Administrative, Criminal, Civil, Regulatory: CISSP Investigation Types, Burden of Proof, and What Makes Evidence Admissible

A regional manager hears that a warehouse supervisor may be falsifying weight declarations. He logs into the supervisor's workstation with a shared admin account, opens a few spreadsheets and copies three to a USB stick. Nothing he found can now be attributed to anyone, the timestamps are his as much as the suspect's, and the copies have no hashes. A possible criminal referral is now an employment matter, because the only investigation type still viable is the one with the lowest evidentiary bar. CISSP objective 1.5 is built on that single direction: rigor can be relaxed later and never added.

Four categories of law, and one that is a contract

Objective 1.4 supplies the categories of law the investigation types map onto. Criminal law is the state prosecuting an offense against society: punishment, fines or imprisonment, beyond a reasonable doubt. Civil law is one party suing another: damages or an injunction, on a preponderance of the evidence. Administrative or regulatory law is an agency enforcing its rules: sanctions, penalties or license conditions, typically on substantial evidence. The fourth category is private or contractual: the counterparty enforces the terms, and the outcome is termination, indemnity or liquidated damages. PCI DSS lives here: a contract with the card brands, not a law. Legal systems are a separate axis, common law on precedent and civil law on codified statute, and a multinational operates under several at once.

The five investigation types

Administrative investigations are the ones a security team runs most: policy violations, misuse, suspected insider activity before it is established as anything more. They are governed by internal policy and employment law. Two disciplines protect them, authorization (a documented mandate) and proportionality (looking only at what the allegation justifies), and both keep the evidence usable if the matter escalates.

Criminal investigations belong to law enforcement; the organization is a witness and a custodian, not the investigator, and the strictest evidence handling applies. Civil investigations turn on discovery: from the moment litigation is reasonably anticipated there is a duty to preserve, implemented as a litigation hold. Failure to preserve is spoliation, which courts punish with sanctions and sometimes an adverse inference that the destroyed material was unfavorable. A retention policy is not a defense: deleting on schedule is fine until the hold, and the defect in the classic stem is the automated deletion that kept running after it.

Regulatory investigations differ in one way that catches candidates: cooperation is compelled. The regulator demands records and interviews on its own timetable, and refusing is a separate offense. Counsel manages the relationship; security supplies accurate, complete material and does not volunteer analysis. Industry standards investigations are contractual: after a suspected cardholder data compromise the card brands can require a PCI Forensic Investigator from an approved list, within days, reporting to the brands and the acquirer as well as to you.

Burden of proof: why the phrases matter

The exam tests the standards as phrases. Beyond a reasonable doubt is the criminal standard, which is why the evidence handling is strictest and a gap in custody is fatal. Preponderance of the evidence is the civil standard: more likely than not, a balance that tips just past even. Substantial evidence is the usual administrative and regulatory standard: enough that a reasonable mind could accept the conclusion. Reasonable belief is where most internal policy sits. Evidence collected to the criminal standard satisfies every lower one; evidence collected casually satisfies none of the higher ones and cannot be re-collected, because the act of looking changed it.

The four evidence types

Digital evidence is mostly documentary and trivially alterable, so authentication carries the weight: a forensic image stands in for the real thing only because a matching hash proves it is a faithful copy.

Admissibility: relevant, reliable, legally obtained

Evidence is admitted when it passes three tests, in order. It must be relevant, tending to prove or disprove a fact at issue; reliable, authentic and unaltered, which for digital evidence means hashes and an unbroken chain of custody; and legally obtained, with proper authority, consent or a warrant, and without entrapment.

Two rules of evidence sit beside the gates. The best evidence rule prefers the original; a forensically sound image with a matching hash is accepted in its place, which is the legal reason imaging and hashing exist. The hearsay rule excludes second-hand statements offered for their truth, and computer records could be argued to be exactly that. The business records exception is the answer: logs kept in the ordinary course of business by a normally functioning system are admissible, provided someone can testify to how they were produced.

Chain of custody is what proves reliability, and a gap is not a paperwork problem; it is an attack on the evidence. Two adjacent concepts: search authority, where a private employer acts on policy and consent but the state needs a warrant, and acting as an agent of law enforcement can import the warrant requirement to you; and entrapment versus enticement, where entrapment induces a crime the person would not otherwise have committed and is a defense, while enticement gives an already-willing offender a monitored target such as a honeypot and is permissible.

The legal landscape the outline names

Objective 1.4 lists the legal topics a security leader must recognize, because one incident engages several at once on different clocks. Intellectual property is four things, distinguished by what is protected and for how long.

The trade secret row is where security is legally load-bearing: access control, NDAs, labeling and egress monitoring are the evidence that the secret was a secret. Licensing is the other half of the item: software audits and copyleft obligations in GPL-family licenses are compliance issues an acquirer inherits.

Import and export controls follow the technology, not the nationality of the person carrying it, and export includes releasing technology to a foreign national inside your own country, the deemed export rule. The US regimes are the EAR for dual-use goods including most commercial cryptography and ITAR for defense articles; the multilateral Wassenaar Arrangement covers dual-use goods including intrusion software. Transborder data flow is a lawful-basis question before it is a technical one: under the GDPR, personal data leaves the EEA only to a country with an adequacy decision, under safeguards such as standard contractual clauses or binding corporate rules, or under a narrow derogation. The cloud form of the problem is in jurisdiction, blocking statutes and eDiscovery.

The privacy concepts the exam takes from the GDPR are the ones every regime echoes: a lawful basis for processing, data subject rights (access, rectification, erasure, portability), controller against processor, notification to the supervisory authority within 72 hours of awareness, and fines up to 4% of global annual turnover or 20 million euros, whichever is higher. Cybercrime law completes the set: the US Computer Fraud and Abuse Act and the UK Computer Misuse Act criminalize unauthorized access, and the Budapest Convention harmonizes offenses across its signatories.

Four stems, decoded

1. A manager suspects an employee of fraud and reviews the mailbox himself before telling anyone. The investigation just lost its evidentiary ceiling. Preserve, isolate and document first, and treat it as criminal until legal says otherwise.
2. Automated retention keeps deleting email for three weeks after counsel issues a litigation hold. Spoliation. The policy is fine; the failure is not suspending it for the material in scope, and the court may instruct an adverse inference.
3. A data protection authority opens an inquiry and a manager proposes withholding records until the internal review is complete. Regulatory: cooperation is compelled, deadlines are the agency's, and obstruction is its own offense. Counsel leads.
4. Defense counsel argues that firewall logs are hearsay. Business records exception: logs kept in the ordinary course of business on a normally functioning system are admissible, with testimony from whoever can describe how they were produced.

Investigation types are objective 1.5 and the legal, regulatory and compliance landscape is objective 1.4 of CISSP Domain 1, Security and Risk Management, 16% of the exam and its largest domain, and the legal frame around the assessment and audit objectives tested later. Work all 60 Domain 1 topics with our CISSP Domain 1 study guide.

#CISSP #ISC2 #DigitalForensics #ChainOfCustody #Investigations #Admissibility #IntellectualProperty #GDPR #InfoSec #CyberSecurity