API 1164 RS.AN-3: RS.AN-3 Evidence preservation, collection and forensic analysis for root cause

The incident response plan must include processes for preserving information that can serve as evidence (including training of operations personnel on preserving evidence when anomalies are suspected), for identifying, collecting and acquiring evidence, for forensic analysis for root cause, and for feeding forensic findings into lessons learned.