Develop forensics capabilities

Ahead of a security incident, consider developing forensics capabilities to support security event investigations. The Guide to Integrating Forensic Techniques into Incident Response by NIST provides such guidance.