The Human Behind the Pager: Why Your Incident Response Plan Fails Without a Duty-of-Care Annex

Somewhere in your incident response plan is a contact tree, a severity matrix, and a section on forensic preservation. What it almost certainly lacks is a page describing what happens to the human being who answers the call when the breach lands at 3 a.m. on a Sunday.

That omission is more than an oversight. It is a gap in the architecture of trust itself — the same zero-trust logic your organization applies to devices and identities should extend to the people who carry the heaviest operational burden during a crisis. Right now, in most American enterprises, it doesn't.

The Responder Is Part of the Attack Surface

Consider what actually happens during a high-severity incident. The CISO or incident commander is awake, caffeinated, and making consequential decisions under extreme sleep deprivation. Meanwhile, their name, employer, and role are often discoverable in minutes — LinkedIn, state corporate filings, conference speaker bios, county property records.

Extremist forums and financially motivated extortion crews have learned that pressuring the responder can be more efficient than attacking the network. Threats against family members, doxxing of home addresses, harassment campaigns aimed at the executive's children's school — these are no longer hypotheticals. US-based security leaders have reported all of them, and law enforcement response is inconsistent at best across jurisdictions.

Add personal liability to the mix. A CISO who signs attestation documents, approves control decisions, or communicates with regulators may find themselves individually named in shareholder derivative suits or SEC scrutiny. The 2023 prosecution chatter surrounding the former Uber security chief sent a chill through the profession that has not entirely faded. Whether or not one agrees with that outcome, the lesson landed: the responder can become a defendant.

What the Organization Owes the Responder

The argument here is not sentimental. It is operational. A compromised, distracted, or legally exposed incident commander makes worse decisions, and worse decisions during an incident translate directly into dwell time, regulatory exposure, and remediation cost. Protecting the responder is a control, not a courtesy.

A serious duty-of-care annex should address four domains.

Physical and digital personal security. Before an incident ever occurs, the organization should fund and review personal privacy protections for designated incident leaders: address scrubbing services, locked credit files, hardened home network configurations, and MFA on every personal account. If the responder's home router is part of the corporate blast radius, the corporate perimeter has already failed.

Legal coverage that travels. Directors and officers policies frequently exclude certain individual actions, and indemnification agreements are often drafted for officers who are not the people actually leading response. Legal should confirm, in writing, who is covered, for what, and under which scenarios — before the 3 a.m. call, not during it.

Family communication protocols. During a major incident, the responder disappears into a war room for days. Spouses deserve to know what that means, and the family needs a simple, pre-agreed communication plan: who calls them, what they should say to unexpected visitors or journalists, and what to do if they receive a threat. This costs one meeting and a one-page document.

Decision hygiene under duress. Require that every consequential incident decision is made with a witness and documented contemporaneously. This protects the responder from retrospective second-guessing and gives counsel a defensible record. Sleep-deprived judgment is a known hazard; paper trails are the antidote.

The Checklist

Organizations serious about this should be able to answer yes to the following:

• Have designated incident leaders received a personal threat and privacy assessment within the last twelve months?
• Is there written confirmation of individual legal coverage for incident response decisions?
• Does the family of each on-call executive have a documented communication plan?
• Are incident decisions witnessed and logged in real time?
• Is there a relationship established with local law enforcement and, where relevant, the FBI field office before an incident?
• Does the organization provide post-incident psychological support with the same seriousness as technical post-mortems?

That last item deserves emphasis. The industry has grown comfortable discussing burnout, but the week after a ransomware event is not ordinary burnout territory. Responders who are expected to return to the pager without recovery time are being set up to fail on the next incident.

Extending Zero Trust to People

Zero-trust architecture rests on a simple premise: no component of the system is implicitly trustworthy, and every element deserves deliberate protection proportional to its value. The incident commander is among the highest-value elements in the enterprise during a crisis. Treating them as an unbreakable, self-protecting asset is precisely the kind of implicit trust the framework was designed to eliminate.

The organizations that weather their worst nights best are not the ones with the flashiest tooling. They are the ones where the person holding the pager is protected, covered, briefed, and backed — by policy, not by luck. Write that policy now. The 3 a.m. call is not the time to improvise.