CSI Cheat Sheet 2026

The 30 highest-yield CSI facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Under U.S. law, which scenario most clearly constitutes 'excessive force' by a private security officer? → Striking an already-subdued, compliant suspect multiple times after the threat has ended
2. Which of the following BEST describes the difference between a threat and a hazard in security assessment? → A threat involves intent or agency, while a hazard is typically unintentional or natural
3. What is the primary goal of a retail loss prevention program? → Reducing inventory shrinkage and protecting company assets
4. When multiple witnesses are available, what is the best practice for conducting interviews in a security investigation? → Interview each witness separately to prevent cross-contamination of accounts
5. Which of the following scenarios BEST illustrates a 'blended threat'? → A disgruntled employee using stolen credentials to access and leak sensitive digital files
6. Which hashing algorithm is currently recommended by NIST for forensic evidence verification due to its collision resistance? → SHA-256
7. Which of the following assessment tools uses a scoring system to prioritize critical assets and their attractiveness as targets? → CARVER matrix
8. Which of the following best describes a 'narrative' section in a security incident report? → A chronological, detailed account of the incident and investigation
9. In digital evidence documentation, a 'hash value' is used to: → Verify that electronic evidence has not been altered since collection
10. Which of the following is a PRIMARY goal of a threat vulnerability assessment? → Determine which assets face the greatest exposure
11. The primary difference between a 'factual finding' and an 'inference' in an investigative report is that: → Factual findings are directly observed or documented; inferences are reasoned conclusions
12. During a vulnerability assessment, an investigator should assess 'single points of failure' because they: → Represent locations where one failure can disable an entire security system
13. Which quality assurance method is most commonly applied in incident report writing to verify that CSI professional standards are being met? → Structured audits, peer reviews, and performance metrics aligned with industry benchmarks
14. What is 'statement analysis' used for in a security interview? → Detecting deception through language patterns
15. What is the primary purpose of a 'chain of custody' procedure in security investigations? → To document the handling of evidence to preserve its integrity and admissibility
16. In the context of CSI investigations, what does OSINT stand for and how is it used? → Open-Source Intelligence; gathering information from publicly available sources
17. What is a digital signature primarily used for in information security? → Verifying the authenticity and integrity of a message or document
18. A 'continuity of operations plan' (COOP) primarily addresses which concern? → How essential functions will continue during and after a disruption
19. How does thorough documentation of evidence contribute to investigative reporting? → It provides a foundation for further legal action
20. A CSI professional encounters an unfamiliar situation while performing emergency action planning duties. What is the most appropriate first action? → Consult relevant standards, guidelines, or a qualified supervisor before proceeding
21. When a suspect's smartphone is seized, what is the FIRST step an investigator should take to preserve its digital evidence? → Place it in airplane mode or a Faraday bag to prevent remote wiping
22. The 'all-hazards' approach to emergency planning is best described as: → Developing core response capabilities applicable across multiple types of emergencies
23. What is 'wardrobing' in retail loss prevention? → Purchasing items, using them, and then returning them as if unused
24. Which writing style is most appropriate for incident reports? → First person, active voice, formal language
25. Which of the following practices undermines the integrity of a security incident report? → Backdating entries to reflect an earlier time than actual completion
26. Which analytical method is used in loss prevention to categorize inventory by value to prioritize security resources? → ABC analysis
27. When documenting a subject's activity during surveillance for litigation purposes, the investigator should avoid: → Using subjective adjectives like 'suspicious' or 'clearly capable'
28. In security investigations, the PEACE model acronym stands for Preparation, Engage and Explain, Account, Closure, and what? → Evaluation
29. Why is it important to regularly update security policies? → It reduces the number of incidents and response time
30. In terms of access control, what is the difference between authentication and authorization? → Authentication verifies identity; authorization determines what that identity can access