Shortcomings regarding the documentation of IT operations or missing records may make it impossible to investigate or clear up security incidents. Since it is often not immediately apparent how an attack was carried out, how extensive it was, or how systems were manipulated, appropriate investigations are first required to answer such questions. To make this possible, however, the target state of IT systems prior to the security incident in question must be documented and verifiable. It must also be possible to distinguish between proper and unauthorised changes to IT systems on the basis of suitable records. If corresponding information is not available, incidents can only be investigated with some degree of difficulty, if doing so is feasible at all. In such cases, it is also not possible to provide any legally valid evidence against the attackers.