Insider Threat Checklist: Hold the Accounts, Seal the Laptop
Edition 2026-11-03

Customer lists, pricing models and code leave in the weeks before a resignation, and the returned laptop is often the only witness. This checklist is the protocol for holding the devices and accounts and exporting the logs that expire first, before anyone looks.

Contents

insider_threat_checklist.html          The checklist with its guidance, sources and contacts. Open it in any browser or print it.
insider_threat_checklist_workbook.csv  The working checklist. Open it in Excel or any spreadsheet and fill in one row per item.

How to use it. Read the checklist page first. Then open the CSV, assign an owner to each row and record the date each action happens. Update the Status column as the work is recorded. In the evidence column, record an evidence ID or the location of your secure repository, where passwords, recovery keys and the evidence itself are kept. When you are ready to begin, call GDF and a senior examiner will walk through the checklist with you.

Talk to a senior examiner. The initial consultation is free. Call (800) 868-8189 at any hour, or write to info@evestigate.com.

© 2026 Global Digital Forensics, Inc. All rights reserved.
