Which stakeholder is responsible for coordinating incident response among various business units, minimizing damage, and reporting to regulatory agencies?

Management holds the authority and accountability required to direct personnel across multiple business units during an incident, ensuring a unified organizational response. They are also the appropriate stakeholders to communicate with and report to regulatory agencies, as this requires organizational authority and legal accountability. Minimizing business damage involves executive-level decisions around resource allocation and risk acceptance that only management can authorize.

Public affairs and media relations is responsible for crafting and delivering external communications and press statements, not for coordinating technical or operational response across business units.

CSIRT (Computer Security Incident Response Team) handles the technical investigation and containment of incidents but does not have the organizational authority to direct all business units or fulfill regulatory reporting responsibilities.

PSIRT (Product Security Incident Response Team) is a vendor-side team that manages vulnerability disclosures in specific products, not an internal incident coordinator for an organization's business units.