The subject of an insider case sits inside the SOC's own reporting line. Who approves telemetry access, and how?

## Why this case breaks the normal design Every access control described elsewhere on this subject assumes the SOC is independent of the subject. When the subject *is* the SOC — an analyst, an engineer, the manager, or the CISO — three assumptions fail at once: 1. **The approval chain runs through the subject or their allies.** A request approved by the subject's own manager, or by someone the subject line-manages, is not a control. 2. **The subject administers the evidence.** SOC staff commonly hold administrative rights over the SIEM, the EDR platform, log retention, forwarding configuration and the query-audit index itself. Someone with those rights can read the case as it is built, shorten retention, disable an audit source, or delete entries. 3. **The subject knows the detections.** They know what is monitored, what is not, what is reviewed and what is merely collected. Detection-shaped assumptions about their behaviour are weaker than usual. ## Authority: naming the alternate in advance The useful answer names a **standing alternate approver defined in policy before any case exists**. Candidates: internal audit, the privacy or compliance function, the general counsel's office, or the risk function. For a case naming the CISO, the route usually goes to an executive outside the reporting line and, in a mature organisation, to the audit committee. The reason to fix it in advance is practical. During a live case, deciding who may authorise reading a colleague's mailbox becomes a negotiation among people who are themselves close to the subject, under time pressure, with the subject possibly aware. Written down in peacetime it is a paragraph: *"Where the subject of an investigation is a member of the security function, approval authority passes to X; where the subject is the head of the security function, to Y."* ## Control of the evidence, before anything else This is where the judgment shows. Before collection begins: - **Confirm where the relevant records live and who administers them.** If the subject administers that store, the record has an integrity problem from the outset. - **Ensure the audit trail is outside their reach.** Append-only or third-party-held audit indexes exist largely for this scenario; if the query audit sits in a system the subject administers, it cannot be relied on. - **Plan revocation.** Removing administrative rights is both necessary and a tipping-off event. Sequence it: collect and preserve first, then revoke, unless the risk of destruction outweighs the risk of alerting them. - **Consider an external examiner.** Retaining an outside forensic party means no one in the subject's line handles the data. It also removes the awkwardness of colleagues examining a colleague, and it strengthens the defensibility of the result if it is ever challenged. - **Watch the second-order signal.** The subject may notice the collection itself — a new forwarding rule, an unusual export, an agent policy change, a colleague behaving oddly. Assume they might, and decide whether you can live with it. ## The trade-offs a lead has to own - **Pre-provisioned independence versus least privilege.** A break-glass path that the SOC cannot see is, by construction, an access path outside the SOC's normal governance. It has to exist, and it has to be audited by whoever holds it. You are choosing which risk to carry. - **Speed versus independence.** The independent approver is, by design, someone who does not do this often. Expect slower decisions and brief them in advance so the first time is not during the case. - **Preservation versus tipping off.** Every step that secures the evidence is a step that might be noticed. - **Proportionality.** The subject is an employee with the same protections as any other, and being on the security team is not a reason for a lower bar. If anything the bar should be visibly equal, because the team's own credibility depends on it. ## When the answer is "there is nobody" Small organisations reach this quickly: the SOC is three people, the CISO approves everything, and there is no internal audit function. The correct move is not to improvise a chain that will not survive scrutiny. It is to name the gap — as a risk on the register, with an owner — and to arrange the cheap mitigations available: an external examiner on retainer, an audit trail held by a third party or in a store the security team cannot administer, and a written escalation route to a board member or an external adviser. That is a decision a lead is expected to make and to have made *before* the day it is needed. ## The tell interviewers listen for Weak answers stay on authority: "HR approves it". Strong answers add the evidence-control half — that the subject's administrative rights over the logging platform, the retention settings and the query audit are the more urgent problem, because authority can be arranged in an hour and a deleted audit trail cannot be recovered at all.