Understanding the NIST SP 800-86 components

Many organizations implement an Incident Response Plan (IRP) to ensure that when a security incident occurs, the impact is minimal, and the organization is able to recover very quickly. Part of an IRP includes the need for forensics techniques to determine how and when the security incident occurred, who is responsible, what was compromised, and what was taken.

Imagine if each organization created and implemented their own IRP without any external guidance from a trusted organization. In this event, the expected results within each organization may not always be the desired outcome. NIST created a Special Publication (SP) 800-86, containing the recommendations as a Guide to Integrating Forensic Techniques into Incident Response. The objective of NIST SP 800-86 is to help organizations with their forensic investigation of security incidents. Overall, the publication provides specific guidelines in terms of how to perform forensic techniques...