# What evidence should we keep for the insurer, the police and the regulator?

Keep everything that shows what happened, when and what you did, without altering it. That means the incident log with times and decisions; exports of firewall, VPN, directory, e-mail and endpoint logs; the ransom note and any messages from the attackers; screenshots of what users saw; forensic images where specialists made them; and records of the costs incurred. Note a hash, the storage place and who handled each file. Insurers usually need the timeline and the cost evidence; the police need the attackers' messages, payment demands and indicators; regulators want to know what data was affected and how you responded. Ask each of them early what they need, and keep copies outside the affected systems. NetSenX alerts, with times, hosts and destinations, and its audit log can be part of this pack, with PDF reports from the Starter plan.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/what-evidence-to-keep-for-insurer-police-and-regulator

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [How long does NetSenX keep the network evidence of an incident?](https://netsenx.com/en/faq/how-long-does-netsenx-keep-incident-evidence)
- [Should we hire an incident-response firm or handle an incident ourselves?](https://netsenx.com/en/faq/should-we-hire-an-incident-response-firm-or-handle-it-ourselves)
- [How do we tell customers what data was affected in a breach?](https://netsenx.com/en/faq/how-to-tell-customers-what-data-was-affected)
- [Can network evidence show that a specific customer's data did not leave?](https://netsenx.com/en/faq/can-network-evidence-show-a-customers-data-did-not-leave)
- [Who can we call for free help after a cyberattack?](https://netsenx.com/en/faq/who-to-call-for-free-help-after-a-cyberattack)