Anthropic-Cybersecurity-Skills/skills/performing-endpoint-forensics-investigation/references/standards.md

Standards & References

Primary Standards

NIST SP 800-86 - Guide to Integrating Forensic Techniques

• Publisher: NIST
• Scope: Forensic process for digital evidence collection, examination, and analysis

ISO/IEC 27037 - Guidelines for Digital Evidence

• Publisher: ISO
• Scope: Identification, collection, acquisition, and preservation of digital evidence

RFC 3227 - Guidelines for Evidence Collection and Archiving

• Publisher: IETF
• Scope: Best practices for evidence collection including order of volatility

Compliance Mappings

Framework	Requirement	Forensics Coverage
NIST 800-53	IR-4 Incident Handling	Forensic investigation procedures
NIST 800-53	AU-10 Non-repudiation	Evidence integrity via hashing
PCI DSS 4.0	12.10.5 - Incident response with forensics	Post-incident forensic analysis
HIPAA	164.308(a)(6)(ii) - Response and Reporting	Forensic investigation of breaches

Tool References

• Volatility 3: https://github.com/volatilityfoundation/volatility3
• KAPE: https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape
• Eric Zimmerman Tools: https://ericzimmerman.github.io/
• Autopsy: https://www.autopsy.com/
• SANS Windows Forensic Analysis Poster: https://www.sans.org/posters/