Detection criteria - Legal and HR coordination requirements - Evidence preservation (heightened chain of custody) - Investigation steps (user activity monitoring, data access logs) - Containment without alerting the subject - Documentation requirements