5.28 Collection of evidence
Requires procedures to be established and used for identifying evidence relating to information security events, then collecting, acquiring and preserving it.
5
artefacts
0
held by a system
3
at each review
hard
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Chain of custody records for evidence collected in the period, showing who held it and when · Document repository
- Evidence of the method used to acquire data in a way that preserves integrity, such as hashing and write protection · Document repository
- Records of the competence of those performing collection, whether internal or an external provider on retainer · HR system / LMS
governing documentDocuments that govern the control
- Procedures for identification, collection, acquisition and preservation of evidence, covering the media types the organisation holds · Policy repository / GRC workspace
- Evidence of retention and secure storage of collected material for the required period · Policy repository / GRC workspace
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Investigation performed on the live system, destroying the evidence in the act of examining it
- No chain of custody, so material collected is unusable in any disciplinary or legal proceeding
- Procedures cover servers and endpoints while cloud, software as a service and mobile evidence acquisition is unaddressed
- Retained material held without integrity protection, so it cannot be shown to be unaltered
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet5.27 Learning from information security incidents · 5.29 Information security during disruption