During a data breach investigation, an organization following NIST SP 800-61 must decide whether disclosure is required under contractual and regulatory obligations, and must review potential liability before the incident is publicly reported. Which stakeholder role should the incident response team primarily engage for this determination?