RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved

Statement

Incident data and metadata are collected, and their integrity and provenance are preserved

Guidance

Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures

1. Overview

1.1 References

• 3.2 Monitoring and logging

1.2 Identified Requirements

1.3 Related Regulations

2. Identified Requirements

3. Related Regulations

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final