Which role on an incident response team focuses on communications and legal liaison during incidents?

• A. Investigations and forensics support
• B. Communications and Legal liaison
• C. System administration
• D. Incident response lead

Answer: (B)

The key idea is identifying who handles communications and legal coordination during an incident. This role is built to manage who gets what information, when, and to whom, while also coordinating with legal counsel and regulators. It ensures that messaging to management, customers, partners, media, and authorities is accurate, consistent, and compliant, and it oversees documentation and evidence preservation to support any potential legal or regulatory actions. This focus on communication flow and legal liaison differentiates it from other roles: investigations and forensics support concentrates on gathering and analyzing data to determine cause and impact; system administration keeps the technical environment running and supports remediation; the incident response lead oversees the overall response, coordinating all teams.