During a major security incident, which best describes how a security team should interact with local law enforcement?

• A. Limit information sharing to internal channels, avoid any coordination with law enforcement.
• B. Establish liaison, share incident information, follow joint command or ICS as appropriate, protect evidence, and coordinate mutual aid.
• C. Act independently without contacting local authorities.
• D. Only report to base commander and defer all actions to law enforcement.

Answer: (B)

Coordinating with local law enforcement during a major security incident hinges on establishing clear cooperation and unified action. Key elements include establishing a liaison with authorities, sharing relevant incident information, operating under joint command or the Incident Command System as appropriate, protecting evidence to preserve its integrity, and coordinating mutual aid. This approach ensures a coordinated, efficient response, legal compliance, and effective use of resources. A liaison creates direct lines of communication to prevent delays and confusion. Sharing information helps both teams understand the scope, risks, and needed actions, supporting accurate decisions and safety. Following joint command or ICS aligns roles and authority, avoiding competing directions. Protecting evidence from the outset preserves its admissibility for investigations, requiring proper handling and chain of custody. Coordinating mutual aid brings in additional personnel, equipment, and expertise as needed. Limiting information to internal channels, acting independently without authorities, or deferring all actions to law enforcement without coordinated effort would hinder investigation, create jurisdictional issues, and slow the response.