Direct answer
Retain evidence of readiness and execution: approved roles and playbooks, exercise results, incident declaration and severity, ownership, decision timelines, response tasks, communications, preserved artefacts, custody records, containment and recovery actions, post-incident findings and tracked remediation. Evidence should show what happened, who acted, when, why and what was verified afterward.
Evidence to retain
Preparedness evidence
Approved incident roles and escalation pathsCurrent playbooksExercise or tabletop recordsContact and communication dependencies
Incident execution evidence
Incident ID, severity and ownerTimeline of confirmed facts and decisionsResponse tasks and statusContainment and recovery actions
Forensic evidence
Source and collection metadataHashes or integrity records where appropriateCustody historyInvestigation findings and linked artefacts
Learning evidence
Post-incident reviewRoot-cause or contributing-factor analysisRemediation owners and due datesPlaybook/control updates and closure verification
Relevant Cybatar surfaces
Cybatar operating sourcehttps://cybatar.co/platform/incident-response-playbooksCybatar operating sourcehttps://cybatar.co/platform/digital-forensicsCybatar operating sourcehttps://cybatar.co/security-playbooksCybatar operating sourcehttps://cybatar.co/incident-evidence-preservation-checklist
External guidance
Claim boundary
Evidence demonstrates recorded activity, not necessarily effectiveness, legal sufficiency or compliance. Formal evidence requirements can depend on jurisdiction, contract, regulator, insurer and investigation context.