This decision is based on factors such as the severity of the incident, potential impact on operations, and the need to preserve evidence. While input from various stakeholders, including incident handlers, IT auditors, law enforcement (if involved), and the security department, may inform the decision-making process, management ultimately has the authority to make the final call.