Imagine that you have discovered a murder in a hotel room. Your users must leave systems untouched, and administrators must make only the minimal changes necessary to keep services available. System configuration is evidences, and changing it cleans up after the crime. You must have people with expertise in every operating system, major application, and network device on call to investigate or recover from an incident. And you must have one person always available as the point of contact.
Some organizations use their help desk as the point of contact for a potential incident.
The help desk doesn't actually handle investigating the incident, but can log the request, provide a trouble ticket number, and contact the point person. You will want to have more than one person who can act as the primary contact. The initial contact should be made by phone, in case e-mail has been compromised. The investigator will also have to decide, if the incident is still in progress, to shutdown the system or to monitor traffic or keystrokes. After the triage phase, the investigator needs to take steps to prevent the incident from happening again.