When is specialist cyber or forensic support required?¶

Not every cyber line of enquiry requires a specialist to take over, but some decisions carry consequences that a non-specialist should not manage alone.

Avoid the dangerous assumption¶

The dangerous assumption is that investigators must either understand every technical detail themselves or hand the entire matter to a cyber unit.

Specialist support is likely to be required where:

• the incident is ongoing and containment may affect evidence
• memory or live system data must be captured
• malware may be active
• remote access or command-and-control activity is continuing
• critical or safety-related services are involved
• large cloud, network or enterprise environments are affected
• logs from several systems must be correlated
• systems are encrypted, virtualised or technically complex
• the organisation proposes rebuilding or wiping systems
• attribution depends on detailed technical interpretation
• there is a significant risk of further victims, data loss or operational disruption.

A specialist may include an internal incident responder, digital-forensics practitioner, cybercrime investigator, malware analyst, cloud specialist, security provider or communications-data specialist.

The investigator should still define the operational question.

Do not ask only, “Can you examine this?” Explain what allegation or issue is being investigated, what decisions are required, what systems are affected, what has already been altered and what evidence may be lost.

Specialists should also be asked to state the limits of their findings. A malware analyst may identify capability without proving use. A forensic examiner may link activity to a device without identifying the person controlling it.

Escalation should be proportionate. Simple preservation and record requests may be completed locally, while high-risk technical actions require specialist control.

Operational takeaway¶

Seek specialist support when technical action may alter evidence, continuing harm is significant or interpretation exceeds what the available records can safely establish.