Digital Forensics, OT Security and Expert Testimony for Public Agencies
Government Digital Forensics Built to Withstand Oversight, Audit and Trial
In public sector matters the facts sit on a seized computer, a compromised account or a control system, and the findings will be read by an inspector general, an auditor or a jury. Global Digital Forensics examines that evidence and tests those systems under the handling rules your agency sets, and documents every step to the standard of the toughest reader. Agencies and authorities can call the 24/7 hotline at any hour, and the first conversation is free.
For federal, state and local agencies and authorities
Forensic and Cybersecurity Services for Public Agencies
Choose the matter type and open the service page behind it. Each one explains the scope, the evidence sources and the deliverables.
Compliance evidence
Technical evidence for DFARS and related certification reviews, produced so an auditor can trace each finding to its source.
OT & critical infrastructure
Assessments of the control systems behind public water, transit, facilities and emergency services, planned with the operators who run them.
Evidence & examinations
Digital forensics, media authentication and expert testimony for agencies, oversight bodies and the enforcement partners they work with.
The initial consultation is free, and a senior examiner sets the plan with you on the first call.
Exposure
Why Public Systems Carry More Exposure Than Budgets Retire
Public agencies run older, interconnected systems because they have to. Legacy applications, records systems with decades of retained data and operational technology in water, transit, courts and public safety are replaced on budget cycles rather than threat cycles, so the risk has to be managed around systems that will not be modernized soon.
Agencies also hold some of the most sensitive categories of data in existence: criminal justice information, benefits and tax records, health data and biometric records. That data crosses jurisdictions and is shared with contractors and neighboring authorities, which multiplies both the access paths an intruder can use and the notification consequences when one of them does.
Municipalities and special districts face the same adversaries as federal agencies with a fraction of the staff. A ransomware event can take down the courts, the utilities, emergency dispatch and the permitting counter in one morning, and the question of what was taken has to be answered from records while the recovery is still under way.
When the recovery is already under way and leadership needs to know what was taken, call (800) 868-8189; the hotline is answered around the clock.
Scoping
Questions the Engagement Must Answer Before Protected Material Moves
- What handling, classification and access constraints apply to the evidence, and who confirms them?
- Which findings must an internal team be able to reproduce after the engagement ends?
- How will the work support an inspector general, an oversight body or a prosecuting authority?
- What interoperability and records retention requirements apply to the deliverables?
- Which limitations must be documented for a public or oversight audience to read?
Services
How We Help Public Agencies and Authorities
-
Digital Forensics and Expert Witness Testimony
Examination, evidence handling and testimony for administrative, civil and criminal proceedings, by examiners who have been deposed and cross examined.
-
Critical Infrastructure & OT Security
Assessment of water, transit, public safety and facility control systems in live operating conditions, with methods and timing approved by the people who run them.
-
Biometrics & Identity Sciences
Independent examination of fingerprint, facial and identity evidence, the scanners that capture it and the databases that store it.
-
Incident Response SLA
Response times and hourly rates committed in advance at no upfront cost, so procurement is not the first task after an incident is declared.
Context
The Regulatory Context We Scope Against
- CJIS
- Agencies that handle criminal justice information work to federally defined security policy covering access control, auditing, encryption and personnel screening, and those rules reach the contractors who touch the data.
- FISMA and NIST frameworks
- Federal systems and many federally funded programs are assessed against NIST based control catalogs, with continuous monitoring and documented authorization expected of the system owner.
- State and local mandates
- State information security offices, election authorities and public utility commissions each set their own assessment and reporting requirements for the bodies they oversee.
- Public records and retention
- An examination touches records governed by retention schedules and disclosure law, so preservation is planned with those obligations in view from the first call.
Requirements vary by agency, funding source and jurisdiction. We scope the work against the frameworks that actually bind your systems and your funding, and the report maps each finding to them.
If you are not certain which framework binds the system in question, ask a senior examiner to scope against it with you before the work is defined.
Related case study
Drug Diversion Forensic Analysis
When seized warehouse computers held the email, purchase and shipping records at the center of a drug diversion investigation, GDF dispatched a mobile forensic lab, imaged the drives under the supervision of the prosecuting authorities and supplied the recovered artifacts to them alongside the physical evidence.
Digital Forensics
Confirm the Contracting and Data Boundary Before Anything Protected Moves
Begin with a description of the system, the task, the agency, the deadline and the procurement contact that contains nothing sensitive. Before protected material is accepted, the agency and GDF agree on the applicable contract, the authorized environment, the personnel requirements and the permitted handling, and we write those terms down.
On procurement, we identify the contracting route, the eligibility requirements, any subcontractor restrictions and the official who can authorize the work. On data, we identify the classification, any criminal justice information or other controlled material, the access restrictions, the approved transfer and storage arrangements and the retention obligations that will outlive the engagement.
On roles, we identify the agency system owner, the security officer and any separately qualified participant who must approve or perform specialized testing. The output of that first conversation is a scope record, free of sensitive detail, that lists the authorized systems, the evidence sought, the assessment method, the exclusions, the reporting recipient and the acceptance criteria.
Criminal justice information and controlled evidence move only through a channel the agency approves in advance, under the CJIS, FISMA or NIST terms that apply. Call (800) 868-8189 and we will set that channel up before anything is shared.
Gather records before an engagement
Records a Defense or Export Control Review Requests
Public agencies and the contractors who serve them are asked for the same categories of records at the start of every review: contract terms, information boundaries, system inventories and the evidence that a control actually operates. The two guides below help your team identify those records, assign an owner to each and write down the questions for the specialist who will review them.
Every guide is free to read online. A download asks for a work email and company, which you may skip, and the file starts immediately.
Discuss your evidence and deadline
CMMC and NIST SP 800-171 preparation
Organize the contracts, information boundaries, system records and evidence requests a defense cybersecurity specialist will work from.
File: ZIP: guide and editable CSV checklists.
EAR and ITAR preparation
Gather the product, technical data, access and transaction facts an export control specialist needs before evaluating your exposure.
File: ZIP: guide and editable CSV checklists.
Browse all preparation packages by subject.
Gather what the guides name, then describe the system, the task and the procurement contact to a senior examiner, and we will set up the right channel for anything sensitive.
Talk with an examiner
Talk With the Examiners Who Work Public Sector Matters
Tell us the matter, the agency's role and the deadline. A senior examiner will call or write back promptly to discuss relevant experience, the contracting route and the technical scope, and the first conversation is free.
Since 1992 · 24/7 response · Court tested experts
GDF does not accept pro se litigation cases, and GDF may decline matrimonial or family law cases at our discretion.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .