Forensic Analysis
What is Forensic Analysis?
The detailed technical examination of digital evidence to determine the cause, scope, and impact of a security incident.
Frameworks that govern forensic analysis
What the standards actually require on forensic analysis
Requirements naming forensic analysis across 6 standards, quoted from the control text.
The incident response plan must include processes for preserving information that can serve as evidence (including training of operations personnel on preserving evidence when anomalies are suspected), for identifying, collecting and acquiring evidence, for fo...
api-1164::RS.AN-3 · RS.AN-3 Evidence preservation, collection and forensic analysis for root cause →Forensic analysis capabilities. Implements CyFun RS.AN-1 / RS.AN-3: detection notifications are investigated and forensic analysis is performed.
BE-CF-21 · Forensic analysis capabilities →Upon request, the Contractor shall provide DoD with access to additional information or equipment necessary to conduct a forensic analysis of a reported cyber incident.
DFARS-7012-f · Access to additional information or equipment for forensic analysis →Analyze malicious code and/or other residual artifacts remaining in the system after the incident.
NIST800-IR-4(12) · IR-4(12) Incident Handling | Malicious Code and Forensic Analysis →Information security incident management consists of five phases: plan and prepare, which puts in place everything needed to operate incident management (policy and senior commitment, updated security and risk policies, the plan, the incident management struct...
iso-iec-27035-1-2023::5.1 · Overview of the process →Produce log data that identifies user access unambiguously at tenant level to support forensic analysis after a security incident, and provide interfaces for conducting forensic analysis and taking backups of infrastructure components and their network communi...
C5-OPS-15 · Logging and Monitoring - Accountability →Questions people ask about forensic analysis
What is Forensic Analysis?
Why is Forensic Analysis important for compliance?
Which compliance frameworks address Forensic Analysis?
Where can I learn more about Forensic Analysis?
See how Forensic Analysis applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.