The incident response team can use staffing models to fit the organization's needs, including performing all of its incident response work itself (using employees), partially outsource the function to a third party or fully outsource the function to a (typically on site) third party