5.28
Collection of Evidence
The organization should develop and enforce procedures to identify, gather, acquire, and preserve evidence pertaining to information security events.
-
5.1.2.1 The organization shall have an incident response plan for how to respond to incidents of varying severity. If an organization is unable to manage some types of incidents on its own, the organization should have a plan for what it will do.
6.6.3.1 Organizations shall ensure an appropriate understanding of their security logging capabilities and needs and ensure a corresponding log management policy is in place.
NOTE: NIST SP 800-92, “Guide to Computer Security Log Management” describes considerations for Security Log Management and includes examples. Understanding what data is available and what is missing
is a key step in defining a good log management and incident. -
-