Lesson 3: Privacy, Licensing, Policy, and Incident Evidence

Core path: 42 minutes

Technicians often have access to devices, accounts, files, printers, backups, and logs that other people do not.

That access creates responsibility.

This lesson is about knowing what you are allowed to view, change, copy, retain, disclose, or escalate.

Incident response starts with authority and preservation

If a support case may become a security, legal, HR, safety, or compliance incident, normal repair instincts can become harmful.

Examples of technician-level concepts include:

• document what was observed;
• preserve relevant system state under the approved process;
• maintain chain-of-custody records when evidence handling requires it;
• notify management or law enforcement only through the organization's required escalation process;
• use approved drive-copy/data-preservation procedures when directed;
• understand that volatile information can disappear when a system powers down;
• avoid destructive "cleanup" before the incident owner authorizes it.

Chain of custody is a record

A chain-of-custody record answers questions such as:

what item/evidence?
who collected or received it?
when?
where was it stored?
who transferred it next?
why was it accessed?

It does not magically make weak evidence reliable. It documents control of the item.

Order of volatility

Some system information disappears faster than other information. Running processes and active network/session state can change quickly; files stored on powered-off media may persist longer.

At A+ depth, the key lesson is:

Do not destroy potentially relevant volatile state because you reflexively rebooted the computer.

Follow the approved incident procedure and escalation path.

Privacy and regulated data

Technicians may encounter:

• payment-card information;
• government-issued identity information;
• personally identifiable information (PII);
• healthcare-related data;
• records governed by retention requirements.

Do not copy real sensitive data into classroom examples, personal notes, screenshots, AI tools, or unapproved ticket fields.

The correct handling rule comes from the organization's policy and applicable regulation, not personal judgment.

NDA and MNDA

A non-disclosure agreement (NDA) or mutual NDA (MNDA) can create contractual confidentiality obligations.

Technician behavior still follows organizational policy. "I work in IT" is not permission to discuss confidential information outside the authorized context.

Licensing matters during support

Software can be technically installable and still not be legally licensed for the intended use.

Recognize concepts such as:

• valid license;
• perpetual license;
• personal-use vs corporate-use licensing;
• end-user license agreement (EULA);
• digital rights management (DRM);
• open-source license.

Open source does not mean "no license." It means use is governed by an open-source license with specific permissions and obligations.

Acceptable use and compliance

An Acceptable Use Policy (AUP) defines permitted/prohibited behavior for organizational systems. Other business/regulatory requirements may define access, retention, logging, disclosure, notices, or splash-screen/banner requirements.

A technician should not invent policy at the desk.

Guided case

A user asks you to copy a former employee's entire home folder to the user's personal USB drive because "management probably wants it saved."

Problems:

• authorization is unclear;
• the destination is personal/removable media;
• files may contain regulated/private information;
• retention requirements are unknown;
• ownership/access may require management or legal/HR direction.

Correct first move: do not copy the data yet. Escalate through the approved process and document the request.

Student action: policy decision matrix

For each fictional case, record:

request:
data or asset involved:
policy/privacy/licensing concern:
what you are authorized to do now:
what requires escalation:
what evidence/documentation should be preserved:

Cases:

1. suspected malware on an executive laptop;
2. expired corporate application license;
3. request to image a drive after a serious incident;
4. printer output containing healthcare data left unattended;
5. employee asks to install a personally licensed application on a company PC.

Evidence checkpoint

Professional support is not just asking "Can I technically do this?"

Also ask:

Am I authorized to do this, where may the data go, what must be preserved, what policy applies, and what should be documented or escalated?