NIST CSF 2.0, RespondRS.AN-07

On a system failure or disruption with a serious impact resulting from another party's act against your Electronic System, such as an attack or intrusion, secure the affected Electronic Information and/or Electronic Document.

Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.

Preserve and protect forensic images of the affected information systems and related monitoring and packet-capture data for at least 90 days counted from the date you submit the cyber incident report, not from the date you discovered the incident, so the Department of Defense can request the media or decline interest.

Take steps to prevent the loss of digital evidence needed to fully investigate the incident, and keep the records needed to analyze it.

Develop, document and implement an ICT-related incident policy that documents the incident management process, lists the relevant internal and external contacts, sets up mechanisms to support incident management, retains evidence relating to ICT-related incidents in a secure manner, and analyses significant or recurring incidents (Article 22). Set clear roles and responsibilities to detect and respond to ICT-related incidents and anomalous activities, collect, monitor and analyze logs, cyber threat information and incident notifications from ICT third-party service providers, implement tools that generate alerts at least for the ICT assets and information assets supporting critical or important functions, and log the date, time and type of each detected anomalous activity (Article 23).