CSS Security Investigations & Reporting Flashcards

What is the most important characteristic of a well-written security incident report?

Answer: It is accurate, factual, objective, complete, and written in clear language

Security reports must be factual, objective, and complete because they may be used as legal documents in investigations or litigation.

Which of the following best describes the chain of custody in a security investigation?

Answer: A documented record of who collected, handled, and transferred evidence to ensure its integrity

Chain of custody documents every person who handled evidence, ensuring it was not tampered with and is admissible in legal proceedings.

When collecting evidence at a scene, a security officer should:

Answer: Photograph the scene before touching anything and use gloves or tools when collecting physical evidence

Photographing the scene before collection and using proper handling precautions preserves evidence integrity and chain of custody.

A security supervisor is investigating an allegation of employee theft. Which is the most appropriate first step?

Answer: Review available evidence such as access logs and CCTV footage before interviewing the employee

Gathering objective evidence before conducting interviews prevents premature conclusions and protects both the investigation and the subject's rights.

The five Ws that should be answered in every security incident report are:

Answer: Who, What, When, Where, Why (and How)

Complete incident reports answer Who, What, When, Where, Why, and How to ensure all essential facts are documented.

Why should a security officer avoid using jargon or abbreviations in a formal incident report?

Answer: Jargon and abbreviations may be misunderstood by investigators, attorneys, or courts who read the report

Security reports may be reviewed by people outside the security field; clear, plain language ensures accurate interpretation by all readers.