Which stakeholder group is responsible for containment, eradication, and recovery in incident handling?

Facilitators are responsible for coordinating communication and logistics across stakeholder groups during an incident, not for directing or executing containment, eradication, and recovery operations.

Practitioners perform hands-on technical tasks during incident response but do not hold formal organizational accountability for directing the containment, eradication, and recovery phases.

According to incident response frameworks such as NIST SP 800-61, leaders and managers hold responsibility for the operational phases of incident handling - including selecting and authorizing containment strategies, directing eradication steps, and overseeing the recovery process back to normal operations. They coordinate personnel and resources while ensuring response actions align with organizational policy and risk tolerance. Their role bridges technical practitioners and executive-level decision makers during active incident response.

Decision makers are responsible for high-level strategic and policy determinations during a major incident, not for the operational management of containment, eradication, and recovery activities.