Direct answer
For each public-source lead, record the research question, exact source, observation time, what was observed, confidence and remaining uncertainty. Keep the observation separate from identity attribution and retain only what the authorized purpose requires.
Define a narrow research question
For an organization reviewing its own exposure, the question might be which public domains appear in its approved inventory. Record who approved the work, exclusions and the intended decision. Public availability does not authorize account access, harassment or unrelated personal research.
Reference: NIST SP 800-115: Technical information security testing.
Capture reproducible observations
A useful row includes an asset identifier, source address, collection date, visible observation, collector and evidence reference. For a matching username, write that a matching public handle was observed; do not silently change that into a statement of account ownership.
- Distinguish direct observations from search snippets or tool summaries.
- Record source access errors and conflicting results.
- Avoid storing session tokens, unnecessary personal records and complete sensitive links.
Rate corroboration honestly
Two websites repeating the same copied biography are not necessarily independent evidence. A link from an independently verified official website may support a stronger connection, but it can also become stale. Record the basis for the conclusion and what could disprove it.
Reference: NIST SP 800-115: Technical information security testing.
Control access and retention
Keep originals in an approved restricted location and share a minimal summary with decision makers. Apply the organization's retention schedule and correct the record when the source changes. A tool output is a lead to investigate, not an attribution or a complete account inventory.
Reference: NIST SP 800-61 Rev. 3: Incident response recommendations.
Assessment limits
Public sources can be copied, removed, impersonated or inaccessible. An evidence ledger preserves uncertainty but does not guarantee accuracy, completeness or identity verification.
Frequently asked questions
Are two matching usernames independent confirmation?
No. Handles can be reused or impersonated. The connection needs additional independent evidence.
What if the source no longer loads?
Retain the original observation and time if policy permits, and mark the current state as unverified rather than assuming it is unchanged.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.