Skip links

Incident and digital investigation preparedness

Assess responsiveness and prepare digital evidence collection and retention processes

Navighează la

Preparing for an incident involves people, procedures, and tools that can be used together. A structured assessment helps the organization understand existing gaps and establish the necessary measures in advance of a critical situation.

Safetech Innovations offers two distinct services: incident response readiness assessment and forensic investigation readiness. You can select an IR assessment project or an annual subscription for forensic readiness procedures and checks, with your own objectives and deliverables.

Utility and benefits

The services are aimed at organizations that want to verify the readiness of response teams and organize the processes necessary to manage digital records.
Depending on the service selected, you benefit from:

Identification of readiness gaps

Assessment of the response plan, procedures, team and tools

Practice coordination

An exercise that allows you to analyze how procedures are applied in the agreed scenario

Organizing records

Procedures and models for collecting evidence and documenting the chain of custody

Priorities for improvement

Documented findings and actions for the responsible teams

Periodic check

Follow-up of forensic training through annual checks and exercises within the scope of the subscription

Service characteristics

The Incident Response Readiness Assessment and Forensic Readiness & Chain of Custody services have the following characteristics:

IR Readiness Assessment

We evaluate the incident response plan, procedures, team, available tools, and previous exercises. The analysis tracks the organization’s ability to apply existing processes and gaps that need attention.
The project includes a tabletop exercise, with an object, scenario and agreed limits. The participants go through the proposed situations, and the observations contribute to the evaluation of the preparation and to the definition of improvement actions.

Deliverables:

  • IR Readiness Report.
  • Gaps identified in response preparedness.
  • Tabletop exercise.
  • Action plan.

Collaboration model:

Project with a defined scope. We establish the object of the evaluation, the duration and limits of the exercise, the success criteria and the way to follow up the actions. The included exercise supports the evaluation of the preparation; the intervention in a real incident is contracted separately.

Forensic Readiness & Chain of Custody

We prepare the organization for digital investigations through evidence collection procedures and chain of custody documentation. Agreed models and flows support the traceability of records and clarification of responsibilities for their management.

The subscription includes checks and an annual simulation exercise, in the established area. These activities aim to monitor the functioning of the process and identify the aspects that need adjustments.

Deliverables:

  • Forensic readiness procedures.
  • Templates for documenting the chain of custody.
  • Annual verification report.
  • Simulation exercise.

Collaboration model:

Annual subscription, with verifications and annual exercise. The object of the verifications, the frequencies and the conditions of acceptance are agreed for the organization. Procedural preparation is distinct from the collection and analysis of evidence in a real investigation.

Methodology, mode of collaboration, complementary services

Methodology and way of collaboration

  1. Clarification of objectives. We select the service, processes and teams included and determine the desired results.
  2. Defining the conditions. We agree on the necessary information, access, responsibilities, timing and limits of the evaluation or exercise.
  3. Evaluation or preparation of processes. We analyze the IR capacity or develop forensic procedures and models according to the contracted service.
  4. Practice and verification. We carry out the included activities and document the findings within the agreed perimeter.
  5. Presentation of results. We explain deliverables, gaps and relevant actions to the responsible teams.

Complementary services

For the availability of an intervention team or the analysis of a managed incident, you can separately select Incident Response Retainer and Post-Incident Analysis.

Tabletop exercises and additional cyber crisis simulation and forensic hands-on training have distinct objectives and deliverables.

For continuous monitoring and detection, SOC/MDR services are available. The inclusion of these services is explicitly stated.

What recommends us?

CERT’s experience in incident management and the capabilities of the Safetech forensic laboratory support the assessment of readiness and the definition of processes for digital records. We correlate activities with the roles, procedures and tools of the organization, to identify relevant gaps and actions applicable to the teams involved.

Our intervention experience is illustrated by the case study on the CERT STI response to a critical ransomware incident. We leverage this operational perspective to support the organization’s preparedness. The intervention and analysis of a managed incident is contracted through distinct services.

Contact us

Similar articles

See all articles
Powered by  GDPR Cookie Compliance (opens in a new tab)
Overview of Privacy

This website uses cookies to provide you with the best user experience. Cookie information is stored in your browser and serves the purpose of recognizing you when you return to our site, as well as assisting our team in understanding which sections of the site you find more interesting and useful. For more information, you can refer to the General Information Note Regarding the processing of personal data.