\cleardoublepage \part{The Team in the Organisation} \setbookpart{The Team in the Organisation}

Part IV: The Team in the Organisation

A blue team does not exist alone. It is bought, built or shared; it has roles and a shape; it takes decisions that can stop a business; it answers to regulators who set reporting clocks; and it is measured. This part treats the team as an organisational design problem and asks how AI changes each answer.

Chapters in this part:

Chapter 16, Operating Models: In-House, Managed, Hybrid and Sovereign Security Operations, compares models and treats the provider's AI.
Chapter 17, Team Design and Roles: After the Tier-1 Pyramid, treats roles that grow, shrink and appear.
Chapter 18, Decision Rights and Escalation: Who May Contain, Isolate and Disclose, treats the decisions that cannot wait.
Chapter 19, Regulation as Constraint: NIS 2, DORA, CRA, GDPR, the AI Act and the Reporting Clock, treats obligations as design constraints.
Chapter 20, Measuring the Transformed Blue Team: Speed, Coverage and Quality of Judgement, treats measures that reward the right behaviour.

Blue team functions in this part. The part concerns all five functions, with B4 Respond and B3 Investigate most of all.

The thread from the series. AI Governance described decision forums and tiers; The Transformed Security Architect described gates instead of meetings and regulation as constraint for an architect. This part applies them to the team.

What you will learn in this part:

What to keep in-house when AI does part of the work
How to shape a team when triage is automated
How to assign decision rights that can be exercised in minutes
How to design for reporting clocks and measure without rewarding the wrong thing

Part V turns to the people.