An organization's incident response team has successfully contained a data breach incident. Which of the following actions is the MOST appropriate next step to ensure that the digital evidence remains intact for forensic analysis?
Performing secure backups of affected systems
Disconnecting compromised systems from the network
Creating a forensic image of affected systems
Turning off systems to ensure data is not tampered with
|Threats, Vulnerabilities, and Mitigations
|Security Program Management and Oversight
|General Security Concepts