Sekit CSF · Incident Response · Policy
RCF-0268Forensics readiness
The company has a formal approach to preserving evidence when a security incident occurs
Mapping at a glance
RCF-0268Forensics readinessIncident Response · Policy
RCF-0268 maps to 3 controls across the published frameworks. Open in the full graph →
Maps to ISO/IEC 27001:2022
Curated mapping with the reasoning, not just the codes.
A.5.24Information security incident management planning and preparationrelatedA written approach to preserving evidence touches the same incident lifecycle but serves evidence collection rather than the detection and response planning this control covers.A.5.28Collection of evidencesupportsWriting down what to capture first, who may handle evidence, and when to call in specialists sets policy. A.5.28 needs evidence identified, collected and kept usable, which this written commitment supports but does not itself perform.
Maps to NIST CSF 2.0
Curated mapping with the reasoning, not just the codes.
Evidence that proves this control
What an auditor, or Sekit's evidence engine, asks for.
Incident playbooks, exercises and forensics readiness
The step-by-step guides for the most likely incidents, the tabletop exercises, the post-incident review reports, and how evidence is preserved so an incident can be investigated.
From the Sekit evidence catalog
This topic through the other lenses
All Incident Response controls
Ask Sekura: “What evidence proves RCF-0268?”
Also via MCP, free with account