PENTESTY · EDITORIAL ANALYSIS · · 4 min read
Corporate investigations: who verifies the origin of delivered data?
A useful report also needs to explain how its information was obtained. The contracting company can examine that origin before accepting or distributing a deliverable.
By Pentesty
The U.S. request and the limits of the conclusion
On September 9, 2026, Wyden, Harrigan and Whitehouse asked the Commerce Department to add companies accused of commissioned hacking to the Entity List. The letter is a request and does not itself establish a listing. In its Entity List FAQs, BIS describes license requirements for specified exports, reexports and transfers. This analysis proposes business controls without determining the guilt of the named companies.
Start with what the contractor may obtain
Imagine a commercial dispute in which a provider promises to explain connections between organizations. Before approving the work, separate public-record research, analysis of documents supplied by your company and collection requiring another authorization. Identify who may expand the scope. A deliverable containing more detail than agreed requires an explanation of its origin before anyone circulates it internally.
Record the purpose, permitted datasets, recipients and exclusions. Involve the legal owner when rights, jurisdiction or use in litigation remain uncertain. Partnership and information-sharing governance complements this preparation: appointing an intermediary does not replace identifying who actually receives information and performs the investigation. Each change needs an accountable owner rather than an informal assumption.
Request a verifiable explanation for each deliverable
For a sample of the report, request the source, collection date, collector and recorded authorization or justification. A reference should allow a reviewer to confirm the described route without entering third-party accounts. Where a methodology involves trade secrets, arrange a restricted review by an authorized professional while preserving the boundaries of the agreed assessment and the information being examined.
Distinguish an analytical conclusion from a received document. Record relevant transformations, excerpts and limitations, avoiding presentation of an interpretation as a complete transcript. This proposed review examines traceability within the sample; it does not certify the legality of the whole investigation. A gap requires clarification and a recorded decision rather than automatically becoming an allegation against the service provider.
Exercise acceptance before receiving sensitive material
Build an exercise using synthetic documents. Include one documented deliverable and another with incomplete provenance, without simulating intrusions into real accounts. Ask procurement, legal and security teams to follow their normal procedure. Observe whether someone accepts the second deliverable because its contents look convincing or a commercial deadline creates pressure to proceed without the expected review.
The exercise can adapt evidence and retest criteria from security assessments to the contracting workflow. Compare expected and observed outcomes. Record where processing stopped, who decided and whether recipients received only the approved version. A completed checklist without observing distribution does not establish that acceptance operated as intended across the actual delivery path.
- Scope: identify the requester, purpose, permitted sources and owner of exceptions.
- Delivery: examine references, dates, transformations and limitations in an agreed sample.
- Intermediaries: record who collected, received, analyzed and shared the materials.
- Decision: document acceptance, clarification requests or suspension and their accountable owners.
Separate contract review from regulatory status
Maintain one record for the service and another for regulatory screening of the counterparty. The export-control owner should examine the official entry and actual transaction before concluding what a restriction means. A congressional letter does not replace that review. Attention to data origin remains relevant even when no designation has been identified in the checks performed by the organization.
Pentesty’s assessment is that a useful outcome is a decision another person can review: what was requested, where the sample came from, which questions remained and why distribution was permitted. At contract closure, examine return, agreed retention and remaining access. Describe the observed state and limitations without promising that this procedure eliminates the risks associated with collecting and using information.
Frequently asked questions
Does the congressional letter already prohibit hiring these companies?
The letter requests Commerce Department action. It does not establish an Entity List designation or decide which requirements apply to a particular contract or transaction.
Does the Entity List prohibit every commercial relationship?
BIS FAQs distinguish license requirements and their scope. Analysis depends on the entry and transaction; a headline cannot replace examining those details and applicable requirements.
Does incomplete provenance prove an intrusion occurred?
No. It identifies a gap requiring clarification. Restrict access to the material and refer the decision to the designated owners without inferring that a crime occurred.
How can the process be tested without collecting third-party data?
Use synthetic documents, previously approved sources and agreed acceptance criteria. Record whether the incomplete deliverable was contained and who authorized the next step in the process.
Sources and references
- U.S. Senate: Wyden, Harrigan and Whitehouse letter, September 9, 2026
- BIS: Entity List FAQs, questions 1, 5, 7 and 10
Original Pentesty analysis, published October 16, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.