Control Statement
Incident data and metadata shall be preserved at a fidelity and for a period sufficient to support reconstruction, legal action and subsequent analysis, under a defined chain of custody.
Purpose. To ensure the material an engagement depends on still exists when it is needed, and is admissible where that matters.
Discussion
Retention is the failure that cannot be remediated after the fact. If telemetry retention is thirty days and plausible dwell is ninety, the reconstruction under EN-2 cannot reach the entry point, RC-4 cannot select a safe restore point, and no amount of subsequent investment recovers the data. Retention should therefore be set against the dwell estimate rather than against storage cost, which is the same reasoning applied by FC-2 to physical crossing logs. Chain of custody is the second requirement and is frequently omitted until an incident turns out to involve an insider or a criminal referral, at which point it cannot be established retrospectively.
Goals and Metrics
A metric that cannot come out badly is not a metric. Each of these is capable of reporting that the control is not working.
- Telemetry retention against the current dwell estimate, by terrain layer
- Number of terrain layers whose retention is shorter than estimated dwell
- Evidentiary integrity verification pass rate
- Percentage of preserved items with an unbroken custody record
Accountability
Exactly one role is accountable, and every other role carries at least Informed — no control in the published catalog leaves a role with zero relationship to it. That is a stated property of how these were authored, not a coincidence, and not a claim that every role's work is worth equal attention here.
| AO | CTI | SOC | HUNT | PLAT | ISSO |
|---|---|---|---|---|---|
| Authorizing Official / CISO: Accountable | Cyber Threat Intelligence cell: Informed | SOC / Defensive Operations: Responsible | Hunt team: Consulted | Platform and product owners: Informed | Governance / RMF / ISSO: Consulted |
AO Authorizing Official / CISOCTI Cyber Threat Intelligence cellSOC SOC / Defensive OperationsHUNT Hunt teamPLAT Platform and product ownersISSO Governance / RMF / ISSO
- AccountableAuthorizing Official / CISO
- InformedCyber Threat Intelligence cell
- ResponsibleSOC / Defensive Operations
- ConsultedHunt team
- InformedPlatform and product owners
- ConsultedGovernance / RMF / ISSO
Inputs and Outputs
Consumes
- EN-1 Event Declaration and TriageDeclared incidents that trigger preservation
- TA-2 Adversary Dwell EstimationDwell estimate that sets the retention floor
- TM-2 Defensive Layer ClassificationTerrain classification determining what must be preserved
- WF-4 Insider Risk PositionLegal and privacy determinations bounding what may be held
Produces
- EN-2 Engagement ReconstructionThe material reconstruction is performed from
- RC-4 Recovery Integrity VerificationIntegrity record restore points are verified against
- DV-3 Endpoint Sensor Coverage and LivenessRetention requirement sensor coverage must satisfy
Activities
- L2Preserve incident data and metadata on declaration.
- L2Record what was preserved, by whom and when.
- L2Define the retention period for preserved evidence.
- L3Set telemetry retention against the dwell estimate under
TA-2rather than against storage cost, and raise a finding where retention is shorter. - L3Define chain of custody for material that may support legal or personnel action, consistent with the safeguards in
WF-4. - L3Preserve material outside the environment under investigation, so evidence is not held where an adversary with access could alter it.
- L3Extend preservation to volatile material where the terrain warrants it, since it is lost by containment actions taken minutes later.
- L4Measure telemetry retention against the current dwell estimate per terrain layer, and trend the shortfall.
- L4Test evidentiary integrity by verifying preserved material against its recorded hash or equivalent on a defined cadence.
- L5Extend retention and fidelity where reconstructions repeatedly fail to reach the entry point, rather than accepting the limit as fixed.
Measurement
Telemetry retention against the current dwell estimate, by terrain layer.
Evidentiary integrity verification pass rate.
Evidence and Assessment
Preserved evidence inventory with custody records; retention configuration by terrain; integrity verification results.
Compare retention against the current dwell estimate; test chain of custody on a sample; test that preserved material is held outside the investigated environment.
Related Guidance
- AU-9
- AU-11
- IR-4
- RS.AN-07
Position in the Chain
Derived from the other controls’ own declarations, so the two directions cannot disagree.
Fed By
Nothing upstream — this control starts a chain.
Where This Control Is Used
Derived, in every case, from the declaration at the other end: the forms whose techniques name this control, the artifacts whose producing and consuming controls include it, the layers whose control lists name it, and the roles its own accountability chart puts to work. Nothing here is authored on this page, so the sheet cannot claim an edge the other end does not.
Forms of Maneuver It Assesses
- M8Isolation / RetrogradeGive ground deliberately to preserve the force. Degrade gracefully; never fail open.1 of 17 techniques — M8.09
Terrain It Is Named On
Applies to all ten layersSets how long this layer’s telemetry must survive — measured against estimated dwell, not against a retention default.
Artifacts It Stands On
- producesEngagement recordThe record of one engagement end to end: what was declared and on what criteria, the reconstruction with its dwell, scope and confidence, the evidence preserved and its custody, the authority exercised, and the verification that eradication actually happened before recovery began.
- consumesCyber Terrain OverlayThe positional map of the estate: every element with a defensive layer, a defensive weight, a named accountable owner and its adjacencies. Not an asset inventory — an inventory enumerates, an overlay positions.
- consumesAdversary dwell estimateThe estimated time an adversary could operate undetected in this estate, with its basis stated — measured dwell, sector reporting, or partner intelligence — and its bias acknowledged.
- consumesTemporal advantage resultDefender decision loop against adversary dwell, reported as a ratio against the threshold set at Frame, with the result written as a word: met, or not met. The framework’s single honest scoreboard.
- consumesInsider risk positionThe stated position on insider risk: what may be done, by whom, under what legal, privacy and labor-relations constraints, and how a case is dispositioned.
Roles It Puts to Work
- AccountableAuthorizing Official / CISOIntent, risk acceptance, and the scheme itself.
- ResponsibleSOC / Defensive OperationsManeuver. Executes fires and emplaces obstacles inside the standing rules of engagement.
- ConsultedHunt teamCounterattack. Works the hypotheses that Fuse raises.
- ConsultedGovernance / RMF / ISSOTranslating cycle outputs into FISMA and RMF artifacts, and owning the rules of engagement.
- InformedCyber Threat Intelligence cellFrame, Map and Fuse. The intelligence requirements, the threat courses of action, and the confidence levels.
- InformedPlatform and product ownersTheir own terrain. Obstacles get emplaced on their ground, so they site them.