+DER.2.2.A8 Selection and Order of Evidence to Be Secured [Process Owner] (S)

DER.2.2.A8 Selection and Order of Evidence to Be Secured [Process Owner] (S)

A forensic examination SHOULD always start by defining the goals or assignment in question. The goals SHOULD be formulated as precisely as possible. All the required data sources SHOULD then be identified. The order in which data is to be secured and a detailed process for doing so SHOULD also be specified. The order SHOULD be based on the volatility of the data to be secured. Highly volatile data SHOULD be secured promptly. Non-volatile data such as read-only memory SHOULD only be secured afterwards, followed by backups.

1. Přehled

1.1 Odkazy

1.2 Identifikované požadavky

1.3 Související regulace

2. Identifikované požadavky

Požadavky

3. Související regulace

Regulace

Propojené úkoly

Vazby
blocks G 0.17 Loss of Devices, Storage Media and Documents
blocks G 0.22 Manipulation of Information
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.37 Repudiation of Actions
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information