Which team is responsible for incident response and must have cross-domain expertise across IT, HR, legal, and marketing?

Which team is responsible for incident response and must have cross-domain expertise across IT, HR, legal, and marketing?

• A. Computer Incident Response Team
• B. Computer Security Incident Response Team
• C. Security Operations Center
• D. Information Security Officer

Answer: (A)

Incident response requires a dedicated, cross-functional group that can coordinate across IT, HR, legal, and marketing to lead the full lifecycle of handling security events. The team responsible for this is the incident response team, whose mandate is to detect, analyze, contain, eradicate, recover from, and learn from incidents while coordinating with various departments to address technical, legal, and communications needs. IT provides technical containment and remediation; HR handles personnel-related issues; legal ensures regulatory compliance and breach notifications; marketing or communications manages public statements and stakeholder messaging. The other options describe functions like monitoring and detection (which a security operations center primarily does) or a leadership role that sets policy rather than drives the response, but they do not embody the cross-functional incident response capability in one dedicated team.

Incident response requires a dedicated, cross-functional group that can coordinate across IT, HR, legal, and marketing to lead the full lifecycle of handling security events. The team responsible for this is the incident response team, whose mandate is to detect, analyze, contain, eradicate, recover from, and learn from incidents while coordinating with various departments to address technical, legal, and communications needs. IT provides technical containment and remediation; HR handles personnel-related issues; legal ensures regulatory compliance and breach notifications; marketing or communications manages public statements and stakeholder messaging. The other options describe functions like monitoring and detection (which a security operations center primarily does) or a leadership role that sets policy rather than drives the response, but they do not embody the cross-functional incident response capability in one dedicated team.