[Introduction to Incident Handling and Response] Which of the following GPG18 and Forensic readiness planning (SPF) principles states that “organizations should adopt a scenario based Forensic Readiness Planning approach that learns from experience gained within the business”?

CESG’s Good Practice Guide 18 (GPG 18) lists seven Forensic-Readiness (SPF) principles. Principle 5 states: “Organisations should adopt a scenario-based Forensic Readiness Planning approach that learns from experience gained within the business.” The wording in the question is taken verbatim from that definition; therefore Principle 5 (option C) is the only correct choice.

A. Principle 3 deals with ensuring evidence collection is proportionate and cost-effective, not with scenario-based learning.
B. Principle 2 concerns integrating evidence requirements with the organisation’s risk-management process, not scenario-driven planning.
D. Principle 7 focuses on extending forensic-readiness obligations to external suppliers and service providers, not internal scenario learning.

1. CESG (UK NCSC) “Good Practice Guide No. 18: Forensic Readiness Planning”, v2.0, Mar 2010, §4 “The Principles”, p.10 – Principle 5 paragraph 1.

2. UK Cabinet Office “Security Policy Framework”, v11.0, Apr 2018, Requirement 44 note 4 — cross-reference to GPG 18 Principle 5.

3. M. Kohn, M. Eloff & J. Eloff, “Integrated Digital Forensic Readiness,” Digital Investigation, 2013, vol. 9, p. S84; Table 1 summarises GPG 18 principles (Principle 5 entry). DOI:10.1016/j.diin.2012.05.012

4. University of Leicester, MSc Computer Forensics Module CO7508, Lecture “Forensic Readiness”, slide 18 – list of GPG 18 principles (identifies Principle 5 as scenario-based learning).