Users and administrators must know more than who and when to call. Policy should dictate what to do in the event of an intrusion discovered while still in progress. By watching the intruder, you may learn which systems have been infiltrated, what techniques have been used for breaking in, and information about the scope of the attack. Imagine that you have discovered a murder in a hotel room. Your users must leave systems untouched, and administrators must make only the minimal changes necessary to keep services available.
System configuration is evidences, and changing it cleans up after the crime.
You must have people with expertise in every operating system, major application, and network device on call to investigate or recover from an incident. And you must have one person always available as the point of contact. Some organizations use their help desk as the point of contact for a potential incident. The help desk doesn't actually handle investigating the incident, but can log the request, provide a trouble ticket number, and contact the point person. You will want to have more than one person who can act as the primary contact.