An information security manager is setting up an investigation capability so that any incident which might involve regulators or prosecution is handled defensibly from the outset. Several drivers compete for attention. Which one should most strongly shape how the investigation is conducted before responders touch any evidence?
- AThe technical preferences of the forensic team for the imaging and analysis tooling they are most experienced and comfortable using day to day.
- BThe speed with which the affected systems can be returned to normal production so that the business disruption from the incident is minimised.
- CThe expectations of senior executives who want a clear narrative of what happened delivered to the board as quickly as the team can produce it.
- DThe legal and regulatory requirements applicable to the incident, established with counsel before evidence is handled and used to govern the procedures. Correct
Why A is wrong: Tool familiarity speeds the work, but choosing the approach around team comfort can produce evidence handling that fails the legal tests an outside authority will apply.
Why B is wrong: Fast restoration matters to the business, yet prioritising it can overwrite or destroy evidence and undermine any later regulatory or criminal proceeding.
Why C is wrong: Executive demand for a quick narrative is real, but letting reporting pressure drive the method risks shortcuts that compromise evidence and the eventual legal position.
Why D is correct: Defining the applicable legal and regulatory requirements first, with counsel, sets the standards every later handling step must meet, which is what makes the investigation defensible.