In general, the IRT is comprised of a team with individuals that have different specialties; one such individual is the ___________________, who offers analytical skills and risk management. This specialist has focused forensic skills necessary for the collection and analysis of evidence.

IRT is included in the core team with specialties when needed. This type is brought by event type. Generally, full-time IRT departments support very large corporations and the government.
Most organizations activate IRT in the event of a major incident. In this case, the management of the process falls outside the information security team.
Members outside the security team have common job responsibilities. When an incident occurs, the team is pulled together to deal with an immediate threat. Once the threat is over, the team’s mission shifts to incident analysis. This analysis determines the cause of the incident and prepares recommendations. Once the final report on the incident is issued, the team will be cancelled.
The IRT usually consists of members of the information security team and representatives of other functional areas
so Information Security Representative the Information Security Representative provides risk management and analytical skills. He may also have the forensic skills needed to collect and analyze evidence.