Requirement
"The organization shall establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events."[1]
Explanation
As part of the incident response process you must collect evidence of the incident. This includes system logs screen shots user reports system images and potentially physical hardware related to the incident.
