search menu icon-carat-right cmu-wordmark

Communication Among Incident Responders – A Study

September 2012 Technical Note
Brett Tjaden, Robert Floodeen

In this report, the authors describe three factors for helping or hindering the cooperation of incident responders.


Software Engineering Institute

CMU/SEI Report Number



Responding to some future incident might require significant cooperation by multiple teams or organizations within an incident response community. To study the effectiveness of that cooperation, the Carnegie Mellon® Software Engineering Institute (SEI) conducted a study using a group of volunteer, autonomous incident response organizations. These organizations completed special SEI-designed tasks that required them to work together. The study identified three factors as likely to help or hinder the cooperation of incident responders: being prepared, being organized, and following incident response best practices. This technical note describes those factors and offers recommendations for implementing each one.