What guidelines should be provided to employees in case they are personally contacted by law enforcement as part of an incident investigation?

Your incident response policy should explicitly identify who will serve as the contact for law enforcement investigations. Your employees should be trained so that, if any employees are contacted by law enforcement, they will involve this centralized contact within your organization immediately. There may be corporate policies in place that the legal department will need to review as to the data that you are providing.