The CTO must take all necessary steps to preserve forensic evidence such as log information, files, and images for further investigation so that the organization can determine whether malicious activity has taken place.

The CTO must take all necessary steps to preserve forensic evidence

— Pyrana Incident Response Policy.pdf

(e.g. log information, files, images)

— Pyrana Incident Response Policy.pdf

for further investigation to determine if any malicious activity has taken place

— Pyrana Incident Response Policy.pdf