Certified Information Security Manager (CISM)Incident ManagementMedium
A CISO is reviewing the organization's incident response plan and observes that while technical steps for containment and eradication are well-defined, there is no clear process for ensuring that forensic evidence is properly collected, preserved, and admissible in legal proceedings. Which of the following roles or functions should the CISO establish or reinforce to address this gap?
- AA crisis communication team for external stakeholder engagement.
- BA forensic readiness capability and chain of custody procedures.
- CA dedicated Security Operations Center (SOC) analyst team.
- DAn Incident Commander primarily focused on operational recovery.
Show answer & explanationAnswer & explanation
Correct answer: B. A forensic readiness capability and chain of custody procedures.
The problem explicitly states a gap in 'forensic evidence is properly collected, preserved, and admissible in legal proceedings'. Establishing or reinforcing a forensic readiness capability and chain of custody procedures directly addresses this need.
Why the other options are wrong
- A. A crisis communication team handles external messaging, which is separate from the technical and legal requirements for evidence handling.
- C. SOC analysts focus on detection and initial response; while they may collect some data, their primary role isn't formal forensic evidence collection for legal admissibility.
- D. An Incident Commander focuses on overall incident management and operational recovery, not specifically the detailed technical process of forensic evidence handling.
Forensic Readiness
The organization's ability to collect, preserve, and analyze digital evidence in a way that is legally admissible, efficient, and does not disrupt business operations.
- Crucial for legal action or internal investigations.
- Involves technical and procedural preparation.
- Chain of custody is a key component.
Memory trick: To keep evidence clean, be forensically keen.