649
May 21, 2020
KSATs
649 (NIST ID: T0120)
Task
Identify, collect, and seize documentary or physical evidence, to include digital media and logs associated with cyber intrusion incidents, investigations, and operations.
Items denoted by a * are CORE KSATs for every Work Role, while other CORE KSATs vary by Work Role.
Core KSAT for the following Work Roles
No Work Roles with Core KSAT 649 |
Additional KSAT for the following Work Roles
Cyber Crime Investigator (Additional)
Identifies, collects, examines, and preserves evidence using controlled and documented analytical and investigative techniques.
Forensics Analyst (Additional)
Conducts deep-dive investigations on computer-based crimes establishing documentary or physical evidence, to include digital media and logs associated with cyber intrusion incidents.