Send us Fan Mail A company found a concealed recording device in the room where its executives meet. They pulled it, imaged it, reviewed the camera footage, went through the employee's internal tool usage, found a second device in a bag he had left in another room, terminated him and referred the matter to the FBI. Every one of those steps was reasonable. And somewhere in the middle of that list, the investigation stopped being theirs. This episode is CISSP Domain 1.6 — requirements for investigation types. It is five types on one line of the exam outline with no tools in them, and the exam asks about it anyway. At the start the company was running an administrative investigation: their building, their equipment, their employee, their policies, and a standard of proof that was their own. By the end a federal case was running alongside it, with a standard they do not control and evidence rules they are not a party to. Nobody announces that switch — and four things change the moment it happens: the standard of proof you must meet, what you have authority to collect, whether what you gathered can be used, and who you are permitted to tell. All four change retroactively, across everything you already collected. In this episode: · All five investigation types — administrative, criminal, civil, regulatory, industry standards — and what each one can actually do to you · Why the type follows whose AUTHORITY the inquiry runs under, not the conduct and not the severity · Burden of proof by type, and why administrative is the one standard the organization sets for itself · Chain of custody worked step by step from the real case, including the bag that cannot be un-opened · Why a forensic image that produced no readable data is still a finding, and why process produces admissible evidence while content produces a conclusion · The five characteristics of evidence, and why only four of them are properties of the evidence · Civil preservation: the duty attaches when litigation is reasonably anticipated, not when a complaint is served · Regulatory: the regulator sets the scope and can compel production, so your own investigation discharges nothing · Industry standards: a contractual obligation, where the contract names who is permitted to do the work · What a manager decides before any of it — naming the type out loud, setting the referral trigger in advance, and collecting as though the type will change It closes with four scenario questions, spread deliberately across all five types. Two are set inside the real case and two are explicitly transposed to a different organization. Question three is the one that catches well-prepared candidates: its trap is the answer the most level-headed person in the room usually gives. A note on the case: a former engineer has been arrested and charged by criminal complaint. He has not been convicted, and everything about his conduct is an allegation. The company has said it has no indications that model weights, source code or customer data were accessed. Source: U.S. Department of Justice, Office of Public Affairs press release, October 2026. Newsroom: https://www.justice.gov/news Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox. Go to CISSPCyberTraining.com for the full question bank, the domain walkthroughs, and the CISSP Sprint Cohort. Gain exclusive access to 360 FREE CISSP Practice Questions at FreeCISSPQuestions.com and have them delivered directly to your inbox! Don’t miss this valuable opportunity to strengthen your CISSP exam preparation and boost your chances of certification success. Join now and start your journey toward CISSP mastery today!
