A1.2.2 Processes or mechanisms are implemented to support and/or facilitate prompt forensic investigations in the event of a suspected or confirmed security incident for any customer.

Defined Approach Requirements

A1.2.2 Processes or mechanisms are implemented to support and/or facilitate prompt forensic investigations in the event of a suspected or confirmed security incident for any customer.

Customized Approach Objective

Forensic investigation is readily available to all customers in the event of a suspected or confirmed security incident.

Defined Approach Testing Procedures

A1.2.2 Examine documented procedures to verify that the provider has processes or mechanisms to support and/or facilitate a prompt forensic investigation of related servers in the event of a suspected or confirmed security incident for any customer.

Purpose

In the event of a suspected or confirmed breach of confidentiality of cardholder data, a customer's forensic investigator aims to find the cause of the breach, exclude the attacker from the environment, and ensure all unauthorized access is removed.

Prompt and efficient responses to forensic investigators' requests can significantly reduce the time taken for the investigator to secure the customer's environment.