--- title: "Incident response: Operations centre | Nexus Observatory" description: "Incident response, inside Operations centre: incident response, coordinated vulnerability disclosure, CSIRT services, remote hands and field dispatch." url: https://observatory.global/operations/incident-response/ publisher: Nexus Observatory Inc. updated: 2026-11-07 --- [Nexus Observatory](https://observatory.global/) / [Operations centre](https://observatory.global/operations/) / **Incident response** # From first alarm to root cause. Incident response, inside Operations centre: incident response, coordinated vulnerability disclosure, CSIRT services, remote hands and field dispatch. Every item is traced to its specification, from NIST SP 800-61 Rev. 3 to ISO/IEC 27035-1:2023, and runs on the open Observatory Protocol. [Plan with us](https://observatory.global/contact/) Architecture [The protocol](https://observatory.global/protocol/specification/) **Technologies**: 4 **At the frontier**: 0 **Protocol functions**: 3 of 12 **Industries served**: 3 At a glance ## Incident response Preparing, detecting, containing, recovering and learning, tied to risk management. In incident response, part of Operations centre, the monitoring, incident response and governance layer holds incident response, drawn against NIST SP 800-61 Rev. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record. The problem ### From first alarm to root cause Networks generate alarms day and night. Without a team that owns them, alarms are muted, incidents repeat and service levels are argued about instead of measured. Nobody can say how well the network is really performing, or what each outage cost the people relying on it. Key facts **Specification**: NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 **Specification**: ISO/IEC 29147 · ISO/IEC 30111 **Specification**: FIRST CSIRT Services Framework **Specification**: ISO 45001:2018 **Standards**: NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 · ISO 45001:2018 · ISO/IEC 29147 Components - Field-service crew vehicle - Particulate monitoring station and sensor node - Radar stream gauge on a road bridge - Street small-cell pole with an air-quality node - "AI tower in a box" - Data hall row pair with cold-aisle containment - Network operations centre with a curved video wall Interfaces **Radio**: LTE / 5G **Time and position**: GNSS Where it works - CSIRT services In the story below 1. The system, part by part 2. Assembly 3. Installation 4. Deployment 5. Connections 6. Operation 7. Failure and recovery 8. Scale and federation 9. What you get Scenes · 13 Next steps [Plan a deployment](https://observatory.global/operations/contact/deployment/) [Open the Field Deployment Studio](https://observatory.global/studio/) [See Operations centre](https://observatory.global/operations/) [See Managed services](https://observatory.global/operations/managed-services/) 1. Operations centre · Incident response From first alarm to root cause Networks generate alarms day and night. Without a team that owns them, alarms are muted, incidents repeat and service levels are argued about instead of measured. Nobody can say how well the network is really performing, or what each outage cost the people relying on it. 2. What it does Incident response Preparing, detecting, containing, recovering and learning, tied to risk management. In incident response, part of Operations centre, the monitoring, incident response and governance layer holds incident response, drawn against NIST SP 800-61 Rev. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record. SpecificationNIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 3. Monitoring Coordinated vulnerability disclosure Receiving, triaging and fixing reported vulnerabilities, with a published contact. In incident response, part of Operations centre, the monitoring, incident response and governance layer holds coordinated vulnerability disclosure, drawn against ISO/IEC 29147 and ISO/IEC 30111. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record. SpecificationISO/IEC 29147 · ISO/IEC 30111 4. Monitoring CSIRT services The services a security response team provides to its constituency. In incident response, part of Operations centre, the monitoring, incident response and governance layer holds CSIRT services, drawn against FIRST CSIRT Services Framework. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record. SpecificationFIRST CSIRT Services Framework 5. Time and place When and where, on every record Every record made for incident response carries its time, from a clock disciplined by satellite time or a PTP grandmaster, with the position and siting record of the station that made it. When time or position degrades, the record for incident response says so, and every user downstream sees the same warning. 6. Operations, NOC, support and training Remote hands and field dispatch Local technicians sent with parts, procedures and access arranged. In incident response, part of Operations centre, the operations, NOC, support and training layer holds remote hands and field dispatch, drawn against ISO 45001:2018. We build it into every site for incident response against that standard, and keep its version and its test results on the site’s record. SpecificationISO 45001:2018 7. Trust Proved before it is trusted A node joins a network for incident response only after its hardware root of trust answers an attestation challenge. Its keys stay in secure hardware, its software arrives signed and every record it makes for incident response carries a signature, so anyone downstream can check where a value came from. 8. Evidence Traced to its specifications We trace each part of incident response to its specification: NIST SP 800-61 Rev. 3, ISO/IEC 27035-1:2023 and ISO 45001:2018. We keep the versions, configurations and test results of incident response as signed records, so a buyer or an auditor can check what was delivered against what was specified. StandardsNIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 · ISO 45001:2018 · ISO/IEC 29147 9. Failure and recovery When a node fails, the fleet knows first When a node for incident response goes silent or a sensor drifts, the node buffers its data and fails over to a second link where the site has one. The alert carries the evidence a responder needs, and the record for incident response loses nothing and counts nothing twice. 10. Field service One crew, from survey to repair One crew surveys, installs, commissions, calibrates and repairs the sites for incident response, working from each site’s own record. Each visit updates that record, so the next crew knows what is on a site for incident response, when it was last checked and why it changed, and plans spares from that history. 11. How it scales One base unit, repeated A network for incident response starts with one base node and the instruments it reads. A station adds power and radio, a site adds a relay and a fleet repeats the proven site, so capacity for incident response grows by adding units, never by replacing what works. 12. Managed services We run it; you use what it observes The status and incident record format is open. Managed Site, network operations and service-level reporting are contracted; pricing follows the sites and the service levels chosen, and changes as the network grows. You keep the data and the records; we keep the network healthy, updated, calibrated and repaired to the levels agreed. [See Managed services](https://observatory.global/operations/managed-services/) [Talk to sales](https://observatory.global/contact/sales-enquiry/) 13. Next step Incident response, planned with you Tell us the sites, the systems incident response must work with and the outcome you need, with a map or a list of addresses if you have one. An engineer replies with a survey proposal, a design and a scope for incident response, and the plan grows from one site to the network you need. [Plan a deployment](https://observatory.global/operations/contact/deployment/) [Open the Field Deployment Studio](https://observatory.global/studio/) [See Operations centre](https://observatory.global/operations/) More presentations ## See it from every side. Each opens as a full-screen presentation: deeper pages on the same subject, explainers, stories, guided tours of the places, network scenes and the observatories that came before. [All presentations](https://observatory.global/presentations/) ### In depth [Use case **Avalanche detection site**](https://observatory.global/use-cases/avalanche-detection/) [Use case **Deployable incident observatory**](https://observatory.global/use-cases/deployable-incident/) [ISIC section · ISIC O **Public administration and defence; compulsory social security**](https://observatory.global/industries/o-public-administration-and-defence-compulsory-social-security/) [ISIC section · ISIC N **Administrative and support service activities**](https://observatory.global/industries/n-administrative-and-support-service-activities/) ### Explainers [Explainer · Sports and events **Sports and events, explained**](https://observatory.global/industries/events/explainer/) [Explainer · Defence-adjacent (civil dual-use) **Defence-adjacent (civil dual-use) — Sectors** Lawful civil dual-use sensing only: northern observatories, satellite reach at high latitude, maritime safety and ice, and critical-infrastructure resilience.](https://observatory.global/industries/resilience/explainer/) [Platform **Operations centre** Alarms nobody owns](https://observatory.global/operations/) [Platform **Connectivity** Public networks were not built for this site](https://observatory.global/connectivity/) ### Stories [Story · Resilient operations **When the links fail** Observing systems matter most on the days infrastructure fails. Designing for that day means local autonomy, stored power, store-and-forward delivery and…](https://observatory.global/stories/resilient-ops/) [Story · Forest and wildfire **Seeing smoke sooner** A fire is cheapest to fight in its first hour. Ridge-top cameras, weather in the stand and satellite hot spots each see it at different times and scales;…](https://observatory.global/stories/wildfire/) [Story · Airspace and drones **A shared sky below 120 metres** Flying beyond visual line of sight turns a drone from a camera on a stick into infrastructure. It needs a command link that holds, an identity others can…](https://observatory.global/stories/airspace-drones/) ### Places and networks [Guided tour · Guided 3D tour **Mountain valley site** A private 5G tower, an automatic weather station, a compact radar and a seismic vault on real alpine terrain, joined to an edge data centre that admits, times and publishes every…](https://observatory.global/environments/mountain-valley/) [Guided tour · Guided 3D tour **Wildfire forest** Camera masts on the ridges, a weather station in the stand and a private cell: the red ground is what the ridge camera can see.](https://observatory.global/environments/wildfire-forest/) [Guided tour · Guided 3D tour **Transmission corridor** Lattice towers carry a line across open country; conductor sensors report temperature and sag, and the substation edge brings them into the grid operator’s systems.](https://observatory.global/environments/transmission-corridor/) [Network scene · NTN · Satellite **Satellite direct to device in a mountain valley** Where the valley cell cannot reach, phones on the pass road connect straight to a low-orbit satellite, which relays through its feeder link to a gateway.](https://observatory.global/environments/networks/ntn-d2d/) [Network scene · Backhaul · Fresnel zone **Microwave backhaul across a river valley** An 18 GHz hop from the church tower to a mast on the far side of the flood plain: its first Fresnel zone, clearance over the town and trees, and what a new building in the path…](https://observatory.global/environments/networks/backhaul-fresnel/) ### Heritage observatories [Heritage observatory · United States · 1961 **World-Wide Standardized Seismograph Network** In the early 1960s the United States put identical seismographs, calibrated the same way, in more than a hundred places around the world and published the records on film for…](https://observatory.global/observatories/wwssn/) [Heritage observatory · United States · 1921 **Caltech Seismological Laboratory** A laboratory in Pasadena that gave earthquakes a number. The Richter magnitude scale of 1935 depended on one instrument type in many places, a lesson as relevant to networks today…](https://observatory.global/observatories/caltech-seismo-lab/) ### Interactive tools [Interactive tool · Configure a station **Station Builder** Configure a station part by part in 3D, check the rules as you go and request a quote for the assembly.](https://observatory.global/studio/builder/) **01** What it is ## Monitoring, incident response and governance. How every node proves what it is and what it runs, how links and keys are protected, how software is traced to its source, how personal data is minimised, and how incidents are found and handled. Everything that happens on the ground across a site's life: survey, permits, design packs, logistics, installation, acceptance, training, operations, maintenance, upgrades, decommission and recycling, done safely and recorded as evidence. Each technology below carries what it is, what we do with it, and the standard it is drawn against. Security, identity and trust ### Incident response Preparing, detecting, containing, recovering and learning, tied to risk management. We design, operate and support. NIST SP 800-61 Rev. 3 · ISO/IEC 27035-1:2023 Security, identity and trust ### Coordinated vulnerability disclosure Receiving, triaging and fixing reported vulnerabilities, with a published contact. We design, operate and support. ISO/IEC 29147 · ISO/IEC 30111 · IETF RFC 9116 (security.txt) Security, identity and trust ### CSIRT services The services a security response team provides to its constituency. We operate and support. FIRST CSIRT Services Framework Field operations and lifecycle ### Remote hands and field dispatch Local technicians sent with parts, procedures and access arranged. We operate, maintain and support. ISO 45001:2018 **02** Architecture ## Where it sits, and what it speaks. Incident response draws on the spectrum below; the highlighted layers carry this area, and the protocol functions it speaks are marked. Edge tiers and multi-access edge computing 9 Modular edge data centres and the AI tower in a box 8 Servers and accelerators 8 Storage and edge data management 6 Cooling and ruggedisation 10 Kubernetes and fleet orchestration 8 OTA updates, GitOps and software supply chain 8 Confidential computing and hardware trust 8 Device identity and attestation 8 PKI, secure boot and updates 7 Zero trust and network security 7 5G and wireless security 6 OT security and software supply chain 9 Privacy and data protection 7 Keys, cryptography and post-quantum migration 9 Monitoring, incident response and governance 8 01**Join** Identity, attestation quote, signed policy. 02**Admit** Admitted for a stated scope, nothing wider. 03**Describe** What, where, how and by whom, with calibration. 04**Time** One clock across the grid, with its error bound. 05**Observe** Every value with quality and provenance. 06**Qualify** Tested against the specification, state on record. 07**Federate** Signed exchange across grids and trust domains. 08**Orchestrate** Software and configuration by signed plan. 09**Correct** A correction marks what depends on it and publishes a new version. 10**Exchange** Products reach people and applications through versioned interfaces. 11**Prove** Signed proof receipts that an independent verifier can check. 12**Exit and decommission** An open exit path, and a record that closes. **03** On the grid ## Every site joins one observing grid. The open networks on the grid today, over real relief and the geodesic cells we count them into. A site built here enrols into the same grid. ## The observing grid 1. Open instruments on the observing grid. **04** In the field ## Where this runs, sector by sector. Deployment scenarios from the sector research that rely on incident response. [Government and public safety Deployable communications and sensing for incident command A cell on wheels with satellite backhaul, mesh telemetry and environment nodes at the incident base.](https://observatory.global/sectors/public-safety/) [Industrial Mine-wide private LTE or 5G with environmental sensing Autonomy communications plus dust, blast vibration, slope and tailings monitoring.](https://observatory.global/sectors/industrial/) [Industrial Continuous methane monitoring Fenceline sensors and optical gas imaging under regulatory leak-detection cadences.](https://observatory.global/sectors/industrial/) [Agriculture Farm or cooperative agromet network with crop models Compact stations and soil probes feeding irrigation, disease and frost models.](https://observatory.global/sectors/agriculture/) [Sports and events Stadium neutral-host 5G with crowd and environment sensing A private operations slice beside the carriers' network, with heat, air and lightning sensing.](https://observatory.global/sectors/sports-events/) [Environment and climate Methane fenceline and site-level continuous monitoring Regulatory cadences in the EU and reporting levels in voluntary frameworks.](https://observatory.global/sectors/environment/) **05** Open and enterprise ## Open by default. Enterprise by contract. The open counterpart lives on the main site for anyone to read and run. The enterprise service is designed, deployed and operated with you, under contract. Open, on the main site - Status and incident record format Enterprise, on this site - Managed Site - Network operations - Service-level reporting **06** The rest of the line ## Operations centre, area by area. [Operations centre Monitoring Fleets, sites and links, in one view.](https://observatory.global/operations/monitoring/) [Operations centre Managed services We run it; you use what it observes.](https://observatory.global/operations/managed-services/) [Operations centre Service levels Written as numbers you can measure.](https://observatory.global/operations/service-levels/) [Operations centre Reporting Uptime, completeness and repairs, on record.](https://observatory.global/operations/reporting/) ## Bring us the site. Survey, design, deployment and operation for incident response. The form names who receives your details. [Talk to us](https://observatory.global/contact/) [Ask for a quote](https://observatory.global/contact/sales-enquiry/) [Nexus Observatory](https://observatory.global/) **Operations centre** . Every node watched. Every incident closed. [Talk to us](https://observatory.global/contact/) Operations centre - [Overview](https://observatory.global/operations/) - [Areas](https://observatory.global/operations/areas/) - [Technologies](https://observatory.global/operations/technologies/) - [Architecture](https://observatory.global/operations/architecture/) - [Industries](https://observatory.global/operations/industries/) - [Resources](https://observatory.global/operations/resources/) - [Contact](https://observatory.global/operations/contact/) Platforms - [Protocol & Grid](https://observatory.global/grid-services/) - [Software](https://observatory.global/software/) - [Hardware & power](https://observatory.global/hardware/) - [Sensors & instruments](https://observatory.global/sensors/) - [Connectivity](https://observatory.global/connectivity/) - [Edge compute & AI](https://observatory.global/edge-ai/) - [Earth observation & GeoAI](https://observatory.global/earth-observation/) - [Space and satellite systems](https://observatory.global/space/) - [Positioning, navigation and timing](https://observatory.global/pnt/) - [Security and trust](https://observatory.global/security-trust/) - [Digital twins and simulation](https://observatory.global/digital-twins/) - [Data & licensing](https://observatory.global/data-products/) - [Field services](https://observatory.global/field-services/) - [Design and integration](https://observatory.global/integration/) - [Test and qualification](https://observatory.global/qualification/) - [Operations centre](https://observatory.global/operations/) - [Training and enablement](https://observatory.global/training/) - [Frontier labs](https://observatory.global/labs/) Solutions - [Early warning](https://observatory.global/use-cases/street-flood/) - [Wildfire and fire weather](https://observatory.global/use-cases/wildfire-camera/) - [Environmental compliance](https://observatory.global/use-cases/methane-fenceline/) - [Asset monitoring](https://observatory.global/industries/infrastructure/) - [Private networks](https://observatory.global/connectivity/private-5g/) - [Remote power and sites](https://observatory.global/use-cases/remote-microgrid/) - [Climate and resilience](https://observatory.global/industries/climate/) - [Site twins](https://observatory.global/digital-twins/) - [Data licensing](https://observatory.global/data-products/) Industries - [Public safety](https://observatory.global/industries/public-safety/) - [Government](https://observatory.global/industries/government/) - [Cities](https://observatory.global/industries/cities/) - [Civil resilience](https://observatory.global/industries/resilience/) - [Communities](https://observatory.global/industries/communities/) - [Humanitarian](https://observatory.global/industries/humanitarian/) - [Climate](https://observatory.global/industries/climate/) - [Water](https://observatory.global/industries/water/) - [Nature](https://observatory.global/industries/nature/) - [Oceans](https://observatory.global/industries/oceans/) - [Agriculture](https://observatory.global/industries/agriculture/) - [Energy](https://observatory.global/industries/energy/) - [Telecom](https://observatory.global/industries/telecom/) - [Transport](https://observatory.global/industries/transport/) - [Infrastructure](https://observatory.global/industries/infrastructure/) - [Mining](https://observatory.global/industries/mining/) - [Industry](https://observatory.global/industries/industry/) - [Research](https://observatory.global/industries/research/) - [Education](https://observatory.global/industries/education/) - [Health](https://observatory.global/industries/health/) - [Insurance and finance](https://observatory.global/industries/insurance/) - [Events](https://observatory.global/industries/events/) Products - [Field Deployment Studio](https://observatory.global/studio/) - [Station Builder](https://observatory.global/studio/builder/) - [Field services](https://observatory.global/field-services/) - [Data products](https://observatory.global/data-products/) - [APIs and SDKs](https://observatory.global/protocol/developers/) - [Edge runtime and fleet](https://observatory.global/software/) - [Hardware catalogue](https://observatory.global/hardware/) - [Reference designs](https://observatory.global/protocol/reference-designs/) Resources - [Learn](https://observatory.global/learn/) - [Stories](https://observatory.global/stories/) - [Presentations](https://observatory.global/presentations/) - [Environments](https://observatory.global/environments/) - [Network scenes](https://observatory.global/environments/networks/) - [Observatories atlas](https://observatory.global/observatories/) - [Earth and maps](https://observatory.global/earth/) - [Technologies](https://observatory.global/technologies/) - [Countries](https://observatory.global/countries/) - [Spectrum](https://observatory.global/spectrum/) - [Observatory Protocol](https://observatory.global/protocol/) - [Specification](https://observatory.global/protocol/specification/) - [Conformance](https://observatory.global/protocol/conformance/) - [Open source](https://observatory.global/open/) - [Data credits](https://observatory.global/credits/) Company - [About](https://observatory.global/about/) - [Open governance](https://observatory.global/consortium/) - [Security and trust](https://observatory.global/security/) - [Careers](https://observatory.global/contact/careers/) - [Press](https://observatory.global/contact/press/) - [Contact sales](https://observatory.global/contact/) - [Privacy requests](https://observatory.global/privacy-request/) © 2026 Nexus Observatory Inc. [Security and trust](https://observatory.global/security/) [Privacy choices](https://observatory.global/privacy-choices/) [Accessibility](https://observatory.global/legal/accessibility/) [Privacy](https://observatory.global/legal/privacy/) [Terms](https://observatory.global/legal/terms/) [Status](https://status.observatory.global/) [Help translate](https://observatory.global/translate/)