How should sensitive information obtained during investigations be handled?

• A. Share only on a need-to-know basis, encrypt or secure storage, and dispose per policy.
• B. Disclose to all personnel to increase transparency.
• C. Store in unsecured folders for quick access.
• D. Delete after 24 hours regardless of policy.

Answer: (A)

Sensitive investigation information must be treated as restricted data. Only people who have a legitimate need to know to perform their duties should access it, which minimizes the chance of leaks, misuse, or harm to the investigation. Protecting the data at rest and in transit is essential, so use encryption or secure storage and enforce access controls and audit trails. When it’s time to dispose of records, follow the established policy so destruction is verifiable and compliant with retention requirements.

Sharing with everyone increases risk and violates the need-to-know principle. Keeping information in unsecured folders makes it easy for unauthorized individuals to access or misplace it. Deleting after a fixed period without regard to policy can erase critical evidence, disrupt the investigation, or violate legal and organizational requirements. Following these practices helps maintain confidentiality, integrity, and accountability throughout the investigation.