During a cyber incident, responders need to contain harm while preserving enough reliable information to understand what happened. Evidence handling should support response rather than become an improvised task after systems have already changed.
Start a timeline early
Record when the issue was detected, who was involved, major observations, containment actions, important system changes, and decisions. Use consistent timestamps and distinguish confirmed facts from working assumptions.
Preserve relevant records
Identify logs, alerts, authentication records, configuration changes, endpoint or cloud telemetry, communications, and other records that may explain the event. Avoid unnecessary collection of unrelated sensitive information.
Limit avoidable alteration
Containment and recovery can change the environment. When practical, preserve relevant records before destructive actions and document changes that responders make. Do not delay urgent protective action merely to create a perfect evidence set.
Control access and retention
Restrict incident records to people with a legitimate need, preserve integrity where practical, and follow applicable organizational, contractual, legal, privacy, regulatory, or law-enforcement requirements for retention and disclosure.
Use qualified support when stakes rise
Potential litigation, regulated reporting, criminal activity, insurance requirements, or formal forensic examination can require specialized procedures. Operational responders should involve appropriate legal, privacy, compliance, forensic, or law-enforcement professionals when those requirements apply.
Related knowledge
Continue with Security Logging for Business SaaS, Incident Response Planning, Privileged Access Reviews, and Secrets and Credential Management.
References
- NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
- NIST Cybersecurity Framework 2.0
This is general cybersecurity guidance and is not legal advice, forensic procedure, or a substitute for incident-specific professional requirements.