RS.AN-06 Actions performed during an investigation are recorded, and the records' integrity and provenance are…
Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved
Source: NIST CSF 2.0, RS.AN-06. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open NIST CSF 2.0 in the compliance library.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Investigation action log per incident · SIEM / log platform
- Tooling audit trail (queries run, evidence pulled) · SIEM / log platform
- Decision log for investigative pivots · SIEM / log platform
periodic reviewEvidence produced at each review
- Chain of custody records for evidence · Document repository
- QA review on action log completeness · SIEM / log platform
governing documentDocuments that govern the control
none for this control
First move
Common gaps auditors find
- Actions captured in chat rather than the case system
- Chain of custody incomplete
- Decision rationale missing
- QA review not conducted
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetRS.AN-03 Analysis is performed to establish what has taken place during an incident and the root cause of the incident · RS.AN-07 Incident data and metadata are collected, and their integrity and provenance are preserved