Authority interfaces in cybersecurity incident response: A comparative framework for decision episodes

This study explains why technically sound interpretations, formal incident declarations and authorized decisions may still fail to produce timely action when cybersecurity response capabilities are distributed across organizational actors. A bounded open-index integrative search is combined with a structured qualitative cross-case comparison of 16 decision units across 15 public cases and 11 jurisdictions. The selected cases illustrate four case-bounded, sensitizing configurations: technically credible warning signs that do not reach institutional escalation; formal activation alongside distributed execution; connections or gaps between decision authority and material capability; and supplier-notification dependencies alongside retained organizational accountability. The framework proposes an audit organized around specific decision objects, escalation rules, activation triggers and execution levers. This is a preprint and has not been peer reviewed.