As the lead of the forensic department in a well-known multinational bank, John has been...

Option C is the best answer because CHFI v11 specifically includes Forensic Readiness and Business Continuity , Forensics Readiness Planning and Procedures , Computer Forensics as part of the Incident Response Plan , and the need for a sound forensic investigation process . The blueprint also emphasizes Evidence Preservation , Data Acquisition and Data Analysis , and proper procedural handling during investigations.

Since John already has an incident response plan and a properly resourced SOC, the most valuable addition is a detailed procedure for evidence collection and analysis . That directly strengthens forensic readiness by ensuring that when an incident occurs, responders know how to preserve evidence, collect it properly, avoid contamination, and support future legal or disciplinary action. This is more directly tied to CHFI forensic-readiness concepts than broader security improvements.

AI-based detection , zero trust , and network reviews can all improve security posture, but they are not the clearest addition to a forensic readiness plan itself. The question is about improving the organization’s ability to investigate future incidents in a defensible manner, which is exactly what documented collection and analysis procedures provide.