Question

A mid-sized company is assembling its incident response team. The security manager insists that beyond IT and security analysts, a representative from the legal department must be a standing member of the team. What is the primary reason legal counsel should be included on the incident response team?

Accepted Answer

To advise on regulatory reporting obligations, evidence handling, and liability during and after an incident

Answer

To physically disconnect affected systems from the network faster than IT staff

Answer

To write the technical malware eradication scripts used in the recovery phase

Answer

To approve the annual IT budget for new security tools