5.2.2. Incident Investigation and Evaluation
💡 First Principle: An investigation's conclusions are only as credible as the evidence trail behind them — mishandled evidence can invalidate not just legal action, but the organization's own confidence in what actually happened and why.
Investigation determines root cause, scope (what was actually accessed or affected), and how the incident began — findings that directly shape both the immediate response and the post-incident remediation (5.2.5). Chain of custody — an unbroken, documented record of who handled evidence and when — is what makes those findings defensible later, whether in a regulatory inquiry, litigation, or simply an internal dispute about what happened. Investigation scope also has to be actively managed: stopping too early misses lateral movement into other systems; continuing indefinitely delays containment and recovery decisions that can't wait for perfect certainty.
⚠️ Exam Trap: Investigation depth is sometimes treated as "more is always better." The correct reasoning recognizes investigation scope as a judgment call balanced against the need to contain and recover — a mature program defines a "good enough to act" threshold rather than pursuing unlimited certainty.
Reflection Question: Digital evidence from an incident is copied to an analyst's personal laptop for convenience during investigation, with no log of who accessed it afterward. What does this do to the credibility of any conclusions drawn from that evidence?
