How should an isolation decision be documented?¶

An isolation decision should show what risk was identified, what action was chosen and what evidential change followed.

Evidential caution: that recording “device isolated” is enough. That phrase does not explain the original connections, the method used or whether isolation was complete.

What this means¶

Describe the connection state before action, including Wi-Fi, mobile data, Ethernet, Bluetooth, VPN, cables, remote sessions and any active synchronisation.

State the reason for isolation. Was the concern remote wiping, continued fraud, malware communication, account activity or another specific risk?

Describe the exact action: flight mode, cable removal, SIM removal, Faraday containment, network control or another measure.

Include who maintained control of the device after isolation and how accidental reconnection was prevented.

What to check or do next¶

• Record the date, time, location, device and person making the decision.
• Record the options considered and why the chosen method was proportionate.
• Record which indicators changed and which connections may have remained.
• Note any effect on the device, including session loss, offline banners, application changes, lock events, alerts or battery concerns.
• Identify any advice received, from whom and when.
• If complete isolation could not be confirmed, say so. Do not present an assumption as a fact.
• Record the time using an independent reference where possible, particularly if the device clock may be inaccurate.
• Record any later reconnection, removal from containment, charging or transfer to another handler. Preserve any photographs or notes that show the device before and after isolation.