Incidents stall when no one's sure who can authorize drastic action. Establishing in advance who can isolate systems, engage counsel, or approve disclosure removes the hesitation that lets a contained problem spread.
“In a crisis, unclear authority is a second attacker.”