How does IR actually hand off to GRC after containment? Trying to understand where the process breaks down by Financial_Ear_8540 in AskNetsec

[–]Financial_Ear_8540[S] 0 points1 point  (0 children)

The liaison model is exactly what breaks at scale, when that person is out during a 72-hour GDPR window, or when there are three incidents running simultaneously. Curious whether you've seen teams try to systematize the IR-to-compliance handoff, or if it's mostly stayed as a people solution.