INQ-01 Legal Assessment of Investigative Inquiries
Route every investigation request received from a government agency to qualified internal specialists for a legal assessment that establishes whether the agency has an applicable and legally valid basis, and determines w
4
artefacts
1
held by a system
2
at each review
moderate
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Intake log capturing the date, agency and channel of each request · SIEM / log platform
periodic reviewEvidence produced at each review
- Legal assessment records for received requests citing the basis relied upon · Document repository
- Qualification records for the personnel who perform the assessment · Document repository
governing documentDocuments that govern the control
- Written procedure routing agency requests to legal review before any action is taken · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Requests actioned by operations staff before the legal review happens
- Assessment recorded as a yes or no with no legal basis cited
- Requests arriving through informal channels bypass the intake log
- No defined handling for requests from agencies outside the primary jurisdiction
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetIDM-09 Authentication mechanisms · INQ-02 Informing Cloud Customers about Investigation Requests