An organization is creating an incident response capability. Describe how internal security staff, managed providers, and forensic specialists can contribute together.

### The concept The material describes incident response as a function that may use internal and external resources. Internal security roles include the Chief Information Security Officer (CISO), security engineers, and security analysts. Managed security service providers correlate logs and events, generate alerts, and hunt for threats. Forensic specialists examine evidence and investigate compromised systems. Their work supports a response that contains threats, removes their causes, and restores operations. These roles can complement one another rather than being treated as interchangeable. ### What a good answer covers - Names examples of internal security roles. - Describes managed providers’ monitoring and threat-hunting tasks. - Describes forensic specialists’ examination and investigation tasks. - Connects the teams’ work to containment, eradication, and restoration. ### Terms - **CISO**: Chief Information Security Officer, a senior organizational cybersecurity role. - **Computer forensics**: Examination of computer evidence to investigate activity. - **Containment**: Limiting a threat’s spread or effect. ### Remember Monitoring, internal leadership, and forensic investigation are distinct contributions to a coordinated response.