Forensic Readiness
Forensic Readiness
This domain tests whether an organization can produce reliable digital evidence before an incident is known. Readiness is proactive: governance, logging, retention, trained responders, and tested procedures. NIST SP 800-86 and ISO/IEC 27037 frame preservation and repeatability, so the exam favors concrete controls over slogans.
Core rules
- Maintain a written forensic/incident-response policy approved by legal counsel; define authority, scope, privacy limits, data retention, and escalation.
- Inventory evidence sources: endpoint logs, EDR, SIEM, proxy/firewall, cloud audit trails, email gateways, badge/CCTV, and backup catalogs. Retention must exceed the likely detection window.
- Pre-position a jump kit, validated write blockers, imaging tools, chain-of-custody forms, and labels; test them on a schedule.
- Train first responders to preserve volatile data, avoid booting or clicking, and document actions.
- Exercise tabletop scenarios and after-action reviews; record gaps and remediation owners.
Worked example
An insider is suspected of exfiltrating data 90 days ago. The SIEM retains 30 days, so endpoint logs are gone; however, email DLP logs are retained one year and badge logs two years. The examiner builds a timeline from DLP and physical access, documents the logging gap, and recommends retention aligned to legal/regulatory requirements and threat horizon. Readiness failed for endpoint logs but not for all sources; the report states both clearly.
Traps
Confusing readiness with reactive incident response; assuming cloud providers keep logs indefinitely; omitting legal review; over-collecting personal data without a lawful basis; failing to test restores and tooling; treating a policy as implemented without evidence.
Key points
- Readiness is evidence availability before an incident.
- Retention schedules must match investigation and legal needs.
- Pre-tested tools and forms reduce spoliation risk.
- First responders need documented, minimal-action procedures.
- Exercises expose gaps that policies alone do not.