Incident Response

Internal Versus External

Today, outsourcing some IT functions has become very popular. The same holds true for incident response, as there is a growing number of commercial incident response teams available to help an organization battle crises. Care should be taken, though, in deciding whether to operate the team as an internal function or an external one. Basically, an internal team is dedicated to the company, and an external team is only available on demand. It is all too easy to contract the function and assume that it is being handled when, in fact, the team isn’t available quickly enough to fight day-to-day problems. The main reason in favor of contracting 100% of the incident response function is to save money; that is, only pay for the incident response resources when they are necessary. In our experience doing incident response in a commercial environment, we’ve never seen this approach work. In fact, we know of no reputable incident response service vendor that would sell its service to a client who wants to rely on it for 100% of incident response needs.

The most effective incident response programs we’ve seen are those in which the client has a robust internal incident response team, staffed with technically skilled and experienced personnel, and contracts with an external team (or teams) to provide on demand staff or expertise augmentation. This can be highly effective at supplying the necessary skill and expertise when needed, while still keeping costs down to a reasonable ...