Ahead of a security incident, consider developing forensics capabilities to support security event investigations.