Investigation Section Chief (DFIR — NIMS ICS Role)

What problem does it solve?

It orchestrates a DFIR investigation lifecycle by defining the Investigation Section Chief role, enforcing authority boundaries, managing operational-period analysis, and producing a continuously reviewed Common Operating Picture (COP).

Core Features & Use Cases

• Authority-gated investigation decisions: Records chain-of-custody failures, scope expansion candidates, contradictions, and closure recommendations for IC ratification without halting analysis.
• Structured, period-based investigation management: Caps analysis at 4 operational periods, drives COP updates each period, and maintains a pivot ledger of outstanding actions triggered by findings.
• Evidence integrity and temporal strategy: Performs evidence inventory, chain-of-custody verification/gap documentation, and selects analysis order based on evidence relationship to the suspected attack window.

Quick Start

Have the Incident Commander invoke the Investigation Section Chief skill at case start and follow its Phase 0 initialization steps to generate and update the COP based on the available evidence.