Start Here: Preparing a Useful Specialist Handoff
How to use the seven preparation packages, the worksheets and the handoff steps
Edition 2026-11-03 | November 3, 2026
Use these packages to find, describe and organize information before you engage an auditor, cybersecurity consultant, forensic examiner, attorney or export control specialist.
How to use this library
Begin with the records you already have.
Each package follows the same pattern. It opens with the facts to settle before you gather, lists the records to find with a suggested owner for each, gives a short question set for client IT and system owners, and closes with the decisions that belong to counsel or the receiving specialist. An unanswered question is a request for help, not evidence of a problem.
Work from the CSV worksheets. Import them as UTF-8, keep the ID columns as text, and widen and wrap the columns before you start. The blank response columns are for your entries. Each worksheet is an index: point to records held in your approved evidence location rather than pasting passwords, patient data or controlled technical information into it.
The first conversation
Open Intake-template.csv and settle seven topics with the business sponsor and counsel: the matter and organization, the purpose and who asked for the work, the period and locations, the people involved, the systems and data, any immediate concerns, and how records will be shared. Immediate concerns come first. An active incident, imminent deletion, expiring logs, a court order or a contractual deadline goes to counsel or the responsible specialist at once, ahead of the worksheet.
Walkthrough from request to handoff
Eight steps take a matter from the first request to a controlled handoff.
1. Name the matter and the recipient
Record the legal entity, business unit or case, the intended recipient, the purpose, the relevant period, the sites, the systems and the client contact. Ask the recipient which criteria, versions and deliverable format they expect. Keep an audit preparation request separate from an incident response or litigation deadline.
2. Identify people and places
Ask the business owner what work occurred and ask IT where the resulting information lives. Include providers, acquired businesses, former accounts, paper files and legacy systems. Start with the data source atlas and create one inventory row per actual tenant, repository or device, not one row per vendor name.
3. Check authority and preserve when necessary
Before anyone changes accounts, retention settings or content, ask counsel and the authorized system owner what must be preserved and who can act. Escalate short lived logs and pending deletions promptly. Check that each hold covers the intended scope and was applied successfully, and record the date it took effect.
4. Gather existing records safely
Request existing exports and documentation through approved channels. Ask for a scoped collection plan if forensic acquisition, production testing, restoration or third party access is needed. Use IDs and redacted examples until the receiving specialist confirms a secure route, and keep passwords, recovery secrets, private keys, patient records and controlled technical data out of ordinary email and web forms.
5. Describe what was supplied
Give every request an ID and every record an identifier. Record the source system, account or tenant, owner, period, collection time with time zone, method, filters, permissions, file format and known omissions. Where appropriate, the collector creates and verifies a cryptographic hash. A matching hash shows two copies are identical, so the specialist reviews exactly the record that was collected.
6. Show gaps and limits
Use the statuses Not started, Requested, Received awaiting specialist review, Partially received, Not available after inquiry, and Proposed not applicable awaiting confirmation. Explain a missing period, an excluded field, a failed export or an uncertainty. Keep Unknown as Unknown, and mark a request complete when every record it asks for has arrived.
7. Prepare a controlled handoff
Reconcile the request checklist with the file inventory. Separate ordinary records from restricted evidence and potentially privileged material. Agree access, permitted recipients, transmission encryption and retention, then obtain a receipt and list the follow up questions. The recipient decides whether the information supports the proposed engagement.
8. Keep the package current
Keep the edition and the date the sources were last checked with the handoff. Recheck the rules and vendor documentation before the next engagement and whenever the facts change. Version new submissions, keep the earlier index and explain the changes. Release a preservation hold or destroy records only on the decision of the owner and counsel.
Who helps with the gathering
Small organizations combine roles; the decisions stay with the person who holds the authority.
| Role | What they contribute |
|---|---|
| Business contact | Explains the business, the relevant events, services and people, and can point to records without answering technical control questions. |
| Project coordinator | Tracks requests, owners, dates, follow up and the handoff, and keeps receipt separate from specialist acceptance. |
| IT and provider contacts | Describe actual systems, permissions, retention, logging and export limits, and arrange authorized technical work. |
| Counsel and privacy lead | Decide case scope, preservation, legal authority, privilege, protected information and applicable duties. |
| Receiving specialist | Agrees criteria and scope, specifies further evidence and evaluates it. Export classifications and audit conclusions stay with qualified decision makers. |
Suggested handoff folders
Use Record-index-template.csv for one row per file or defined record set: the request it answers, the original source, date range, collector and method, approved location and limits. Handoff-checklist.csv tracks the ten handoff steps.
| Folder | Contents |
|---|---|
| 00 Scope and contacts | Engagement purpose, entity or matter facts, period, owner roster and exclusions. |
| 01 Requests and responses | Completed request list, IT questionnaire, follow up records and open questions. |
| 02 Record index | Pointers to approved evidence locations with source, date, method, limits and receipt; no sensitive data in the index itself. |
| 03 Source records | Existing policies, diagrams, contracts and exports; restricted material stays in its approved repository. |
| 04 Specialist decisions | Applicability, legal or process decisions, export classifications or the technical collection plan once supplied. |
| 05 Handoff and updates | Transmittal, recipient receipt, known gaps, version history and supplemental requests. |
Choosing the right package
Seven packages cover the most common requests. For other programs, the table shows what to collect first.
| Program | Starting facts | Records to locate | Where to start |
|---|---|---|---|
| NYDFS Part 500 | Entity operating, or required to operate, under a DFS authorization. | Legal entity and license, examination request, exemption and Class A support, period and program records. | Package 01. |
| New York private information | New York resident data, owner or maintainer status and sector. | Data fields and combinations, data flows, safeguards, entity facts and any incident chronology. | Package 02. |
| CMMC and defense safeguarding | Actual solicitation, contract, flowdowns, data types and current modifications. | Signed clauses, SSP and boundary, FCI and CUI facts, providers and assessment records. | Package 03. |
| EAR and ITAR | Items, software, technology and services, parties, locations and planned activity. | Specifications, prior classifications, licenses and agreements, access map and data handling. | Package 04. |
| Departed employee, commercial or medical matters | The legal matter, its issues, custodians and period. | The sources listed in the package for that matter type. | Packages 05, 06 and 07. |
| Other federal contracting or cloud review | Agency, contract, data and cloud service context. | Agency clauses, security attachment, required framework and revision, boundary and authorization. | Collect these records, then ask the specialist which framework applies. |
| HIPAA security review | Covered entity or business associate facts. | Role and agreements, ePHI flows, risk analysis and program records. | Package 07 covers a legal matter; scope a HIPAA security review with the specialist. |
| FTC Safeguards Rule | Business activities and which regulator has jurisdiction. | Business model, customer information, provider arrangements, existing program and regulator correspondence. | Collect these records with the current 16 CFR Part 314 text. |
| Utilities and operational technology | Facilities, sector, state and permits. | Applicability register, operating permissions and facility evidence. | Use the OT assessment planning library at evestigate.com/resources/ot-assessment-planning-library/. |
Common terms
| Term | Meaning |
|---|---|
| Custodian | A person who may hold or manage relevant information. The system owner may be someone else. |
| Tenant | An organization specific cloud environment. One company can have several tenants and acquired or dormant domains. |
| Native file | A file in its original working format. A PDF printout can omit formulas, comments, versions, metadata or embedded material. |
| Metadata | Information describing a record, such as dates, owner, IDs or revision details. Its meaning depends on the application and the collection method. |
| Log | A record of selected system activity. A log covers an event when logging was enabled, captured that event and kept it for the period in question. |
| Archive | A retained repository that may preserve selected content. Coverage depends on capture, indexing, policy and configuration. |
| Backup | A recovery copy. Confirm its contents, restore capability and point in time; searching it and holding it are separate steps. |
| Legal hold | A preservation measure directed by counsel or an authorized process. The instruction, the technical implementation and the confirmation are separate records. |
| CUI and FCI | Controlled Unclassified Information and Federal Contract Information. The contracting or data owner confirms the category and its contractual basis. |
| ECCN and USML | An Export Control Classification Number under the EAR and the United States Munitions List under the ITAR. A specialist determines classification and jurisdiction from the facts. |
Receiving the package and timing
Receiving the package
Ask the recipient to acknowledge what arrived, name any unreadable or missing files and confirm the next request. Keep their substantive review separate from the delivery receipt. A complete collection is the starting point the specialist works from for the audit, export review or test planning.
Timing and urgent matters
Agree gathering dates with the recipient based on records, access and provider availability. Those dates are project targets. Active incidents, imminent deletion, filing deadlines, litigation orders and pending transactions go to counsel or the responsible specialist immediately, outside the ordinary package schedule.
Talk to a senior examiner
Get a free consultation. The initial consultation is free, and requests are handled in confidence.
Call (800) 868-8189 at any hour, or write to info@evestigate.com.
Request a consultation online at evestigate.com/contact.
© 2026 Global Digital Forensics, Inc. All rights reserved.