dfir-readiness

namespace	aiwg
name	dfir-readiness
platforms	["all"]
description	Use when a project needs DFIR readiness from the security-engineering side: prepare incident evidence handling, chain-of-custody expectations, IOC readiness, and handoff to forensics-complete without collecting evidence.
triggers	["DFIR readiness","incident response readiness","evidence preservation readiness","chain of custody readiness","IOC readiness","forensic report readiness"]
requires	[{"project-context":"repository or workspace that may need evidence-bearing incident response"}]
ensures	[{"boundary-routing":"preventive security, production incident management, and forensic investigation responsibilities are separated"},{"forensics-handoff":"operator is routed to forensics-complete for evidence-bearing work"},{"readiness-record":"preparation notes can be written under .aiwg/security-engineering/incident-readiness/"}]
invariants	["no live evidence collection happens from this skill","no containment, cleanup, or destructive action is suggested without explicit operator authorization","forensic case artifacts stay under .aiwg/forensics/"]

DFIR Readiness

Use this skill when a security-engineering conversation turns into incident readiness: evidence handling, chain of custody, IOC workflow, forensic report readiness, or "what should this project have in place before an incident?"

This is a bridge. It prepares and routes. It does not replace forensics-complete, and it does not collect evidence.

Triggers

• "DFIR readiness"
• "incident response readiness"
• "evidence preservation readiness"
• "chain of custody readiness"
• "IOC readiness"
• "forensic report readiness"
• "prepare this project for a breach investigation"
• "start a forensics case safely"
• "what do we need before collecting evidence?"

Purpose

Make a security project ready to hand off to evidence-preserving DFIR work.

The skill answers three questions:

1. Is this preventive security work, production incident coordination, or a forensic investigation?
2. Is forensics-complete installed for evidence-bearing work?
3. What readiness record, custody expectation, and handoff steps should exist before anyone touches volatile or potentially admissible evidence?

Behavior

Boundary

Need	Route
Preventive controls, disclosure intake, secure design decisions	security-engineering
Severity, incident bridge, stakeholder comms, service restoration, PIR	sdlc-complete incident-response flows
Evidence preservation, triage, acquisition, timelines, IOCs, reports	forensics-complete

If a request includes live evidence, suspected compromise, a target host, IOC extraction, chain of custody, forensic timeline, or report generation, route to forensics-complete.

1. Classify the situation

Ask only enough to route safely:

• Is there an active incident, or is this readiness planning?
• Is any evidence already collected?
• Are any destructive containment or cleanup actions planned?
• Is legal, compliance, or customer-impact handling in scope?
• Which systems could hold volatile evidence?

Do not ask for secrets, exploit payloads, private vulnerability details, or raw evidence in chat.

2. Check for the DFIR framework