Operational Controls and Investigations

Running secure operations

Need to know and least privilege applied daily, not just at hire.
Separation of duties, mandatory vacations, and job rotation to detect fraud.
Dual control and split knowledge for the most sensitive operations.
Configuration and change management so no change reaches production unreviewed.
Patch management, media handling, and secure backup rotation.

Forensics and evidence

Digital evidence must be admissible, so process matters as much as technique. Preserve the chain of custody, collect in order of volatility (CPU registers and cache, memory, network state, disk, then archives), work from bit-level images with verified hashes, and never analyze the original media.

Evidence should be relevant, reliable, legally permissible, and sufficient.
Best evidence rule prefers originals; secondary evidence includes copies and oral descriptions.
Enticement is legal; entrapment (inducing a crime the person would not have committed) is not.