When containing an incident, who makes the final decision on whether a box should be taken offline?

The IT auditor evaluates and reports on controls and compliance after events have occurred and does not hold operational decision-making authority during active incident response.

Law enforcement may be engaged when criminal activity is involved, but they do not direct internal organizational decisions such as whether to isolate or shut down company systems.

The incident handler executes approved containment tasks but operates under the authority of the security department and does not hold final decision-making power independently.

Management owns business risk and is consulted on decisions with significant operational impact, but the technical authority to contain a security incident is delegated to the security department.

The security department - typically led by the CISO or incident response team lead - is accountable for making technical containment decisions such as isolating or shutting down compromised systems to prevent further damage or lateral movement. While management is notified due to potential business impact, the security department possesses both the technical expertise and the organizational authority to make the final call on containment actions during an active incident.