Evidence helps you understand the attack, support insurance claims and meet reporting duties. Collect logs, memory images and disk images from key systems before rebuilding them.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Export logs before they roll over
- Image key systems before wiping
- Record who handled the evidence
Next steps
An external responder can collect evidence while your team restores service. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.