Index / Investigation and response

Investigation and response

Triage, evidence, escalation and the departing employee.

• ProcedureCaseworkTriage: Separating Mistakes From MaliceMost alerts are people doing their jobs. The triage question is which of the remainder needs a h
• ProcedureCaseworkInvestigation Practice and Evidence HandlingAn investigation that reaches the right conclusion by the wrong method is unusable. The practice
• ChecklistPeopleThe Departing EmployeeThe single highest-yield focus in insider risk, and the one with the clearest window for action.
• ProcedureCaseworkContainment: The First HourThe decisions taken before anyone understands the situation, and how to avoid the ones that dest
• ProcedureCaseworkPost-Incident ReviewThe review is where a programme learns, and it is routinely skipped because the case is closed a
• ReferenceCaseworkCommunicating an Incident InternallyWho needs to know, what they need, and the leaks that come from the response rather than the inc