Incident Response for an Organisation

Who declares an incident, who is woken, who is allowed to speak, which clocks are running, and the tabletop that finds out whether any of it is true. The organisation's half of incident response — the analyst's half is segment C2.