12 new national NIS2 framework versions published! Read more ->
Cyberday back to normal - related blog
The organization shall provide on-demand audit review, analysis, and reporting for after-the-fact investigations of information/cybersecurity incidents.
The organization shall conduct forensic analysis on collected information/cybersecurity
event information to determine root cause.
Guidance
Consider determining the root cause of an incident. If necessary, use forensics analysis on collected information/cybersecurity event information to achieve this.
If it is difficult to identify the source of a security incident based on the primary treatment, a separate follow-up analysis is performed for the incident, in which the root cause is sought to be identified.
After a disturbance, a forensic examination must be carried out on the malicious code or other remnants of the disturbance. A safe investigation in a closed environment can open up the causes, goals, and motives of the incident. This helps the organization fix potential security vulnerabilities, prepare for similar incidents, and identify or profile a potential attacker.
.png)
