The 2 A.M. Decision: Who Can Authorize What During a Cyber Crisis

The ransomware note appears at 2 a.m. on a Saturday. The on-call engineer can see the affected systems and knows what isolating them would cost the business. What they do not know is whether they are allowed to do it.

So the clock runs while messages go up the chain. By the time someone with unambiguous authority joins the call, the question is no longer whether to isolate one segment. It is how many more are affected.

Incident response plans usually document the technical steps. Fewer document the authority: who can take a system down, engage the retainer, approve emergency spend, or decide that a customer gets called. That matrix is the part the 2 a.m. hour tests.

TLDR

• Document decision authority per decision type, not per person.

• Give the on-call tier pre-authorized actions with defined blast-radius limits.

• Name first and second alternates for every authority; crises ignore calendars.

• Pre-approve spending routes for the response retainer and emergency procurement.

• Test the matrix in a tabletop that starts at an inconvenient hour.

Authority gaps are the silent delay

Post-incident reviews tend to focus on the attacker's timeline. The more uncomfortable timeline is internal: the 90 minutes between detection and the decision to isolate, spent finding someone who felt empowered to say yes.

NIST's incident response guidance assigns clear roles and responsibilities across the response organization. In practice that means every consequential decision type has a named authority, a fallback, and a threshold for escalation - before the incident.

Write the matrix by decision, not by role

List the decisions a real incident forces in the first hours: isolate a system or segment, fail over to backup, engage the response retainer, notify the cyber insurer, approve emergency spend, pause a customer-facing service, and call in outside counsel. For each, define who can authorize it, who is the alternate, and what limit applies.

This fictional example shows an authority matrix. It is an illustration, not a policy.

Decision	Primary authority	Alternate	Limit / note
Isolate a single system	On-call engineer	Security lead	Pre-authorized
Isolate a business segment	Security lead	CTO	Notify COO within 1 hour
Engage response retainer	General counsel	CFO	Retainer terms pre-agreed
Pause customer-facing service	COO	CEO	Board notified same day
Emergency spend	CFO	CEO	Up to a pre-set ceiling

The limits matter as much as the names. Pre-authorization with a defined blast radius lets the on-call tier act in minutes instead of waiting for permission.

Pre-approve the money and the firms

Two delays are entirely self-inflicted: negotiating the response firm's engagement letter during the incident, and finding a purchase-order route for emergency spend at 3 a.m. Both are solvable in advance with retainer terms agreed while calm and a pre-approved emergency procurement path with a ceiling.

Include the insurer. Many policies require notification within a set window and before certain costs are incurred. The matrix should say who makes that call and within how many hours of declaration.

Test it at an inconvenient hour

A matrix that works at 10 a.m. on a Tuesday may collapse on a holiday weekend when the primary is on a plane and the alternate is at a wedding. Run at least one tabletop that begins with an after-hours call, and measure how long each decision actually took.

Record the gaps the same way you record technical findings: owner, fix, retest date. The goal is not faster heroes. It is a system that makes the right decision available at the worst hour.

The related discussion of the first 48 hours of a security crisis is worth your time alongside this one. The related discussion of leading through a cyber crisis is worth your time alongside this one.

Frequently asked questions

Does pre-authorization create reckless isolation risk?

Not with defined limits. Pre-authorizing the isolation of one system with mandatory notification is safer than the alternative, which is an engineer hesitating while an attacker moves. The limit and the logging keep the power bounded and reviewable.

Who should hold disclosure authority?

Usually the CEO with general counsel, informed by the security lead's facts. What matters is that the matrix names them, names the alternate, and states what happens if they are unreachable for a defined period.

How often should the matrix be reviewed?

Twice a year, after every incident, and on any change to the named people, the insurer's requirements, or the response retainer. An out-of-date matrix is worse than none because people trust it.

A Defensible Next Step

Take your incident plan and check whether it names who can authorize each first-hour decision, with alternates. If the answer is a job title with no fallback, that is the gap to close this quarter. Book a Decision-Clarity Call if you want a tested matrix.