Collection of evidence

What the requirement asks

Procedures are to be set up and followed for identifying, collecting, acquiring and preserving evidence connected with information security events. Purpose: handle incident evidence consistently and effectively so it can support disciplinary or legal action. Guidance: internal procedures govern evidence intended for disciplinary or legal use and take account of the rules in each relevant jurisdiction so the evidence has the best chance of being accepted. They should explain how to identify, collect, acquire and preserve evidence for different storage media and devices and for devices that are powered on or off. Evidence generally has to be gathered in a way a national court or other disciplinary forum will accept, which means being able to show that records are complete and untouched, that copies of electronic evidence are very likely identical to the originals, and that the systems it came from were working properly when it was recorded. Where possible, personnel and tools should hold certification or other qualification, strengthening the preserved evidence. When digital evidence crosses organizational or jurisdictional lines, the organization must make sure it is entitled to collect it. Other information: whether an event will lead to court action is often unclear at first, so evidence can be lost, deliberately or not, before the seriousness is understood; seek legal or law enforcement advice early; ISO/IEC 27037 covers digital evidence handling and the ISO/IEC 27050 series covers electronic discovery. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Evidence collection is expected to be lawful, proportionate and repeatable. The guidance asks for the method, the chain of custody, the storage and the person authorised to collect.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep evidence handling procedures covering identification, collection, acquisition and preservation for different media and for powered-on and powered-off devices and one live sample together.

Evidence an assessor asks for

• Digital evidenceEvidence handling procedures covering identification, collection, acquisition and preservation for different media and for powered-on and powered-off devices
• Digital evidenceChain of custody records for evidence collected during incidents
• Digital evidenceForensic images with hash values demonstrating that copies match originals
• Digital evidenceQualifications or certifications of forensic personnel and validated forensic tools
• Digital evidenceLegal review of jurisdictional requirements for admissibility and entitlement to collect cross-border evidence
• Digital evidenceRecords showing legal advice or law enforcement engaged early where legal action was contemplated

The question an assessor will ask

An assessor will ask for evidence handling procedures covering identification, collection, acquisition and preservation for different media and for powered-on and powered-off devices, then trace it to the system it protects. For A.5.28 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Responders reimage or power off systems before evidence is captured
• No chain of custody is kept, so evidence would not be admissible
• Copies are made without hashing, so integrity cannot be demonstrated
• Cross-border evidence is collected without checking the legal right to do so

Before the next audit

Before the next audit, check one live sample for this gap: responders reimage or power off systems before evidence is captured.