Cyber-Forensics Checklist

• Tested incident response plan in place?

• Response plan includes forensic triage?

• Incident team instructed in data collection?

• Network forensic data sources identified?

• Tested forensic plan in place?

• Documentation procedures in place?

  • Document creation
  • Evidence retention and archive

• Sensitive data areas identified on systems?

• Incident reporting policy and guidelines?

Notes: