5.28 Collection of evidence
Procedures are to be set up and followed for identifying, collecting, acquiring and preserving evidence connected with information security events. Purpose: handle incident evidence consistently and effectively so it can support disciplinary or legal action. Guidance: internal procedures govern evidence intended for disciplinary or legal use and take account of the rules in each relevant jurisdiction so the evidence has the best chance of being accepted. They should explain how to identify, collect, acquire and preserve evidence for different storage media and devices and for devices that are powered on or off. Evidence generally has to be gathered in a way a national court or other disciplinary forum will accept, which means being able to show that records are complete and untouched, that copies of electronic evidence are very likely identical to the originals, and that the systems it came from were working properly when it was recorded. Where possible, personnel and tools should hold certification or other qualification, strengthening the preserved evidence. When digital evidence crosses organizational or jurisdictional lines, the organization must make sure it is entitled to collect it. Other information: whether an event will lead to court action is often unclear at first, so evidence can be lost, deliberately or not, before the seriousness is understood; seek legal or law enforcement advice early; ISO/IEC 27037 covers digital evidence handling and the ISO/IEC 27050 series covers electronic discovery.
Source: ISO/IEC 27002:2022, 5.28. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.
ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Chain of custody records for evidence collected during incidents · Document repository
- Qualifications or certifications of forensic personnel and validated forensic tools · Document repository
- Legal review of jurisdictional requirements for admissibility and entitlement to collect cross-border evidence · Identity provider / directory
- Records showing legal advice or law enforcement engaged early where legal action was contemplated · Document repository
governing documentDocuments that govern the control
- Evidence handling procedures covering identification, collection, acquisition and preservation for different media and for powered-on and powered-off devices · Policy repository / GRC workspace
- Forensic images with hash values demonstrating that copies match originals · Document repository
First move
Common gaps auditors find
- Responders reimage or power off systems before evidence is captured
- No chain of custody is kept, so evidence would not be admissible
- Copies are made without hashing, so integrity cannot be demonstrated
- Cross-border evidence is collected without checking the legal right to do so
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.27 Learning from information security incidents · 5.29 Information security during disruption