Computer Forensics JumpStart, Second Edition

Develop Your Incident Response Team

incident response team (IRT)

A team of individuals trained and prepared to recognize and immediately respond appropriately to any security incident.

Organizational policies and practices provide important guidance that applies to forensic examinations. They are designed to ensure quality and efficiency in the workplace. In an effort to properly preserve evidence, you must establish and make ready an incident response team (IRT). That team needs to know how to handle workplace situations they will encounter when conducting investigations.

Organize the Team

incident response plan

The actions an organization takes when it detects an attack, whether ongoing or after the fact.

Incident response plans are needed ...