scope:

This Recommendation describes a general procedure for cybersecurity incident response and investigation. It also analyses sources of cybersecurity incident evidence and specifies capability requirements for tools used for collection and preservation of such evidence in an investigative process. This Recommendation also specifies reliability assurance requirements for these tools as guidelines to developers who design tools for such purpose.

This Recommendation does not include privacy issues and regulations related to gathering cybersecurity incident data, legal proceedings, disciplinary procedures and other related actions in handling potential cybersecurity incident evidence. These elements are considered outside the scope of "collection and preservation".