A logistics firm with 15 AWS accounts has no standing incident capability. Past events stalled waiting for access approvals and missing forensic tools. Leadership wants pre-staged access, tooling, and evidence storage ready before the next incident. Which preparedness design best ensures rapid response?

The correct design works because it eliminates both failure modes before an incident by combining an isolated response account for containment, pre-authorized cross-account roles for access without tickets, and ready forensic workstations plus immutable central storage for preservation across all 15 accounts. The centralized logging design that retains snapshots in source accounts fails on evidence handling, since workload-local copies remain subject to accidental deletion, owner contention, and inconsistent legal hold compared with a central vault. The pre-provisioned roles with on-demand host building design fails on tooling readiness, since assembling EC2 examiners after declaration reintroduces the delay leadership wanted to remove even though access and storage are ready. The dedicated account with manual approval design fails on access readiness, since requiring per-incident authorization reproduces the approval stall despite having tooling and storage staged. As an exam caveat, distinguish capabilities that exist from capabilities that are pre-staged, centralized, and immediately assumable, because preparedness turns on timing and placement rather than mere presence. As a practical check, conduct a game day with workload owners unavailable and confirm responders can assume roles, attach tools, and copy snapshots to the central vault within target timelines with full chain of custody.