NIST CSF 2.0 RS.AN-07: Preserve Incident Data

RS.AN-07 says incident data and metadata are collected, and their integrity and provenance are preserved. The data that proves what happened, such as logs, disk images, emails and memory captures, disappears or changes quickly. This outcome asks you to capture it deliberately and prove it was not altered. CSF is voluntary, and there is no CSF certification.

What good looks like

You know in advance which data to grab for common incident types and who is allowed to grab it. Each item is recorded with its source, collection time, the collector and a hash. Copies are stored read only, and access to them is logged. A simple chain of custody note follows the item from collection to storage.

How to implement it

• Write a one page checklist per incident type: compromised account, malware on a laptop, data exposure, cloud misconfiguration.
• Check log retention now. Extend short windows for identity, cloud audit and endpoint logs.
• Collect with tools that preserve metadata. Export logs in native formats rather than screenshots.
• Compute a hash at collection time and record it in the incident log.
• Store evidence in a restricted location with write once or versioned settings.
• Decide when to involve outside forensic help, and keep their contact details ready.

Evidence to collect

• The collection checklists.
• A sample evidence record with hash, collector and timestamps.
• Storage access settings and logs.
• Retention settings for key log sources.

Common gaps

Retention is thirty days and the incident is found on day forty. Evidence is collected on a personal laptop. Rebooting or reimaging a machine destroys memory data before capture. Metadata is stripped by copying through email or chat.

Quick check

Sources

• NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
• NIST CSF 2.0 Reference Tool and implementation examples: https://csrc.nist.gov/Projects/Cybersecurity-Framework/Filters#/csf/filters