What it asks for. This Respond category, called Analysis in CSF 1.1, asks that investigations are conducted to ensure effective response and support forensics and recovery. It covers determining what happened and the root cause, preserving evidence and estimating incident magnitude.
In practice. Responders follow playbooks to scope incidents, collect and preserve evidence with integrity, build timelines and identify root cause. Forensic capability exists in house or via a retainer, and incidents are categorised consistently. Evidence includes investigation records, chain of custody documentation and root cause reports.
Common gaps. Evidence is often lost because logs were not retained or systems were rebuilt too early. Root cause analysis is frequently skipped once service is restored, so the same weakness can be exploited again.