Key concepts
The guide describes a four-phase forensic process (collection, examination, analysis, reporting) and applies it to files, operating systems, network traffic and applications. It is not a legal manual.
How it is organized
- Establishing a forensics capability
- The forensic process: collection, examination, analysis, reporting
- Data from files, operating systems, network traffic and applications
- Combining multiple sources
What a school district should take from it
- Wiping and rebuilding a system too early can destroy information insurers, responders and law enforcement need.
- Most districts should rely on their insurer's or pool's approved responders for forensics.
How to use it in your district
- Add an 'evidence first' step to the incident plan before reimaging servers.
- Know which responders your insurer or pool requires before engaging anyone.
- Keep basic log and system information that responders will ask for.
Common misconceptions
- Forensics is only for crimes.
- It also answers what happened and what data was affected, which drives notification decisions.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- RS.ANIncident Analysis
Tools in the program portal
- Incident respondersLine up outside response help before you need it
- Cyber insurancePolicy conditions, questionnaire and Breach Day card
- Incident DeskDeclare an incident and track reporting clocks
Related publications
- SP 800-61 Rev. 3Incident response
Citation and source
SP 800-86, Guide to Integrating Forensic Techniques into Incident Response. National Institute of Standards and Technology. 2006. https://doi.org/10.6028/NIST.SP.800-86.
Topics: Incident response. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.