Privacy, licensing, and incident matching lab

Match chain of custody, order of volatility, PII handling, and AUP; leave reboot-first and PII-to-Slack unused.

Match each privacy/incident ticket. Leave reboot-first and PII-to-Slack unused.

CompTIA 4.6 is paperwork with teeth: chain of custody, order of volatility, PII/retention, EULA/DRM/licensing, AUP, and NDAs — not vibes.

HR needs the laptop drive admitted as evidence later

Prove who touched it and that it stayed sealed.

Live malware still in RAM; someone wants to pull the plug first

What disappears when power dies?

Tech screenshots a patient's chart into a group chat

Identifiers and health data — policy, not speed.

New hires stream torrents on corp Wi-Fi 'because nobody said no'

Behavioral contract for systems/internet use.

Still on the bench

Chain of custody — who held evidence, when, why, sealed/hashed — Courts and management need an unbroken handoff log. A mystery USB in your pocket is not evidence.
Order of volatility — capture RAM/live state before disk before backups — Powering off first can destroy the richest evidence. Document live state, then image disk.
Need-to-know PII handling + retention — not hallway screenshots — SSNs, health, payment, and government IDs follow policy and retention — not convenience chats.
Acceptable Use Policy — rules for systems/internet before access — AUP (and splash/EULA acceptance) sets the behavioral contract. NDA is confidentiality; AUP is use.
Reboot the suspect PC immediately so 'it is clean for imaging' — Reboot wipes volatile evidence. Image/live capture first when investigating.
Paste customer SSNs into a public Slack channel for 'fast help' — PII belongs in approved systems with access control — not blast channels.