diff --git a/docs/index.html b/docs/index.html
index 9fb38c8..6f360c0 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -445,8 +445,8 @@ <h2 id="_internet2_trust_and_identity_services_incident_handling_framework">Inte
 <div class="sectionbody">
 <div class="paragraph">
 <p><strong>Prepared by:</strong> Nicholas Roy, Director of Technology and Strategy, InCommon/Internet2 Trust and Identity Services<br>
-<strong>Version:</strong> 1.4<br>
-<strong>Date:</strong> September 5, 2019</p>
+<strong>Version:</strong> 1.5<br>
+<strong>Date:</strong> September 26, 2019</p>
 </div>
 <div class="paragraph">
 <p><strong>Document Title: Internet2 Trust and Identity Services Security Incident Handling Framework</strong><br>
@@ -547,6 +547,13 @@ <h3 id="_change_log">Change Log</h3>
 <td class="tableblock halign-left valign-top"><p class="tableblock">1.4</p></td>
 <td class="tableblock halign-left valign-top"><p class="tableblock">Nicholas Roy</p></td>
 </tr>
+<tr>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Draft</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Added language about who can declare an incident</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">September 26, 2019</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">1.5</p></td>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Nicholas Roy</p></td>
+</tr>
 </tbody>
 </table>
 <div style="page-break-after: always;"></div>
@@ -671,7 +678,7 @@ <h3 id="_roles">Roles</h3>
 <div class="olist arabic">
 <ol class="arabic">
 <li>
-<p>CSIRT Executive Sponsor, typically the Internet2 Vice President for Trust and Identity Services</p>
+<p>CSIRT Executive Sponsor, typically the Internet2 Vice President for Trust and Identity Services. Only this role can declare an incident, in consultation with a lead named by this role.</p>
 </li>
 <li>
 <p>Incident Lead, typically an Internet2 Security Lead</p>
@@ -1045,7 +1052,7 @@ <h3 id="_appendix_b_acknowledgements">Appendix B: Acknowledgements</h3>
 </div>
 <div id="footer">
 <div id="footer-text">
-Last updated 2019-09-09 13:44:00 -0600
+Last updated 2019-09-26 15:39:11 -0600
 </div>
 </div>
 </body>
diff --git a/main.adoc b/main.adoc
index 25604fd..93b99fa 100644
--- a/main.adoc
+++ b/main.adoc
@@ -3,8 +3,8 @@
 == Internet2 Trust and Identity Services Incident Handling Framework
 
 *Prepared by:* Nicholas Roy, Director of Technology and Strategy, InCommon/Internet2 Trust and Identity Services +
-*Version:* 1.4 +
-*Date:* September 5, 2019
+*Version:* 1.5 +
+*Date:* September 26, 2019
 
 
 
@@ -35,7 +35,8 @@
 |Publication|Revisions from Internet2 General Counsel|January 30, 2017|1.1|Nicholas Roy
 |Publication|Revisions to fix typos and add document repository information|February 27, 2018|1.2|Nicholas Roy
 |Draft|Support other InCommon services|July 15, 2019|1.3|Nicholas Roy
-|Draft|Changed from InCommon to Internet2 Trust and Identity Services|September 5, 2019|1.4|Nicholas Roy|
+|Draft|Changed from InCommon to Internet2 Trust and Identity Services|September 5, 2019|1.4|Nicholas Roy
+|Draft|Added language about who can declare an incident|September 26, 2019|1.5|Nicholas Roy|
 |===
 
 <<<
@@ -106,7 +107,7 @@ Upon receipt of information about a possible security threat to an Internet2 Tru
 
 Roles 1-4 make up the standing CSIRT, with all roles under 5 filled on an as-needed basis.
 
-. CSIRT Executive Sponsor, typically the Internet2 Vice President for Trust and Identity Services
+. CSIRT Executive Sponsor, typically the Internet2 Vice President for Trust and Identity Services. Only this role can declare an incident, in consultation with a lead named by this role.
 . Incident Lead, typically an Internet2 Security Lead
 . Incident Communications Representative, typically an Internet2 marketing and communication director
 . REN-ISAC liaison
diff --git a/pdf/inc-security-incident-handling-framework.pdf b/pdf/inc-security-incident-handling-framework.pdf
index 18fa10c..0ba02f0 100644
Binary files a/pdf/inc-security-incident-handling-framework.pdf and b/pdf/inc-security-incident-handling-framework.pdf differ