Domain 1 · Objective reference 1.5 · Chapter 5 of 62
Investigation types and evidence requirements
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: The investigation purpose changes authority and evidence needs.
Explore the anchors
Investigate internal policy and employment matters.
Concept matching activity
Match this task or description to its concept:
Support disputes and civil claims.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
An administrative investigation examines organizational policy or conduct. Civil, criminal, regulatory and industry-related investigations have different authorities, purposes and procedural requirements. The same technical event can involve several processes. Evidence needs can therefore differ in collection authority, preservation, disclosure and documentation. Do not assume that a normal administrator’s access permits every investigative use of personal information.
Design, evidence and tradeoffs
Coordinate incident, legal, privacy, human-resources and specialist roles as appropriate. Establish the purpose, scope, evidence sources, handling and retention before avoidable changes occur. Chain-of-custody documentation records handling and control, while integrity checks help detect alteration. Neither independently proves that the original observation was accurate or lawfully obtained. Urgent containment can proceed under authorized decisions while investigation continues.
Worked example
A suspected employee data export is investigated through the approved personnel and legal route while technical responders preserve relevant logs.
Check your understanding
Why should a technical team not choose the investigation process solely from the alert label?
Show explanation
Authority, affected people, obligations and intended use of evidence determine procedural requirements beyond a product’s severity label.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.