Sekit CSF · Incident Response · Technical
RCF-0270Forensics readiness
Technical controls capture and preserve forensic evidence automatically when incidents are detected
Mapping at a glance
RCF-0270Forensics readinessIncident Response · Technical
RCF-0270 maps to 3 controls across the published frameworks. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.28Collection of evidencesupportsEDR telemetry retention, tamper-resistant log shipping and snapshot capability give the evidence collection process something automated to rely on instead of manual capture under pressure.A.8.15LoggingsupportsConfiguring systems to capture and retain forensic data automatically, through EDR telemetry and tamper-resistant log shipping, extends A.8.15's logging into incident investigation readiness.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Incident playbooks, exercises and forensics readiness
The step-by-step guides for the most likely incidents, the tabletop exercises, the post-incident review reports, and how evidence is preserved so an incident can be investigated.
From the Sekit evidence catalog
This topic through the other lenses
All Incident Response controls
Ask Sekura: “What evidence proves RCF-0270?”
Also via MCP, free with account