CISSP Understand Requirements for Investigation Types – Bk1D7T2

In this section, we compare and contrast different investigation types, including administrative, criminal, civil, and regulatory investigations. For each investigation types, we discuss who performs the investigation, the standard for collecting and presenting evidence, and the general differences between the types.

In discussing legal matters, it is important to stress that laws and courts vary significantly across the globe; there are a great many particular distinctions between how law enforcement, courts, lawyers, and judges behave and perform, depending on where you live, where the events leading to the investigation occurred, and other variables. The information presented in this book will be largely based on traditions of adversarial courts and English common law, strictly as an example; however, it is absolutely essential that you, as a security practitioner, familiarize yourself with the laws and proceedings relevant to your locale and customers so you can provide adequate, informed service.

There are many forms of law and law enforcement bodies and many ways in which those laws are adjudicated. Here are some examples of different courts:
  • Criminal: The government prosecutes a person/organization for violating a law to provide for the common safety and security of the public.
  • Civil: Private entities seek resolution of conflict and compensation for losses.
  • Religious: An authority figure recognized by practitioners of a given faith interprets the implications of a religious text, makes decisions, and resolves conflicts based on this interpretation
  • Tribal: Leaders of a community, recognized by the members of that community, make binding decisions based on their wisdom and authority.

Burden of proof is the requirement that the criminal prosecutor or civil plaintiff/ claimant prove the claims they are making against the accused, or defendant. The entity making a claim must demonstrate the truth of that claim, with compelling evidence; the entity defending against the claim, in most modern societies, is presumed innocent or without fault—that is, the court will not recognize the validity of a claim against anyone until that claim is substantiated. The amount and strength of proof required to sway the judgment away from this presumption of innocence or lack of fault differs depending on which kind of claim is being made, for instance, whether the claim is being made by one private party against another or whether the claim is being made by the government against a person or organization (more on this distinction in just a moment). In the U.S. legal system, the two predominant standards of proof that must be met are called preponderance of the evidence and beyond a reasonable doubt.

Preponderance of the evidence is the lower standard of the two and is used primarily in civil actions. It essentially means that the evidence shows that the defendant is more likely to have caused the damage than not. In other words, the evidence convinced the judge, jury, or ruling body that there was at least a 51 percent chance that the defendant caused the damage.

The second standard, beyond a reasonable doubt, is much harder to prove and is used primarily in criminal actions. It is insufficient for the evidence to merely make the judge or jury lean more toward guilt than not. In this case, the evidence has to be so clear and compelling that a “reasonable” person has no doubt or reservation about the defendant’s guilt after seeing it.