Security incident response management, evidence collection and forensics

Even strong defenses will sometimes fail. Incident response management limits damage, restores operations and learns from each event. An organization that prepares in advance, with a plan, a team and practice, responds faster and more consistently than one that improvises while systems are down and executives are asking questions. For the auditor, preparation is the most important thing to test, because by the time an incident happens it is too late to write the plan.