What is 'forensics readiness,' and what practices contribute to it?

• A. Maintaining incident response diagrams only.
• B. Having capabilities and processes ready to collect and preserve evidence; includes tools, procedures, and trained personnel.
• C. Encrypting all data at rest and in transit exclusively.
• D. Only performing forensics after a major breach.

Answer: (B)

Forensics readiness means having the people, tools, and documented processes in place before an incident occurs so you can collect, preserve, and analyze digital evidence in a reliable and legally sound way. It isn’t just about having a diagram or about encrypting data; it’s about being prepared to perform a proper investigation whenever something happens. This includes having the right capabilities to gather evidence, defined procedures that describe how evidence is collected and stored to maintain its integrity, and trained personnel who know how to handle and interpret the data. It also covers practical elements like logging, data retention, chain of custody, secure storage of evidence, and rehearsed workflows with the appropriate forensic tools and methods. Waiting until a breach to start forensics misses early, potentially compromised data and legal issues, whereas readiness ensures investigations can start quickly and produce credible results.