Which statement best defines forensics readiness?

• A. Maintaining incident response diagrams only.
• B. Relying on user reports without tools.
• C. Involving only legal counsel in incident handling.
• D. Having capabilities and processes ready to collect and preserve evidence; includes tools, procedures, and trained personnel.

Answer: (D)

Forensics readiness means you’re prepared to conduct a forensics investigation by having a stable, repeatable set of capabilities to collect and preserve evidence before, during, and after an incident. This includes the right tools (forensic software, write-blockers, secure storage), documented procedures for how evidence is gathered and kept with a clear chain of custody, and trained personnel who know how to handle artifacts without altering them. With this readiness, investigations can start quickly, evidence integrity is maintained, legal defensibility is improved, and business disruption is minimized.

Relying only on user reports without proper tools, having nothing but incident diagrams, or involving only legal counsel neglects the technical, procedural, and personnel aspects needed to preserve and analyze evidence effectively.