Cybercrime investigation CRIM
(new)
Investigates cybercrimes, collects evidence, determines incident impacts and collaborates with legal teams to protect digital assets.
SFIA 9 is in development
- SFIA 9 planned for publication October 2024.
- The content of this skill may change before publication.
Guidance notes
(new)
Activities may include, but are not limited to:
- collecting digital and physical evidence from various sources, including public networks, private systems and harder-to-access environments like the deep web and the dark web
- assessing the credibility and authenticity of evidence
- conducting interviews and interrogations to gather information
- assessing target vulnerabilities and operational capabilities
- identifying incidents that may require legal action and collaborating with legal teams
- documenting findings and preparing comprehensive reports for stakeholders
- ensuring the integrity and admissibility of evidence in investigations.
Understanding the responsibility levels of this skill
Where lower levels are not defined...
- Specific tasks and responsibilities are not defined because the skill requires a higher level of autonomy, influence, and complexity in decision-making than is typically expected at these levels. You can use the essence statements to understand the generic responsibilities associated with these levels.
Where higher levels are not defined...
- Responsibilities and accountabilities are not defined because these higher levels involve strategic leadership and broader organisational influence that goes beyond the scope of this specific skill. See the essence statements.
Developing skills and demonstrating responsibilities related to this skill
The defined levels show the incremental progression in skills and responsibilities.
Where lower levels are not defined...
You can develop your knowledge and support others who do have responsibility in this area by:
- Learning key concepts and principles related to this skill and its impact on your role
- Performing related skills (see the related SFIA skills)
- Supporting others who are performing higher level tasks and activities
Where higher levels are not defined...
- You can progress by developing related skills which are better suited to higher levels of organisational leadership.
Click to learn why SFIA skills are not defined at all 7 levels.
Show/hide extra descriptions and levels.
2
3
4
5
6
Levels of responsibility for this skill
2 | 3 | 4 | 5 | 6 |
Level 1
Cybercrime investigation: Level 2
(new)
Assists in cybercrime investigations under routine supervision.
Supports the collection and documentation of digital and physical evidence.
Participates in monitoring and recording activities.
Maintains evidence integrity and assists in interviews. Follows established protocols and guidelines.
Cybercrime investigation: Level 3
(new)
Conducts investigations using standard procedures.
Collects and preserves digital and physical evidence, assessing its credibility and authenticity and ensuring compliance with relevant standards.
Analyses basic cyber threats and prepares detailed reports. Identifies incidents that may have legal implications.
Conducts interviews and assists in interrogations.
Cybercrime investigation: Level 4
(new)
Oversees mid-level investigations, planning and conducting thorough forensic analyses.
Coordinates the collection of digital and physical evidence, ensuring it meets investigative standards. Assesses target vulnerabilities and operational impacts.
Provides comprehensive reports and expert analysis for stakeholders.
Conducts interviews and interrogations, identifying potential legal implications and collaborating with legal professionals.
Cybercrime investigation: Level 5
(new)
Manages complex cybercrime investigations, overseeing all stages from detection to resolution.
Evaluates incidents involving advanced threats or significant breaches.
Develops and implements procedures for evidence handling and documentation. Collaborates with legal teams to ensure evidence supports potential legal proceedings.
Leads the development of response strategies, assessing vulnerabilities and operational capabilities. Oversees the implementation of tools and automation to enhance investigative processes.
Cybercrime investigation: Level 6
(new)
Defines the organisational strategy for cybercrime investigations.
Establishes policies and standards for handling digital and physical evidence, including the adoption and integration of tools and automation to improve efficiency and accuracy.
Oversees high-risk or sensitive investigations, managing cross-disciplinary teams. Conducts high-level interviews and interrogations, providing strategic insights on cybersecurity threats and vulnerabilities.
Engages with external stakeholders, including regulatory bodies and legal entities, to ensure compliance with legal and ethical standards.