NCSC Urges Forensic Observability in Network Devices for Enhanced Incident Response

• •NCSC calls for forensic observability in network devices to improve incident response.
• •Manufacturers are urged to provide built-in capabilities for evidence collection post-compromise.
• •The NCSC is developing a reference architecture to guide manufacturers in implementing these features.

The UK's National Cyber Security Centre (NCSC) has called on device manufacturers to embed forensic observability features in network devices to aid incident response teams. Chris A, technical director at NCSC, emphasized that firewalls and VPN gateways are increasingly targeted by attackers, necessitating reliable methods for understanding compromises. Forensic observability includes telemetry, logging, and the ability to collect forensic data, which should be built into products to avoid reliance on reverse engineering. Despite the NCSC's guidance issued in February 2025, many manufacturers are not meeting these requirements. The NCSC is collaborating with global partners to develop a reference architecture for forensic observability. This initiative aims to ensure that manufacturers can provide safe and reliable forensic access without compromising security.