This approach often stems from a group of individuals in the organization who see the need to address security even if the need is not recognized by higher level management. However, even having capable people available does not mean that the organization is prepared to respond. Depending on the scope of the overall volunteer effort, it is likely that even with intrusion-detection software in place in parts of the organization, serious network security incidents may still go undetected. Volunteers may be able to deal with the technical issues, but may not understand or have the information available to assess the business consequences of any steps taken. Volunteers may delay seeking and obtaining management approval to respond.
Volunteers have no bigger picture of the overall detection and response activity.
Volunteers may know in some cases whom to contact internally, but anomalies may exist. Other individuals in the company who identify a possible security incident may not be aware of the informal group and may fail to report to it. An informal group is unlikely to have external recognition and support. In addition to the foundation of management support, the empowered group must also be recognized internally and externally and prove its effectiveness, trustworthiness, and ability to everyone. Management authority and recognition are the foundation for success.