RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

Statement

Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved

Guidance

Require each incident responder and others (e.g., system administrators, cybersecurity engineers) who perform incident response tasks to record their actions and make the record immutable

Guidance

Require the incident lead to document the incident in detail and be responsible for preserving the integrity of the documentation and the sources of all information being reported

1. Overview

1.1 References

• 3.2 Monitoring and logging

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final