An investigation into data exfiltration points to a specific employee, and management wants to interview the employee and possibly take disciplinary action. Which stakeholders should the security team involve before any of those steps are taken?

Investigations that involve an identifiable employee carry employment, privacy, and litigation implications. Human Resources owns the disciplinary process and knows the policies, union or contract terms, and documentation requirements that must be followed for any interview, suspension, or termination. Legal counsel advises on lawful evidence handling, privacy obligations, privilege, potential litigation, and whether law enforcement referral is appropriate. Involving both before acting protects the organization and keeps evidence usable. Briefing the employee's peers spreads sensitive allegations, risks alerting the subject, and can expose the organization to defamation or privacy claims; peers may be interviewed later, but only as part of a process HR and Legal direct. External auditors assess controls and financial statements; they do not approve internal disciplinary actions and are not part of the investigation's chain of authority. Law enforcement may eventually be engaged, but not every employee incident is criminal, and referring the matter without Legal's review removes the organization's control over timing and evidence. Exam caveat: the 4.8 stakeholder list also names Accounts, relevant when a financial or account-related element is involved, but the person-centered question points to HR and Legal. Operational check: open a case with HR and Legal, agree on the interview plan, and keep chain-of-custody records for all evidence.