A.5.28
Collection of evidence
Organizational controlsCheckpoints 5Evidence 6Cases 6
Control objective
This control is about how an organization finds, secures, and safeguards the material left behind by information security events (including those subsequently classified as incidents), so that it can still be relied on later for disciplinary action, litigation, regulatory reporting, and cause analysis. If the integrity and chain of custody of evidence are not maintained, then no matter how much material is gathered after an incident, it may lose its value as evidence in legal or disciplinary proceedings. The aim is therefore to prepare procedures, roles, tools, and external cooperation arrangements before an incident occurs, so that evidence can be secured promptly and in a defensible manner when one happens.
Key checkpoints
- Are procedures for the identification/collection/acquisition/preservation of evidence related to information security events and incidents documented, and do they reflect applicable laws and the evidence-admissibility criteria of the relevant jurisdiction?
- Are a standard form and procedure in place to record and maintain the chain of custody, tracking acquisition time, handlers, and the movement/handover path?
- For digital evidence, are methods defined to preserve the integrity of the original (forensic imaging, hash generation and verification, write-blocking, and similar)?
- Are qualified internal staff or external specialists (forensic firms, law enforcement) designated in advance for collecting and handling evidence?
- Are storage, sealing, access control, and retention periods defined for evidence, preventing unauthorized alteration and damage?
Implementation guidance
- Define collection procedures and priorities for each evidence type (logs, disk images, memory dumps, network packets, documents, physical media), and specify an order that secures the most volatile evidence first (memory, sessions, temporary data).
- Standardize a chain-of-custody record that captures the acquisition date/time, location, handler, handover details, and storage location without gaps, and update it at every movement or examination.
- For stable media, acquire a verified image where feasible and analyze the copy. For live systems or cloud data, record the authorized collection method and its limitations, and hash acquired material to detect later changes. A hash alone does not establish identity with a source that cannot be directly compared.
- Use suitable write protection and validated collection tools. Record trusted collector time and the source time zone/clock offset; do not change an evidence source clock merely to synchronize it. Document reasons and effects for unavoidable state changes.
- Restrict evidence-handling privileges to a minimal set of qualified personnel, protect evidence with sealed and locked storage and access logs, and define retention periods and disposal procedures.
- When handling evidence that contains personal or confidential information, comply with applicable laws and privacy requirements, and collect or examine only the minimum needed for the purpose of the investigation.
- Identify in advance situations that require cooperation with external forensic specialists or law enforcement, prepare contracts/agreements and contact arrangements, and define procedures so the chain of custody is not broken at handover.
Evidence
- Evidence collection/preservation procedures and the standard chain-of-custody record form
- Chain-of-custody records completed during actual incidents, evidence item lists, and sealing/unsealing records
- Forensic imaging logs and hash generation/verification records
- Evidence store access logs, retention management registers, and disposal records
- Cooperation contracts or agreements with forensic specialists/law enforcement and emergency contact arrangements
- Designation documents for evidence-handling personnel and related training records
Nonconformity examples
- Evidence collection procedures are not documented, so during an incident staff collect evidence at their own discretion.
- The original disk is opened/analyzed directly, changing timestamps and compromising evidence integrity.
- No chain-of-custody record exists, so the handling history of the evidence cannot be traced and its validity cannot be demonstrated in legal or disciplinary proceedings.
- Acquired material lacks an integrity baseline or records of its collection path and limitations, preventing verification of later changes and provenance.
- The evidence store has no access control, allowing many people to access the evidence without authorization.
- Evidence containing personal data is collected excessively without limits on purpose/scope, breaching privacy requirements.