# SEC10-BP03: Prepare forensic capabilities

## Description

Forensic readiness.

## Implementation Guidance

- Log retention for forensics
- Disk snapshot capabilities
- Memory capture tools
- Chain of custody procedures
- Forensic analysis tools

## Risk Level

Medium - No forensics means no root cause.
