Identifying a Shared Mental Model Among Incident Responders

Typically, there is a direct correlation between the time to resolve an incident and the damage sustained by an organization, with faster resolution of the incident resulting in less damage to the organization. Therefore, improving coordination between organizations experiencing the same or related incidents allows faster resolution and hence less damage to each organization. Coordination, however, means more than simply communicating during an incident - effective communication is critical. In this paper we explore how effective communication might be improved by the development of a mental model internalized by the group's technical staff prior to an incident. In this paper, we present the results of an exercise we conducted to determine whether an ad-hoc group of incident responders share a schema for decision making, and, if not, what some of the decision criteria (questions) and types of values (answers) might be that would allow the creation of a shared mental model for incident response.