Another consideration when engaging a CSIRT is the need to have a single location from which the CSIRT can operate. There are several terms in use for the physical location a CSIRT can operate from, such as a SOC or a crisis suite, but a simple term is a war room. A war room can be set up as is necessary, or, in some instances, a dedicated war room is set aside. In the former case, an existing meeting room is purposed as the war room for the duration of the entire incident. This is often the preferred option for those organizations that do not have a high enough number of incidents to necessitate a dedicated war room. For those organizations that experience a higher number of incidents or more complex incidents, there may be a need to create a dedicated war room.

The war room should have the following capabilities to facilitate a more orderly response to incidents:

• Workspaces: Each member of the CSIRT core team should have a dedicated workspace in which to perform analysis. Workspaces should include network connectivity, power, and monitors.
• Team displays: One of the frustrations CSIRT team members may encounter during an incident is the inability to share the output of the analysis. An overhead projector or a large screen can facilitate better sharing of data across the entire team.
• Note sharing: Along the lines of sharing data through team displays, there may also be the need to share information among teams that are geographically dispersed. This may also be facilitated through the use of collaboration tools such as OneNote, SharePoint, or a wiki created for the incident.
• Whiteboards: There is a good deal of information flowing in and out of a war room. Data related to assignments and running lists of compromised systems are best left on a whiteboard so that they are clear to everyone.
• Limited access: The CSIRT should limit access to a war room to only those personnel who have a legitimate need to enter. Limiting access to this area prevents information from falling into the wrong hands.