What best describes the role of the Incident Response Team?

• A. The team requires key stakeholder representation and subject matter experts beyond conventional IT and security responders
• B. It should be composed only of security analysts
• C. It only handles external communications
• D. It operates without business unit involvement

Answer: (A)

Effective incident response relies on cross-functional collaboration. The team should include key stakeholders and subject matter experts beyond conventional IT and security responders because incidents affect more than technical systems—they impact operations, legal obligations, regulatory reporting, finance, and the organization’s reputation. Bringing together people from security, IT, legal/compliance, risk, communications, operations, and other business units ensures timely, informed decisions, appropriate escalation, and coordinated actions across containment, eradication, recovery, and communication with external parties.

This broader composition also supports legitimate authority to mobilize resources, make risk-based choices, and meet regulatory and contractual requirements during and after an incident. It isn’t limited to security analysts, it doesn’t focus solely on external communications, and it wouldn’t be effective if business units were excluded.