Emphasize that most organizations cannot sustain a permanent digital forensics team. Even so, there should be people in the information security group trained to understand and manage the forensics process.
Recall that this expertise can be obtained by sending staff members to a regional or national information security conference with a digital forensics track or to dedicated digital forensics training. Organizations should be aware that this may be a costly action to take, but depending on their industry and frequency of attacks that may come in, it could be a good investment to do.