Which department is involved in computer security incident response?

• A. IT
• B. Security
• C. Legal
• D. ALL

Answer: (D)

Incident response requires coordination across different parts of an organization. IT handles the technical side—detecting, containing, and restoring systems—while Security leads the analysis of the incident, determines scope, and helps implement remediation. Legal takes care of regulatory requirements, evidence handling, and notification obligations, ensuring that any disclosures or investigations comply with laws and contracts. Because these activities span technical, legal, and regulatory aspects, effective incident response isn’t owned by a single department. The best answer reflects this cross-functional nature: all of them work together to manage and recover from an incident. In practice, teams run incident response plans that assign roles to IT, Security, and Legal (and often others) to ensure a swift, compliant, and well-documented response. For example, during a breach, IT may isolate affected systems, Security analyzes what happened and how it spread, and Legal coordinates any required notifications and preserves evidence. Relying on just one department risks missing critical steps, so involving all three is essential.