EH-Net

I am on the IR team at my company and I am the Forensic Analyst of the team. I have taken a few SANs courses and the instructors are always adamant that you get written documentation signed by your Legal Department that authorizes you to conduct analysis on corporate assets. My question is, Does anyone know where I can find a template or a starting point on this type of document?
I was under the impression that it is more for the analyst's protection so going to the company's legal department for the writing of the document seems like a bad idea.

Welcome to EH-Net, akira.

Why do you think going to the legal department or any lawyer would be a bad idea for this? I am asking because I don't think using an existing template and modify it slightly in order to fit your needs better is still not enough to consider all possibilities which could happen and can't replace the process to get help from a lawyer at all.

I've searched and searched.  I've searched previous threads here, NIST (http://csrc.nist.gov/) and everywhere in between.  I am positive I've heard of a template from Ed Skoudis, but darn if I can find it.  My recommendation would be to work with your legal department to work up the language.

Being that you are an internal team, I am not sure if you would require such a document.  I believe the document is more for 3rd party vendors, like penetration testers.  I'm not saying that it would not be helpful to have the information in writing, but it may be overkill.  I think what would be more important is making sure there are appropriate corporate policies which support your work.  You may want to talk to your CIO/CISO.

'Get out of jail free' can still be useful/important for internal terms. In addition to cya, it can also help establish the boundaries and business needs during an incident.

For example, in the event of a incident involving malware on the companies main web farm, can you pull the network to stop additional propogation? Or does the web presence have to remain up and operational at all costs, regardless of how much more difficult it makes containment?

CYA, applies both internal and external in my opinion, although could equally be in the form of a 'procedure' rather than a get out of jail document for internal scenarios.

And in answer to original question; sorry, don't know of any template available for a starting point, despite looking :(

Here's a link to Ed's template: www.counterhack.net/permission_memo.html.

Thanks CMonkeyDO

Thank you CMonkeyDO.

And to everyone else. I wanted to have an idea of what other people were thinking when I went in to the legal department to discuss this.