The incident commander is the person who takes operational charge during a security incident. They coordinate all involved teams, make escalation decisions, and ensure the incident response plan is followed. The role is clearly separated from technical analysis: the incident commander drives the process while specialists handle the technical investigation. In your ISMS, define who can assume this role and ensure multiple people are trained for it. A rotation schedule is advisable if your organization needs round-the-clock coverage.