How SMBs Can Use the Collection Management Framework (CMF) to Prepare for a Cyber Incident

**Executive summary:** This blog explains how small and medium-sized businesses with industrial control systems can prepare for cybersecurity incidents by creating and maintaining a Collection Management Framework (CMF): build an asset inventory, document available logging and retention across devices, engage in-house IT or contractors to capture forensic sources, iterate the CMF through exercises and incidents, and use OT-CERT resources and templates to guide the process.