Investigation Types
Understand requirements for investigation types — administrative, criminal, civil, regulatory, industry standards
There are five investigation types, and each one determines three critical things: the standard of proof required, who leads the investigation, and what happens to the subject.
Administrative — internal HR matter, lowest evidence bar
Criminal — law enforcement leads, highest evidence bar
Civil — legal dispute between parties
Regulatory — external government or regulatory body
Industry — compliance auditor (PCI QSA, SOC 2, etc.)
Getting the type wrong can compromise the entire case. If you handle a criminal matter as an administrative investigation, you may contaminate the evidence chain and make prosecution impossible.
At a mature organization, each investigation type follows a distinct process:
- Administrative — HR leads the investigation. Standard of proof is preponderance of evidence (more likely than not). Outcome: termination, suspension, or policy remediation. No law enforcement involvement required.
- Criminal — Law enforcement leads. Standard of proof is beyond reasonable doubt — the highest bar. Chain of custody is absolutely critical. The security team preserves evidence and cooperates but does not lead. Outcome: prosecution, fines, imprisonment.
- Civil — Legal counsel leads. Standard of proof is preponderance of evidence. Typically involves lawsuits between parties — breach of contract, negligence, intellectual property disputes. Outcome: monetary damages, injunctions.
- Regulatory — An external regulatory body leads (HIPAA OCR, SEC, FTC, GDPR DPA). The organization cooperates and provides evidence. Outcome: fines, consent decrees, mandatory remediation plans.
- Industry — A qualified assessor or auditor leads (PCI QSA, SOC 2 auditor, ISO auditor). Standard: compliance with the specific framework requirements. Outcome: certification, remediation requirements, loss of certification.
Notice: the security team never leads a criminal investigation and never makes prosecution decisions. Your job is to preserve evidence and cooperate with the appropriate authority.
| Type | Standard of Proof | Led By | Example | Key Concern |
|---|---|---|---|---|
| Administrative | Preponderance of evidence | HR / Management | AUP violation, policy breach | Due process, documentation |
| Criminal | Beyond reasonable doubt | Law enforcement | Data theft, fraud, hacking | Chain of custody, evidence preservation |
| Civil | Preponderance of evidence | Legal counsel | Breach of contract, IP theft lawsuit | Discovery obligations, litigation hold |
| Regulatory | Varies by regulation | External regulatory body | HIPAA audit, GDPR investigation | Mandatory cooperation, penalties |
| Industry | Framework compliance | QSA / Auditor | PCI DSS assessment, SOC 2 audit | Certification status, remediation |
Evidence standard determines everything. Criminal investigations require “beyond reasonable doubt” — the highest bar. Administrative and civil both use “preponderance of evidence” (51% likely). If you start administrative and it escalates to criminal, any evidence mishandled under the lower standard may be inadmissible.
You’re the security manager at a mid-size e-commerce company. An alert fires: an employee in the database team has been running unusual queries against the customer payment table after hours.
The Suspicious Queries
E-commerce · 50K customer records · PCI environmentPreserve evidence at the highest standard first. You can always downgrade from criminal to administrative. You cannot upgrade from administrative to criminal after mishandling evidence. When in doubt, treat it as criminal until legal counsel advises otherwise.
In practice, organizations often want to “handle it quietly.” The pressure to avoid publicity is real. But the security professional’s job is to protect the organization — and that means preserving the option for criminal prosecution even if leadership hasn’t decided to pursue it yet.
On the exam: When a question involves potential criminal activity, the answer that involves law enforcement and proper evidence handling is almost always correct. “Handle it internally” is usually the wrong answer.
You discover an employee has been exfiltrating customer data. Your CEO says “handle it quietly — fire them and move on.” But the data includes PII of 50,000 customers, and your state has mandatory breach notification laws.
Administrative investigation + termination
Quick, quiet, minimal disruption. Fire the employee, patch the vulnerability, notify no one externally.
Involve law enforcement, begin criminal investigation
Slower, public risk, but preserves chain of custody and meets breach notification obligations.
Option B is correct — the scale triggers legal obligations you cannot ignore
Option B: With 50,000 customer PII records involved, mandatory breach notification laws almost certainly apply. Administrative handling alone will not preserve evidence to the criminal standard (“beyond reasonable doubt”). Law enforcement involvement ensures proper chain of custody and demonstrates the organization acted responsibly — which matters when regulators review your response.
Option A’s kernel of truth: Speed matters, and terminating access quickly is correct. But “notify no one externally” violates breach notification laws. The termination can happen alongside the criminal investigation — these aren’t mutually exclusive.
On the exam: when the scenario involves large-scale PII exposure, the answer always includes external notification and proper investigation procedures. “Handle it quietly” is a distractor.
When you see potential criminal activity in a question: the answer always involves law enforcement and proper evidence preservation. The security team’s first job is to preserve evidence — disable accounts, capture logs, maintain chain of custody. Never confront the suspect (tips them off), never begin forensic analysis without proper authority, and never “handle it quietly.”
- A Disable the account and preserve logs
- B Confront the employee
- C Begin forensic analysis
- D Notify law enforcement
Correct: A. Preserve evidence first — disable the account to prevent further damage and capture logs before they can be altered. Then involve law enforcement. Confronting the employee (B) tips them off and gives them time to destroy evidence. Forensic analysis (C) should wait for proper authority and chain of custody procedures. Law enforcement notification (D) is critical but happens after evidence is preserved — you need something to hand them.