A security analyst notices PII has been copied from the customer database to an anonymous FTP server in the DMZ. Firewall logs indicate the customer database has not been accessed from anonymous FTP server.

Which of the following departments should make a decision about pursuing further investigation? (Choose two.)