Who should be accountable for coordinating response when a critical infrastructure attack affects public services?

Why This Matters for Security Teams

When a critical infrastructure attack spills into public services, accountability is not a paperwork issue. It determines who can declare impact, stop unsafe changes, prioritize restoration, and speak for the organisation under pressure. Without a named incident leader, technical teams, operations, legal, and government stakeholders can all act with good intent but conflicting priorities, which slows containment and increases public harm.

Current guidance from CISA cyber threat advisories and the EU NIS2 Directive points toward defined incident leadership and rapid coordination across operational and regulatory boundaries. That matters more in infrastructure than in typical enterprise breaches because service restoration, safety, and public communication are all happening at once. NHIMG research on 52 NHI Breaches Analysis also shows how quickly identity failures can cascade when access and response ownership are unclear. In practice, many security teams encounter accountability gaps only after outage conditions and media pressure have already narrowed the response window.

How It Works in Practice

The accountable party should be the designated incident commander or equivalent senior response lead, backed by a predefined escalation path that includes security, operations, legal, communications, and external liaison functions. For critical infrastructure, that role often sits inside a 24/7 security operations structure or a resilience function with authority to direct containment, approve emergency credential changes, and coordinate restoration priorities. The point is not to centralize every decision, but to ensure one person or function owns the decision-making chain.

In mature programs, the incident lead does four things quickly. First, they establish scope: which systems, services, and public outcomes are affected. Second, they direct containment with operational context, so emergency actions do not create unsafe service knock-on effects. Third, they maintain a single external narrative, including regulator, customer, and public-sector coordination. Fourth, they preserve evidence and decision logs for later review. That structure aligns with lessons repeated in the Ultimate Guide to NHIs — Key Challenges and Risks, where identity-driven compromise often moves too fast for ad hoc coordination. It also reflects the reality described in Anthropic — first AI-orchestrated cyber espionage campaign report, where automated operations compress attacker timelines and force faster response decisions.

• Name the incident commander before an event, not during one.
• Pre-authorise who can isolate services, revoke credentials, and approve safe rollback.
• Keep technical containment, business continuity, and public communications on one escalation track.
• Record every decision, especially when actions affect service availability or public safety.

These controls tend to break down when responsibility is split across privately owned operators and public agencies because legal authority, service ownership, and restoration priorities do not line up cleanly.

Common Variations and Edge Cases

Tighter incident command often increases coordination overhead, so organisations must balance speed against the need for informed operational decisions. In some sectors, the accountable lead is a utility executive; in others, it is a government incident manager or sector-specific emergency coordinator. There is no universal standard for this yet, but current guidance suggests the accountable role should match who can actually direct restoration and external engagement during a crisis.

One common edge case is a hybrid incident that begins as cyber intrusion but quickly becomes a service continuity event. In that situation, security leadership should not be the only accountable party. Utility operations, safety officers, and public-sector liaisons may all need formal decision rights, while still reporting into one incident chain. Another edge case is an attack on shared suppliers or managed service platforms, where the impacted operator may not control every underlying system. Even there, accountability still belongs to the entity that can coordinate response on behalf of the affected service, not to the attacker, the vendor, or an informal working group.

The practical test is simple: if a person cannot authorize containment, coordinate restoration, and speak for the incident, that person is not the accountable lead. Mature teams document this in advance and rehearse it with regulators and partners, because confusion over ownership is what turns a cyber event into a public service failure.

Related resources from NHI Mgmt Group

• Who should be accountable when an identity failure affects critical infrastructure or delegated AI access?
• Who is accountable when a critical supplier incident affects essential services?
• Who is accountable when Infrastructure as Code changes create compliance or security failures?
• Who is accountable when identity drift or excessive access affects regulated aviation operations?