Is it best if the IT department handles a situation requiring immediate attention?
Traditional IT departments are very good at what they do but may not have the necessary tools to perform a computer investigation in a forensically sound manner. Organizations can avoid conflicts of interest that arise from using their own IT staff. An outside computer security incident expert should be brought in as soon as possible to work with the IT, legal and/or compliance personnel to offer an outside unbiased perspective. Courts favor use of neutral third-party analysis.
