Operational guidance, not legal advice. This page distills named public sources (regulator guidance and industry practice). It is not a legal determination, not a notification decision, and not a substitute for your counsel, insurer, or a retained DFIR firm. Verify applicability and current deadlines for your facts and jurisdiction.
Best digital forensics firms — criteria, not a ranking
Last verifiedEvaluate digital-forensics firms by stated criteria — accreditation class (PFI, CREST, ISO/IEC 17025), jurisdiction, and media/cloud/mobile scope — not a ranking. Verify the current public roster. Not legal advice.
Operational guidance, last verified 7 September 2026 against the PCI SSC PCI Forensic Investigator (PFI) directory, CREST Incident Response company accreditation and the CREST Marketplace / member roster, ISO/IEC 17025 laboratory accreditation as listed by ILAC-recognised bodies (UKAS, A2LA, ANAB), NIST SP 800-86 (Guide to Integrating Forensic Techniques into Incident Response), and SWGDE published digital-evidence guidelines. This page does not rank DFIR firms, does not name any, does not reprint a roster, and is not a substitute for counsel, your insurer, or a retained DFIR firm. The what-is-dfir page on this site is the DFIR explainer. The when-you-need-dfir page on this site is the retain-or-not tree. Not legal advice.
This is a criteria checklist, not a vendor list
Audience: an engineering leader, founder, CTO, CISO, counsel, or incident commander shortlisting a digital-forensics firm under time pressure. The what-is-dfir page on this site is the explainer (identify, preserve, analyze, report; forensic soundness; chain of custody). The when-you-need-dfir page on this site is the in-house-versus-firm decision tree. The preserve-evidence page on this site is the order-of-volatility checklist. This page is the inclusion-criteria step: which accreditation classes, jurisdictions, and media/cloud/mobile scopes to check against a public roster before you retain anyone. It does not rank DFIR firms, does not name any, and is not a directory. The how-to-select-a-dfir-provider page on this site is the selection decision tree. The comparing-major-incident-response-providers page on this site is the named-brand criteria table (not a ranking; inclusion is not endorsement).
Forensics is P0 evidence-preservation work. A firm you cannot reconstruct later is a broken chain, not a brand. NIST SP 800-86 is a guide to integrating forensic techniques into incident response — guidance, not a statute. SWGDE documents are consensus best-practice / guideline publications for digital and multimedia evidence, not a statute and not a ranking of firms. PCI SSC's PFI programme qualifies companies to investigate suspected cardholder-data compromises; the Council tells clients to check the current list each time they engage a PFI. CREST Incident Response is a company-level capability class assessed against a published standard. ISO/IEC 17025 is a laboratory-competence standard; the scope of accreditation is the claim, not the logo. ASCLD is a professional membership society; the former ASCLD/LAB accreditation programme is now ANAB. None of those sources is a league table. Last verified 7 September 2026. Not legal advice.
- Inclusion on this page means a criterion you can check on a named public roster, not a brand we like. This page does not rank DFIR firms and does not name any.
- Accreditation is a class (PFI, CREST Incident Response, ISO/IEC 17025 forensic-lab scope). Verify the CURRENT listing and the CURRENT scope. A slide-deck logo is marketing.
- Court-admissibility and expert-witness standing are not public rosters. Treat them as questions for counsel on YOUR facts, not a score this page can assign.
- If you have a cyber policy, the panel or prior-consent clause is a contract constraint, not a quality ranking. The contact-cyber-insurance page on this site is that checklist. Verify YOUR policy.
- This page does not rank DFIR firms, does not interpret YOUR policy, does not start a notification clock, and is not legal advice.
Stated inclusion criteria
A firm belongs on YOUR shortlist only when it meets the criteria that apply to THIS incident. The rows below are inclusion criteria. They are not a league table, not an endorsement, and not a directory. Last verified 7 September 2026. Not legal advice.
| Criterion | What must be true | How to verify | Limit |
|---|---|---|---|
| Current accreditation class for the work | The company is listed now for the class of work you need: PFI (cardholder-data compromise), CREST Incident Response (company IR/forensics capability class), or ISO/IEC 17025 with a digital-forensics / computer / mobile scope on an ILAC-recognised body's schedule. | Open the public roster named in the accreditation-classes table below. Check the company, the status, the region, and the scope — not a logo on a pitch deck. | Accreditation is a capability class, not 'best firms,' not a licence in every country, and not a guarantee of admissibility. Verify the CURRENT list. This page does not reprint one. |
| Jurisdiction match | The roster listing and the engagement cover the country, legal process, and data-residency rules that actually apply — including where evidence will be stored and who can testify. | Read the roster's region / place-of-business fields (PFI regions; CREST Marketplace filters; 17025 schedule of accreditation). Ask counsel where the work will be done. | A UK NCSC CIR or UKAS 17025 listing does not, by itself, authorise work everywhere. A US PFI listing is a PCI class, not a global forensics licence. |
| Media / cloud / mobile scope | The firm's assessed scope covers the sources you actually have: host/disk media, cloud identity and logs, mobile devices — not a generic 'we do DFIR' claim. | Read the 17025 schedule (methods and item types). For CREST, filter Incident Response and ask which environments the assessed capability covers. For PFI, the class is cardholder-data investigations, not every media type. | Scope is a class of assessed work, not a named case study this page will invent. Cloud API collection is not the same as a write-blocked disk image. |
| Forensic method (NIST SP 800-86 / SWGDE class) | Working copy, integrity preservation, hashes, chain of custody, documented tools and versions, trained handlers. Another examiner can reconstruct the work. | Ask for the method statement and a sample custody record (fields, not a client file). NIST SP 800-86 and SWGDE best-practice documents describe the class of method. The preserve-evidence page on this site is the order-of-volatility checklist. | Method is guidance, not a guarantee of admissibility. NIST SP 800-86 and SWGDE are not statutes. The chain-of-custody page on this site is the handling record. |
| Insurer panel / prior consent | YOUR form either lists this firm or written consent is in hand before DFIR costs are incurred. | Notice the carrier (or the broker). Ask which DFIR the policy recognises. The contact-cyber-insurance page on this site is that checklist. Verify YOUR policy. | A contract role, not a quality score. Panel is not 'the best firms.' This page does not interpret YOUR policy and does not rank panel members. |
| Counsel-directed statement of work | Counsel retains and directs the firm, with a SOW that says the work is to assist counsel in giving legal advice — common practice, not a privilege ruling. | The contact-breach-counsel page on this site is the privilege-and-engagement checklist. Confirm with counsel before you sign. | Common practice, not a ruling that privilege or work-product will attach. Dual-purpose ordinary-course IT work is a known waiver risk. |
| Independence from the estate operator | The examiner is independent of the MSP, SOC, or internal team that runs the environment, unless counsel and the insurer have a reason to use the incumbent. | Ask who operates the estate and who will image it. Independence is a conflict criterion. | Independence is not a preference for boutiques. An insurer-cleared retainer can still be the right firm. |
| Court-admissibility / expert-witness standing | Not an inclusion checkbox this page can tick. Whether a later forum will admit the work, and whether a named examiner can testify, are counsel's questions on YOUR facts. | Ask counsel. Ask the firm who would testify, in which jurisdictions they have, and whether the method is reconstructable. There is no public 'expert-witness roster' this page will invent. | Track record is not a ranking and not a public list. This page does not score firms on court wins. Not legal advice. |
Accreditation classes (not a ranking)
These are classes of independently assessed capability. A class is not a league table. Verify each class on the named public roster at the time you engage — PCI SSC says to check the PFI list each time; CREST and 17025 listings also change. This page does not reprint those lists and does not name firms. Last verified 7 September 2026.
| Class | What it actually is | Public roster to check | What this page is not saying |
|---|---|---|---|
| PCI Forensic Investigator (PFI) | PCI SSC qualifies PFI companies to investigate suspected cardholder-data compromises. A PFI must work for a Qualified Security Assessor company with a dedicated forensic investigation practice, and requalify. 'In Remediation' is a published status, not a hidden fail. | PCI SSC PFI directory (assessors and solutions → PCI Forensic Investigators). PCI SSC: check the list each time you engage a PFI; the Council does not guarantee the list is current at all times. | PFI is a payment-card forensics class, not a general 'best digital forensics firms' mark, not a licence for every media type, and not a ranking. The best-incident-response-firms page on this site is the inclusion-criteria checklist. |
| CREST Incident Response (company) | CREST company accreditation against a published Incident Response standard (six domains; expert-led assessment of documentation, artefacts, and prior engagements). Individual CREST exams (CPIA / CRIA / CCIM) are a people competence class, not the company class. | CREST Marketplace (buyer-facing roster of CREST-accredited providers; CREST states it replaced the previous member directory) and the CREST members search. Filter for Incident Response accreditation. CREST accreditation standards are published separately. | CREST IR is a capability class, not 'best firms,' not a global licence, and not this page's vendor list. Membership without the IR accreditation is not the IR class. Verify the CURRENT listing. |
| ISO/IEC 17025 laboratory | ISO/IEC 17025 is the international standard for testing and calibration laboratory competence. For digital forensics, the claim that matters is the schedule of accreditation: which methods, which item types (computer, mobile, cloud-derived media), which location. | The accrediting body's directory, not the lab's marketing site: UKAS (search accredited organisations), A2LA (accredited-organisations directory), ANAB (directory of accredited organisations). Read the schedule. ILAC recognition is how bodies recognise each other; it is not a ranking of labs. | A 17025 certificate for chemistry or calibration is not a digital-forensics scope. Logo without a current schedule is not verification. 17025 is not a statute of admissibility. |
| ASCLD-class forensic-lab accreditation | ASCLD (American Society of Crime Laboratory Directors) is a professional membership society. The former ASCLD/LAB accreditation programme transferred to ANAB (ANSI National Accreditation Board). Today, US forensic-lab ISO/IEC 17025 / 17020 accreditation is offered by ANAB and A2LA — not by ASCLD as a current accreditor. | ANAB directory of accredited organisations (forensic testing / inspection programmes) and A2LA's directory. ASCLD's own site is membership and an accreditation toolkit pointing at ANAB and A2LA, not a current lab roster. | An old ASCLD/LAB logo is history, not a current listing. ASCLD membership is not ISO/IEC 17025. This page does not treat ASCLD as a ranking of firms. |
Comparison by criteria
Use this table to compare candidates you already have — a panel list, a retainer, or a name counsel supplied — against the same criteria. Fill the cells from the public roster and from counsel. Empty cells are unknowns, not a pass. This is not a filled-in vendor comparison and not a ranking. The comparing-major-incident-response-providers page on this site is the named-brand criteria table (not a ranking; inclusion is not endorsement). Last verified 7 September 2026. Not legal advice.
| Criterion | What a defensible 'yes' looks like | Fail / skip signal |
|---|---|---|
| PFI class (if cardholder data may be in scope) | Named on the current PCI SSC PFI directory for the region; status is not a surprise; company requalification is current. | Logo on a website, an expired listing, or 'our people used to be PFI.' PCI SSC: check the list at engagement. |
| CREST IR class (if you are using that scheme) | Company listed on CREST Marketplace / members search with Incident Response accreditation current. | CREST membership without IR accreditation; an individual exam quoted as if it were the company class; a screenshot from last year. |
| ISO/IEC 17025 digital-forensics scope | Current schedule from UKAS, A2LA, or ANAB naming the methods and item types you need (computer, mobile, the media you have). | A 17025 certificate whose schedule is another discipline; a certificate with no schedule; a body you cannot find on an ILAC-recognised directory. |
| ASCLD-class (ANAB / A2LA today) | Current ANAB or A2LA forensic-lab listing covering the digital-evidence discipline you need. | ASCLD membership, a historical ASCLD/LAB mark, or a crime-lab claim with no current ANAB/A2LA schedule. |
| Jurisdiction | Roster region and engagement geography match; evidence storage and testimony location are named. | 'We work globally' with no roster region and no data-residency answer. |
| Media / cloud / mobile | Assessed scope covers the sources in play. Cloud collection method is documented (API, snapshot, legal process), not implied. | A host-image lab asked to collect a multi-account cloud tenant with no scope for it — or the reverse. |
| Method / chain of custody | Working copy, hashes, custody fields, tool versions. NIST SP 800-86 / SWGDE class. Reconstructable by another examiner. | Live analysis on the original with no record; 'we just run the tool'; no custody log. The chain-of-custody page on this site is the handling record. |
| Panel / counsel / independence | Carrier recognises the firm or has consented; counsel holds the SOW; examiner is not the estate operator unless that is the agreed exception. | You signed before notice; privilege assumed after the fact; the MSP is investigating itself with no conflict note. |
What you need to do now
Order is the failure mode. Shopping a favourite firm from a blog 'top list,' then asking counsel to wrap privilege around it, then telling the carrier, is the reverse of common practice. The sequence below is practice, not a statute. Last verified 7 September 2026. Not legal advice. Not coverage advice.
- Preserve first. Do not reimage, power down a live host to 'save it,' or rotate logs before capture. The preserve-evidence page on this site is the order-of-volatility checklist. The we've-been-breached page on this site is the first-moves hub.
- Walk the retain-or-not tree with the commander and counsel. The when-you-need-dfir page on this site is that tree. In-house capture now does not bar a firm later for analysis.
- If you have a cyber policy, notice the carrier before you pick a non-panel firm. Panel is a contract role, not a ranking. The contact-cyber-insurance page on this site is that checklist. Verify YOUR policy.
- Counsel-directed engagement is common practice. The contact-breach-counsel page on this site is the privilege-and-engagement checklist.
- Check the current public roster for the class of work: PFI directory, CREST Marketplace / members search (Incident Response), ISO/IEC 17025 schedule (UKAS / A2LA / ANAB). Do not trust a logo. This page does not reprint those lists.
- Match jurisdiction and media/cloud/mobile scope to THIS incident. Empty cells on the comparison table are unknowns, not a pass.
- The information-to-give-a-dfir-firm page on this site is the intake checklist: assets, logs, access, UTC timeline, architecture. Hand over on the out-of-band channel. Do not reimage first.
Where this shows up in ShipReady Metrics
The signed-in app does not image hosts, keep a chain of custody, produce a forensic report, retain a DFIR firm, notice an insurer, or file with a regulator. It does not rank forensic vendors, does not keep a copy of your policy, and does not maintain a PFI, CREST, or ISO/IEC 17025 roster. If you already have a session: signed-in app → Compliance → CRA reporting tracks the 24-hour / 72-hour / 14-day ladder from your recorded awareness for findings the org has classified as CRA-in-scope. That ladder is not a forensic exam, it does not start a clock for you, and it is not a determination that CRA applies. A named human still submits. None of those surfaces is a substitute for the commander, counsel, the insurer, or DFIR.
Primary sources (last verified 7 September 2026)
Every operational claim on this page is taken from one of these. If a later revision of a source changes the advice, the date above is how you can see we have not re-checked yet.
PCI SSC PCI Forensic Investigator directory and programme materials: PFIs investigate suspected cardholder-data compromises; they must work for a QSA company with a dedicated forensic practice; the Council tells clients to check the current list at each engagement; 'In Remediation' is a published status. CREST publishes a company Incident Response accreditation standard and, as of March 2026, CREST Marketplace as the buyer-facing roster of CREST-accredited providers (CREST states it replaced the previous member directory); the members search remains a listing surface; individual CREST intrusion-analyst / incident-manager exams are a people competence class. ISO/IEC 17025:2017 is the laboratory-competence standard; UKAS, A2LA, and ANAB publish searchable directories and schedules of accreditation; ILAC is the recognition arrangement among accreditation bodies, not a ranking. ASCLD is a membership society; ASCLD/LAB accreditation transferred to ANAB; ASCLD's accreditation toolkit names ANAB and A2LA as the US forensic-lab accreditors to ISO/IEC 17025 / 17020. NIST SP 800-86 (August 2006) remains the current final guide this page cites for integrating forensic techniques into IR — guidance, not a statute. SWGDE publishes consensus guidelines and best-practice documents for digital evidence collection, acquisition, and examination; they are not a statute and not a ranking of firms. NIST SP 800-61 Revision 3 (April 2025) is the current final Incident Response Recommendations and Considerations for Cybersecurity Risk Management: a CSF 2.0 Community Profile; it supersedes NIST SP 800-61r2 (August 2012), Computer Security Incident Handling Guide. This cluster cites r3 as current — guidance, not a statute.