Protect information and intellectual property within evidence collection and documentation.
Collecting and Documenting Evidence in Security Incidents
A practical programme in evidence collection and documentation for professionals who are accountable for results, not just awareness.
📍 Tunis🗓️ 5 training days📚 4 modules🎓 Accredited certificate
5intensive training days
4scientific modules
8training sessions
32detailed points
Course Overview
Guard force performance on evidence collection and documentation reflects supervision, not instruction. Security arrangements around collection and documentation are tested by adversaries, not by auditors. Participants finish able to explain the wider corporate security practice agenda to a non-specialist audience without losing precision. Applied research in corporate security practice consistently shows that early structure around evidence collection and documentation reduces downstream rework. The programme uses small-group work so that each participant's treatment of this strand of corporate security practice is examined, not just described. The programme is built to be used, and every section of collection and documentation it covers ends in something applicable. What blocks progress on evidence collection and documentation is usually unclear ownership rather than unclear intent. It is pitched for practitioners with responsibility for collection and documentation, not for observers of it. Participants leave with a plan for this area of corporate security practice sized to what their organisation can realistically absorb.
Expected Learning Outcomes
Agree the first three actions on collection and documentation that will be taken on returning to work.
Coordinate with civil defence, police and external authorities on evidence collection and documentation.
Align collection and documentation with the wider objectives of the protected site rather than optimising it in isolation.
Assess and control third-party and contractor exposure in evidence collection and documentation.
Test the organisation's response to collection and documentation under conditions that are less than ideal.
Manage guard force competence, supervision and performance on evidence collection and documentation.
Who Should Attend
Business partners who must understand evidence collection and documentation well enough to challenge it.
Control room and monitoring staff operating collection and documentation.
Risk managers assessing exposure from evidence collection and documentation.
Security managers and officers responsible for collection and documentation.
Anyone whose accountability for evidence collection and documentation exceeds their current formal training in it.
Information security staff whose remit overlaps collection and documentation.
Course Modules
Evidence collection and documentation: surveillance, monitoring and control rooms
2 sessions · 8 pointsSession 1Making evidence collection and documentation work when resources are constrained
- Report on evidence collection and documentation in terms that support an investment decision.
- Rank the weaknesses in collection and documentation by consequence rather than by ease of fixing.
- Check that evidence collection and documentation still works when volumes rise unexpectedly.
- Confirm access control on collection and documentation cannot be routinely bypassed.
Session 2Coordinating with external authorities on collection and documentation
- Review whether evidence collection and documentation is aligned with the objectives of the protected site.
- Record what was learned when collection and documentation did not go as planned.
- Set escalation thresholds for evidence collection and documentation that work out of hours.
- Define the first response actions for an incident involving collection and documentation.
Collection and documentation: threat assessment and intelligence
2 sessions · 8 pointsSession 1Surveillance on collection and documentation that supports an investigation later
- Set the review interval for evidence collection and documentation and who attends.
- Agree the indicators that will show whether collection and documentation is improving.
- Protect sensitive information relating to evidence collection and documentation from casual disclosure.
- Assess insider risk in roles with privileged access to collection and documentation.
Session 2Who answers for collection and documentation, and to whom
- Remove steps in evidence collection and documentation that add effort without adding assurance.
- Test the procedure for collection and documentation against a realistic scenario.
- Set out how exceptions to evidence collection and documentation are requested and approved.
- Confirm recorded material from collection and documentation is retained long enough to be useful.
Collection and documentation: investigation, evidence and reporting
2 sessions · 8 pointsSession 1Access control on collection and documentation that people do not bypass
- Identify the data already collected that bears on evidence collection and documentation.
- Set escalation criteria and out-of-hours contacts for collection and documentation.
- Establish evidence handling and chain of custody for evidence collection and documentation.
- Coordinate arrangements for collection and documentation with civil defence and police in advance.
Session 2Assessing the threat to evidence collection and documentation specifically, not generically
- Plan the sequence in which improvements to evidence collection and documentation will be introduced.
- Build the threat picture for collection and documentation from sources relevant to this site and sector.
- Review evidence collection and documentation after every incident, exercise or change in threat.
- Reduce the variation in how collection and documentation is carried out between teams.
Collection and documentation: governance, assurance and investment case
2 sessions · 8 pointsSession 1Reading the current state of collection and documentation honestly
- Establish the boundary of evidence collection and documentation and record what sits outside it.
- Rehearse the briefing on collection and documentation that would follow an incident.
- Verify identity checks applied at entry points relevant to evidence collection and documentation.
- Exercise the plan for collection and documentation under realistic conditions and record failures.
Session 2The first fifteen minutes of an incident involving collection and documentation
- Record the rationale for each significant choice made about evidence collection and documentation.
- Check that controls on collection and documentation cover deterrence, detection, delay and response.
- Confirm vetting standards applied to staff and contractors in evidence collection and documentation.
- Check guard force instructions for collection and documentation are current and understood.
Choose the package that suits you
Silver Package
At least 3 people
USD1,250
- Workshop or Program Participation
- Airport Transfers
- Customized Badge
- Expert Mentorship (Private Sessions)
- Supervision & Secretarial Services
- Accredited Certificate of Participation
- Complete Training Kit
- Coffee Break
- Closing Ceremony
Gold Package
At least 3 people
USD1,850
- 5-night stay in a 5-star hotel
- Workshop or Program Participation
- Airport Transfers
- Customized Badge
- Expert Mentorship (Private Sessions)
- Supervision & Secretarial Services
- Accredited Certificate of Participation
- Complete Training Kit
- Coffee Break
- Closing Ceremony
Complete your registration
We will contact you within one business day to confirm.