Computer Incident Response and Forensics Team Management

Section 19

Relationship Management

The primary organizational relationships for the SIR&FT, other than with the IT department, are reviewed and discussed.

Keywords

Law enforcement; legal; HR

There are many situations within the Incident Response and Forensics domains where other internal corporate organizations and/or external agencies, organizations, and third-party corporations will need to or must participate in the response efforts. It is important to identify other groups within the organization that may be needed to participate in incident handling so that their cooperation can be solicited before it is needed. As the NIST SP 800-61 says, “Every incident response team relies on the expertise, judgment, and abilities of others, including—

■  ...