IV004Investigation plan and scope

The statement, made before the work, of what will be examined and what will not.

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
Recommended	Germanywhere written	IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026	What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured.	A forensic examination should begin by defining its objectives, or the work it has been asked to do, as concretely as they can be put, and only then identifying the data sources it needs. A written guide should set out how evidence is to be secured, naming the procedures, the technical tools, the legal conditions, and what has to be documented.