Effective Incident Response Team, The

Funding the Team

Every organization needs to have a computer incident response capability, whether that capability is provided through internal or external means. The real challenge in many cases is gaining management's approval to fund the requirements to establish a team, acquire specific resources, or even outsource the requirement. All too often, organizations wait until they become the victim of an incident to provide the funding necessary to respond quickly. This section outlines a few methods commonly used for convincing management to fund the internal response team up front, before a major incident occurs. Although this book focuses on computer incident response, these techniques may be applied equally well to any expenditure associated ...