During an incident response investigation, forensic analysis confirms that an internal employee intentionally exfiltrated customer records to a personal cloud account. The incident response coordinator needs to involve the appropriate stakeholder to handle disciplinary action against the employee in accordance with company policy. According to NIST SP 800-61, which stakeholder should the coordinator engage for this task?