Overview

This standard provides guidelines based on idealized models for common incident investigation processes across various incident investigation scenarios involving digital evidence. This includes processes from pre-incident preparation through investigation closure, as well as any general advice and caveats on such processes. The guidelines describe processes and principles applicable to various kinds of investigations, including, but not limited to, unauthorized access, data corruption, system crashes, or corporate breaches of information security, as well as any other digital investigation.

Document: references other documents

Responsible national committee

NA 043-04-27-04 AK - Security controls and services  

Responsible european committee

CEN/CLC/JTC 13 - Cybersecurity and Data Protection  

Responsible international committee

ISO/IEC JTC 1/SC 27/WG 4 - Security controls and services