5.3Stakeholders and digital forensics

Incident response is not a job for technicians alone. Involving the right stakeholders in the right roles—legal, PR, HR, executives, and sometimes law enforcement—separates success from failure. At the same time, whether collected evidence holds up legally later is decided by in what order and how, while preserving integrity, it was collected. This section covers mapping stakeholders and the frameworks (NIST IR categories, CMMC) and the NIST SP800-86 forensic principles, as the judgment a SOC analyst needs to act without destroying evidence.

5.3.1Stakeholders and frameworks

• Mapping stakeholders means deciding in advance who to involve, when, and in what role, according to the incident type and impact: executives (decision/approval), legal (legal risk, evidence handling), PR (external communication), HR (insider misconduct, employee matters), IT/SOC (technical response), and law enforcement (criminal investigation), mobilized per impact category. Late involvement or role confusion fatally slows response.
• NIST IR categories classify incidents by functional impact, information impact, and recoverability, framing whom to notify and the response priority. CMMC (Cybersecurity Maturity Model Certification) is a security-maturity certification framework required mainly of the U.S. defense supply chain, assessing in stages which maturity level an organization's processes reach. Both systematize "who bears what obligation."