Investigation Types — CISSP Study Guide

Bundled into the existing Certified Information Systems Security Professional premium course — no separate purchase.

Included in this chapter:

Dimension	Administrative	Civil	Criminal	Regulatory / Industry-standards
Who initiates	The organization itself	A private plaintiff	Government / prosecutor	Oversight agency or contractual framework (e.g. PCI DSS)
Standard of proof	Internal management judgment (lowest)	Preponderance of the evidence (>50%)	Beyond a reasonable doubt (highest)	Agency- or framework-defined (often administrative/civil-level)
Typical outcome	Discipline, termination, policy change	Monetary damages or injunctive relief	Fines, probation, imprisonment	Penalties, sanctions, fines, loss of standing
Evidence / process rigor	Acceptable-use policy and consent banners	Discovery / e-discovery between parties	Warrant, search-and-seizure rules, strict chain of custody	The body's prescribed procedures and reporting deadlines

Cheat sheet

Classify the investigation type before touching evidence
There are exactly five investigation types: administrative, criminal, civil, regulatory, industry-standards
Administrative investigations use the lowest bar: internal management judgment
Civil cases are decided on a preponderance of the evidence
Criminal cases require proof beyond a reasonable doubt, the highest standard
The standard of proof rises with what the subject stands to lose
Regulatory and industry-standards investigations sit at agency- or framework-defined levels, not a new higher bar
PCI DSS is the industry-standards example, not a government regulation
Chain of custody is the unbroken documented record proving evidence was not altered
Chain-of-custody rigor scales with the standard of proof; criminal is strictest
Preserve evidence to the highest standard that might plausibly apply
Employers gain search authority through acceptable-use policy and warning banners, not a warrant
When an incident may be a crime, preserve evidence and involve counsel before remediating
Forensic technique is shared across types; only the legal process differs
Civil parties exchange evidence through discovery, not seizure
The five types are not mutually exclusive and can run in parallel
Acquire forensic evidence with a write blocker and verify with a hash

Unlock with Premium — includes all practice exams and the complete study guide.