ISO 27001 A.5.28: Collection of evidence

Write evidence handling procedures covering the full lifecycle: identification, collection, preservation, analysis, presentation, and disposal. Align them with legal requirements in every jurisdiction you operate in. For identification, define what evidence to collect for different incident types. Create checklists for common scenarios. Train responders to recognise and protect potential evidence sources from the moment they arrive at the scene. For digital evidence collection, follow forensically sound methods. Image storage media rather than examining originals. Use write-blockers when imaging drives. Capture volatile evidence (memory, running processes, network connections) before powering anything down. Verify images with cryptographic hashes. Document everything: tools used, hash values, timestamps. Keep a validated forensic toolkit ready to go. Implement chain of custody for all evidence. Use forms that record: what the evidence is, who collected it, when and where, how it has been stored, and every person who has handled it. Store evidence in a secure location with access controls and logging. Protect log data that could serve as evidence. Centralise logging with tamper-evident controls. Set retention periods that meet both operational and legal needs. Use NTP for time synchronisation across all systems so timestamps are reliable. Protect log integrity through read-only storage, digital signing, or write-once media. Line up external forensic specialists in advance for major incidents. Define when to bring them in - typically when there is potential criminal activity or a large-scale data breach. Make sure your internal procedures do not conflict with what external specialists or law enforcement will need.