Reporting and Documentation

The hope of bringing offenders to justice may be shattered if evidence is not collected, maintained, and reported in a meticulous way. All relevant information should be documented and cataloged for later presentation.

Reporting should be done in a structured way, usually on a predesigned report form, with sufficient depth to be presented to a court, regulators, insurance adjusters, investors, shareholders, or other stakeholders.

It should be thorough, accurate, and believable.

Reports based on and supported by evidence should contain enough information and samples to relate the entirety of the incident or situation without the need for subjective or convoluted interpretation.

In most jurisdictions, evidence will be presented to a court in an adversarial situation, with two or more sides of a story. In criminal court, there will be a prosecutor and a defendant. In civil court, there will be a claimant and a defendant. Basically, each side is telling a story using the same facts and trying to convince the court that their side is correct-that the evidence supports their story and not their opponent's. Evidence is meant to make the story believable.

Reports based on and supported by evidence should contain enough information and samples to relate the entirety of the incident or situation without the need for subjective or convoluted interpretation.

In most jurisdictions, evidence will be presented to a court in an adversarial situation, with two or more sides of a story. In criminal court, there will be a prosecutor and a defendant. In civil court, there will be a claimant and a defendant. Basically, each side is telling a story using the same facts and trying to convince the court that their side is correct-that the evidence supports their story and not their opponent's. Evidence is meant to make the story believable.

When presenting evidence, especially to a court, the security professional should adhere to these tenets:

• Admissibility. Only evidence acceptable to the court may be presented. The court will inform the professional if some evidence is unacceptable.
• Accuracy. The evidence should be true and clear.
• Comprehensibility. Even though the organization is trying to present one particular story, the organization (or security professional) cannot withhold

Before presenting evidence in court (or to a regulator), it is advised to consult with legal counsel. Attorneys have more expertise and familiarity with testimony and the courts, and a professional litigator can help you prepare for the process. It is to be expected that the opposing party will present its own story to the court, one that may share an entirely different perspective from yours. Some litigators present alternative explanations (stories that differ from the story your organization wants to present) as a persuasive technique. When presenting evidence or testimony, or both, you can explain how the organization considered alternative explanations (including your opponent's explanation), and how, using the evidence and expert opinion and or analysis, you were able to rule out that explanation and come to the conclusions you are presenting to the court. This does not detract from your case and may indeed support it.

A security professional should bear in mind that the audience (judge or jury, or both) are not IT security experts, and the presentation of the material should avoid technical jargon and complex concepts.

evidence that may be contrary to that story. Keeping contrary evidence out of consideration may be a crime in some cases.

• Objectivity. The evidence should stand for itself on a factual basis. Unless called on by the court or counsel, the security professional should not introduce subjective opinion.

Everything should be explained without any assumptions about the audience's understanding of basics.