An organization is forming its incident response team. The draft roster includes only network, systems and security engineers. Which change would MOST improve the team's ability to manage a significant data breach?
Select an answer to reveal the explanation.
Short Explanation
A data breach isn't just a technical puzzle; it's a legal, people and reputation problem all at once. You need lawyers, HR, communications and the business at the table, not just engineers. More engineers is the trap; you'll analyze faster but still stumble on notification, employees and the press.
Full Explanation
Significant incidents, especially data breaches, have consequences well beyond technology. Legal counsel advises on notification obligations, evidence handling and liability; human resources handles incidents involving employees, including insiders; communications manages messages to staff, customers and the media; and business unit representatives judge operational impact and make decisions about their processes. Including designated representatives from these functions in the incident response team, with defined roles, allows the organization to respond in a coordinated way. More senior engineers strengthen technical capacity, which may be useful, but the roster's real gap is the non-technical expertise that a breach demands. A penetration testing firm tests for vulnerabilities; it is not an incident response function and adds nothing to managing legal, personnel or communication consequences. Having the internal audit manager review each decision as it is made compromises audit independence and slows the response; audit's role is to evaluate the process afterward. Exam caveat: not every function needs to join every incident; the plan should define when each is engaged based on incident type and severity. Operational check: confirm each non-technical representative has a named deputy, current contact details and an engagement trigger in the plan.