IV011Engagement of external investigators

The instruction of a party outside the organization to conduct or assist the examination.

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
Recommended	Germanywhere written	IT-Grundschutz-Kompendium, Edition 2023Bundesamt für Sicherheit in der Informationstechnik · read 29 Aug 2026	What the German federal authority holds to be the state of the art, in numbered requirements, among them the checking of a candidate’s own account of themselves, a logging infrastructure the administrators who run it cannot alter, a regular audit of the detection systems against the state they are supposed to be in, and how evidence is secured.	An organization without a forensic team of its own has to identify possible service providers in the preparation phase, before there is anything to examine, and to document which of them come into question. Call-off agreements or framework contracts with them should be concluded so that an incident can be examined sooner.