What does forensic readiness mean?

• A. Preventing all cyber incidents.
• B. Having a plan to respond after an incident is detected.
• C. Policies to dispose of evidence.
• D. Being prepared to collect, preserve, and analyze evidence for investigations.

Answer: (D)

Forensic readiness means having the people, processes, and technical capabilities prepared before an incident so evidence can be collected, preserved, and analyzed for investigations. It involves establishing a forensic policy and procedures, defining roles, and equipping the team with the right tools to acquire data from systems, networks, and devices without altering it. Important elements include a documented chain of custody, precise timekeeping, cryptographic hashes to prove integrity, secure storage of forensic images, and trained personnel who know how to collect artifacts properly. With this readiness, investigators can quickly reconstruct what happened, support legal or regulatory inquiries, and ensure evidence remains usable. It’s broader than simply trying to prevent incidents or relying on a post‑incident response plan; it focuses on making evidence collection and analysis effective from the start and preserving its integrity, so disposal policies or casual handling don’t undermine investigations.