HKMA Cyber Resilience Assessment Framework (C-RAF) 5.3.B: 5.3 Cyber forensics: baseline level

Baseline control principles for cyber forensics (required of every AI (minimum for a low inherent risk)). A formal documented procedure collects and preserves the integrity of digital and forensic evidence before analysis (for example by comparing cryptographic hashes), with audit records timestamped from synchronised internal clocks; the institution defines the range of evidence to collect in an incident and keeps it adequate for after-the-fact investigation. (Levels of the 2.0 forensic principles are not stated in the held sources beyond those carried from 1.0.)