Stratton Partners' evidence rail arching through eight stations — scenarios, sources, retention, collection, custody, legal, cloud and review — so evidence exists and holds up before an incident starts; the retention gaps found and fixed, where a year of advertised retention was really 30 days, access logs rotated after 90 days when 14 months were needed, and CloudTrail kept only its 90-day default; collection readiness, where EDR live response rose from 41% coverage on an expired licence to 100% and the 30-minute memory-capture target first took four hours; and a chain of custody from hashed collection through immutable storage to release to counsel.

CY-SENIOR-054Senior Level · Forensic Readiness Program

Enterprise Forensic Readiness Program — The Evidence Rail

A senior-level program course that builds the enterprise capability to investigate your own incidents before one ever happens. Work the evidence rail - eight stations: Scenarios, Evidence Sources, Retention, Collection Capability, Integrity & Custody, Legal Alignment, Cloud & SaaS, and Exercise & Review - so evidence already exists, is retained, can be collected fast, and will stand up to a regulator, a court, or an insurer, with real retention config, EDR live-response, cloud log-export, hashing, and custody-record work. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Build and maintain a forensic readiness scenario inventory across cyber, regulatory, and HR triggers.
Map, verify, and retain evidence sources so they are usable, not merely present, when needed.
Pre-position collection tooling, trained responders, and runbooks with measurable time-to-collect targets.
Protect evidence integrity and custody, align with legal and HR, extend readiness into cloud and SaaS, and prove the program through exercises.

Price:৳10,000