Technical controls capture and preserve forensic evidence automatically when incidents are detected
EDR telemetry retention, tamper-resistant log shipping and snapshot capability give the evidence collection process something automated to rely on instead of manual capture under pressure.
Configuring systems to capture and retain forensic data automatically, through EDR telemetry and tamper-resistant log shipping, extends A.8.15's logging into incident investigation readiness.