one: who can decide it, with what backup chain (two named alternates), and under what principle — “act then inform” for reversible actions, prior validation for irreversible ones;
• the operations provider’s authorization threshold, if applicable: what they can do on their own initiative as a protective measure.

Have this document signed by management: its real purpose is to shift the responsibility for the decision from the individual to the organization, so the on-call analyst doesn’t have to choose between caution and their own standing.

Exercise this authority at least once in a drill (see MFL-011): a mandate that has never been used becomes an open question again under stress.

Do not manage the crisis through successive authorization requests — obtain a standing mandate for the duration of the incident:

• have the reachable decision-maker validate, in writing even if brief (a timestamped message is enough), a delegation covering reversible protective actions for the duration of the incident;
• frame each decision request as a binary alternative with the cost of both branches (“isolate now: N hours of downtime; wait: encryption continues”) — this format lets a non-technical decision-maker rule quickly;
• log every decision, its author, and its time: the decision timeline protects everyone, and makes subsequent decisions faster because the framework is already established;
• if no one decides: carry out the reversible, documented actions rather than waiting — and note it. Inaction is also a decision, the least defensible of the two.