Logs Are Missing or Don’t Go Back Far Enough
Important events aren’t recorded, or logs with default settings often overwrite themselves after a short time. If an attack is only noticed after weeks, the initial access remains in the dark.
Incident Response & Forensics
Forensic Readiness: Prepared for When an Incident Strikes
Prepared, not improvised.
Whether a cyberattack can be investigated is often decided long before the attack. With forensic readiness – preparing your organization for forensic investigations – we make sure that, in an emergency, the right logs are available, the timestamps are reliable and the evidence preservation procedures are clear. This helps you answer the crucial questions faster – for recovery, reporting obligations and insurance.
- Guided by BSI DER.2.2
- Data protection & works council rights considered
- Individual quote
Definition
What Is Forensic Readiness?
Forensic readiness is an organization’s ability to secure and analyze digital evidence quickly, completely and traceably in an emergency – without unnecessarily disrupting operations. This includes logging, retention and time synchronization as well as clear roles, rehearsed procedures and rules agreed with data protection and the works council.
The reason is simple: a forensic investigation can only analyze what has been recorded and retained. In practice, investigations therefore often fail not because of the analysis, but because of missing or unusable data.
The BSI (Germany’s Federal Office for Information Security) dedicates module DER.2.2 “Provisions for IT Forensics” of its IT-Grundschutz framework to the topic. Among other things, the module requires reviewing the legal framework while involving the works council or staff council and the data protection officers, creating a guide for initial measures and – if there’s no in-house forensics team – identifying suitable service providers in advance. ISO/IEC 27001:2022 also includes Annex A controls for logging (8.15), clock synchronization (8.17) and collection of evidence (5.28).
On top of that come tight reporting deadlines: under Art. 33 GDPR, reportable personal data breaches must be reported to the supervisory authority without undue delay and, where feasible, within 72 hours. In Germany, entities covered by NIS2 report significant incidents in stages under § 32 BSIG (German BSI Act) to the joint reporting office of the BSI and the BBK (Federal Office of Civil Protection and Disaster Assistance): an early warning within 24 hours, an incident notification within 72 hours and a final report no later than one month after that notification. Financial entities must also report major ICT-related incidents under DORA in several stages. Meeting these deadlines requires having the facts quickly.
Our Approach
How We Make Your Organization Forensically Ready
We start with scenarios that are realistic for you – such as ransomware, a compromised Microsoft 365 account, data exfiltration by insiders or a compromised online shop. For each scenario, we clarify which questions you’d need to answer after an incident and which data you’d need to do so.
We then compare the target and actual state: What is logged where, how long is it retained, and are all clocks in sync? We check samples directly in your environment – because a policy alone doesn’t make logging work.
The result is an actionable, prioritized concept – if you wish, we support the implementation and test the procedures in an exercise.
Typical Risks
Why Forensics Fails Without Preparation
Short Retention in the Cloud
Microsoft Entra ID currently retains sign-in and audit logs for only 7 or 30 days, depending on the license, and AWS CloudTrail event history goes back 90 days. Without an export, older traces are lost.
Inconsistent System Times
If clocks drift apart or time zone information is missing, events can’t be reliably correlated – and the evidentiary value suffers.
Logs Stored Only Locally
If logs are stored only on the compromised system, attackers with administrator rights can delete or manipulate them.
Initial Measures Destroy Evidence
A reboot wipes the memory, a reinstalled server wipes all traces – and logging on to the compromised system with a domain admin account may hand attackers additional credentials.
Incomplete Chain of Custody
Without hash values and documented handovers, there’s no way to prove that secured data is unchanged.
Modules
Three Paths to Forensic Readiness
No rigid packages: we start where you are and tailor the scope individually.
Assessment
Readiness Check
A compact analysis of your logging, retention and procedures based on realistic scenarios.
- Target/actual comparison with spot checks
- Alignment with BSI DER.2.2 and OPS.1.1.5
- Prioritized gaps and quick wins
Design
Readiness Concept
The complete framework for an emergency – technical and organizational.
- Logging and retention concept
- Guides for initial measures and evidence preservation
- Templates, roles and contact plan
Support
Implementation & Exercise
We support the rollout and check whether everything holds up in an emergency.
- Support with configuration and tools
- Training your IT team in evidence preservation
- Practical test in an exercise
Process
Forensic Readiness in Five Steps
Forensic readiness is part of preparing for security incidents – according to guidance such as ISO/IEC 27035 and NIST SP 800-61 Rev. 3, the foundation of effective Incident Response – and a core component of Incident Response Planning.
-
01
Initial Consultation & Target Picture
Starting point, scenarios, requirements such as those from NIS2, DORA or ISO/IEC 27001, and existing tools. You then receive an individual quote.
-
02
Inventory
Interviews with IT, data protection and business units, plus a review of configurations and spot checks in your environment.
-
03
Concept
Logging, retention, time synchronization, guides, chain of custody templates, legal hold and a roles and contact plan.
-
04
Implementation & Training
We support the implementation as well as coordination with the works council and data protection, and train those responsible in evidence preservation.
-
05
Exercise & Maintenance
A trial run shows whether data and procedures hold up – for example in Crisis & Tabletop Exercises. Regular reviews keep the concept up to date.
Deliverables
Documents Your Team Can Work With
You receive practical documents for emergencies that you can also use as evidence of your preparedness in audits. We discuss all results with management, IT and data protection.
- Executive summary with maturity level and prioritized gaps
- Logging and retention concept with configuration requirements
- Guide for initial measures and evidence preservation
- Templates for evidence forms, handover records and legal hold
- Alignment with BSI DER.2.2, OPS.1.1.5 and ISO/IEC 27001:2022
- Action plan and lessons learned from the exercise
Be Prepared Before an Incident Happens
In an emergency, there’s no time to retrofit logging or clarify responsibilities. We show you where you stand and which steps make the biggest difference.
FAQ
Frequently Asked Questions About Forensic Readiness
Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.
We don’t have our own forensics department – do we still need forensic readiness?
Especially then. Even an external forensics team can only work with evidence that exists. That’s why BSI module DER.2.2 emphasizes that strategic preparation is necessary even without in-house forensic expertise. Above all, your team needs to know which initial measures preserve evidence.
How long should we retain logs?
There’s no one-size-fits-all period. It should be long enough to investigate attacks that are only noticed after weeks or months, and no longer than the purpose requires. Tiered, justified retention periods per data source make coordination with data protection and the works council easier.
Is comprehensive logging compatible with data protection?
In principle, yes, if it’s purpose-bound, proportionate and transparently regulated. The main legal basis is the legitimate interest in the security of your IT (Art. 6(1)(f) GDPR). Tiered access rights, fixed deletion periods and – where necessary – a data protection impact assessment are important.
Does the works council need to be involved?
If there is a works council, as a rule, yes: under § 87(1) No. 6 BetrVG (German Works Constitution Act), it has a co-determination right regarding technical equipment designed to monitor employees’ behavior or performance – according to case law, it’s enough that the equipment is objectively suitable for this. That typically also applies to centralized logging and SIEM. It’s best regulated by a works agreement negotiated before an emergency; in the public sector, the same applies to the staff council.
What does legal hold mean?
A legal hold specifically suspends routine deletion as soon as an incident, litigation or official proceedings are foreseeable. Art. 17(3)(e) GDPR provides a point of reference: the right to erasure doesn’t apply to the extent that data is necessary for the establishment, exercise or defense of legal claims. Clear triggers, responsibilities and a defined end are important.
Can we list Rootsektor in our emergency plan?
Yes. Without an in-house forensics team, DER.2.2 requires identifying and documenting suitable forensic service providers during preparation anyway. Feel free to add our contact details and the 24/7 emergency hotline +49 2932 465265-0 to your escalation plan. You don’t need a standby or retainer contract for this – we don’t offer such contracts. In an emergency, contact us directly; we’ll then agree on the scope and approach with you individually.
Related pages
Discuss Forensic Readiness
Tell us briefly about your environment – such as locations, cloud services and regulatory requirements – and we’ll get in touch for a no-obligation initial consultation. In an acute security incident, you can reach our 24/7 emergency hotline at +49 2932 465265-0 or use the Report an emergency form.