Question

A mid-size company is building its digital forensics capability. Following NIST SP 800-86 guidance, the security manager wants to ensure that when an incident occurs, analysts can immediately collect and preserve evidence without delay. Which action BEST reflects the NIST SP 800-86 recommendation for organizational readiness?

Accepted Answer

Establish forensic policies, train staff, and prepare a validated toolkit of hardware and software before any incident occurs

Answer

Wait until an incident is confirmed, then purchase and validate forensic tools appropriate to that specific event

Answer

Rely solely on law enforcement to provide forensic tooling and expertise during any investigation

Answer

Focus exclusively on collecting the most volatile data and skip documentation until analysis is complete