Outside Working Hours / Days

The subject conducts work-related activity outside their established working hours or normal working days. This may include accessing organizational systems, applications, sensitive information, or physical facilities during periods when the subject would not ordinarily be expected to perform their duties.

Activity outside normal working periods may indicate preparation for an infringement, particularly when the subject accesses resources unrelated to their assigned responsibilities or operates during periods of reduced organizational oversight. Such behavior may provide opportunities to conduct reconnaissance, collect or stage information, or test access without attracting attention.

The subject's expected working schedule must be established before assessing this behavior. Working hours may vary according to role, location, shift arrangements, flexible working agreements, on-call responsibilities, and authorized overtime. Investigators should distinguish genuine human activity from automated processes, scheduled tasks, persistent sessions, and other system-generated events that do not demonstrate active participation by the subject.

Activity outside established working periods is not inherently suspicious. Its investigative significance increases when it represents a deviation from the subject's historical behavior and correlates with other indicators of preparation or infringement.