When an intrusion is declared, which functions beyond the security team join, and what does each decide?

## Why a declared intrusion stops being a security-team problem Triage is a security activity. Declaration is not. The moment someone with authority says *an adversary is or was inside*, the questions on the table change: does this have to be reported, to whom and by when; is the evidence going to be argued over later; is the person we are investigating sitting three desks away; who is allowed to take a production system down; who talks to the customer. None of those are technical questions and none of them are the analyst's to answer. This is the clearest structural difference between a security incident and an outage: an outage response is staffed with engineers, while an intrusion response is staffed with engineers *plus* functions that exist to manage legal, employment and disclosure risk. ### Legal counsel Counsel is usually the first non-security addition, and often the earliest. Counsel decides whether the response is directed by lawyers so that reports and advice may be protected from later disclosure, retains outside forensic specialists under that engagement, reads the contracts to see what you promised customers about notification, and owns the interpretation of regulatory duties. Counsel does not run the technical work and should not be treated as a rubber stamp collected afterwards; the protective effect of involving them depends on their involvement being real and early. ### Privacy / data protection The privacy function wears two hats at once. Outward: was personal data reached, whose, and does that drive a notification analysis. Inward: is *your investigation* a lawful and proportionate use of personal data. Reading one named employee's mailbox, endpoint telemetry or HR-system audit trail is itself processing of that person's data, and in several jurisdictions it needs a documented basis, a defined scope and a limit on who sees it. ### HR When the subject is an employee or contractor, the case is simultaneously a security investigation and an employment matter. HR owns the employment relationship, the disciplinary route, and frequently owns the very records you want to read, because HR-system data belongs to HR. HR also tells you the facts that change your whole read of the alert: that the person resigned last Tuesday, that they are on notice, that they have already been told their access will be reviewed. ### Communications Communications owns what is said externally and internally. The security team's job is to supply what is defensible and to say plainly what is still unknown, not to draft the statement or decide the audience. ### An accountable executive Somebody has to be able to say yes to things that hurt: take the order-entry system offline, disable a director's account, sign a six-figure retainer, tell the largest customer before the contract requires it. Security can recommend all of these; it cannot unilaterally accept the business consequence. A response plan that never names this person stalls at exactly the moment speed matters. ### A retained DFIR firm External forensic responders bring capacity, specialist tooling and an independence that matters when the findings will be contested. They are commonly engaged *through* counsel rather than contracted directly by security, so their work is produced to inform legal advice. ### What does not change Security keeps the technical investigation, the timeline and the containment options. Adding counsel does not mean lawyers decide which host to pull, and adding HR does not mean HR reads the logs. The pattern is: security owns the facts and the technical options; these functions own the decisions that carry legal, employment or disclosure consequences. ### Sequencing and need-to-know Not everyone joins at once. Counsel and a decision-making executive belong in early, because privilege posture and authority are needed from the start. HR joins the moment the subject is internal. Privacy joins once personal data is plausibly in scope. Communications joins before anything leaves the building. The retained firm joins when scope exceeds what the team can cover. Every addition also widens who knows. In an insider case this is a live risk rather than a formality: the subject may know the person you just added, and a leaked hint gives them time to delete a cloud copy, wipe a personal device or resign on their own terms. Keep an explicit, named distribution list, use a channel the subject cannot read, and add people because a decision needs them, not because they are senior.