The organization relies on an external firm for digital forensics during major incidents, but no agreement is in place and the firm's contacts appear nowhere in the incident response plan. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
Calling a forensics firm for the first time in the middle of a breach is like shopping for a locksmith while you're locked out at midnight. Sign the retainer now and write the firm into your plan: when you call, who you call and what they do. Haggling over terms mid-incident is the trap.
Full Explanation
When an organization depends on a third party during incident response, that dependency must be arranged in advance and built into the plan. A retainer establishes contractual terms, response commitments, confidentiality and evidence-handling expectations before they are needed, and documenting the firm's role, the conditions under which it is engaged, who may engage it and its contact details lets responders act quickly. Building an in-house forensics capability is a strategic decision that may not be justified by incident volume or cost, and it would take considerable time; the immediate gap is the unmanaged external dependency. Agreeing terms when a major incident occurs adds delay, weakens the organization's negotiating position and may find the firm unavailable when demand is high. Attaching the firm's own plan does not define how the firm fits into the organization's roles, escalation and communication, and the firm's generic plan does not reflect the organization's environment. Exam caveat: engaging forensics through legal counsel may matter for privilege, so legal should be involved in defining the engagement route. Operational check: confirm the retainer is signed and current, the plan lists who can engage the firm, and an exercise has tested the call-out.