Which of the following trio of roles is typically found on an incident response team?

• A. IT help desk, facilities manager, purchasing agent.
• B. Incident commander, security analyst, communications lead.
• C. Security guard, receptionist, HR liaison.
• D. Data analyst, network administrator, compliance officer.

Answer: (B)

Incident response hinges on three essential functions: leadership to command and coordinate the actions, technical investigation to detect, triage, contain, and eradicate the threat, and communications to ensure accurate, timely information flows to all stakeholders. An incident commander provides overall direction, sets priorities, and keeps the response on track. A security analyst carries out the technical work—monitoring systems, assessing the incident, determining scope, and guiding containment and remediation efforts. A communications lead handles messaging, keeps internal teams informed, and coordinates external communications as needed, helping to manage visibility and preserve trust.

Other groupings miss one of these critical pillars. Roles focused on general operations or facilities, without a clear leadership or communication point, don’t provide the coordinated command needed during an incident. Similarly, combinations that rely mainly on technical staff but omit a designated commander or communications liaison can lead to disjointed actions and unclear guidance. That combination best covers the key needs of an effective incident response.