Collection of evidence

What the control asks

Procedures are to be set up and followed for identifying, collecting, acquiring and preserving evidence connected with information security events. Purpose: handle incident evidence consistently and effectively so it can support disciplinary or legal action. Guidance: internal procedures govern evidence intended for disciplinary or legal use and take account of the rules in each relevant jurisdiction so the evidence has the best chance of being accepted. They should explain how to identify, collect, acquire and preserve evidence for different storage media and devices and for devices that are powered on or off. Evidence generally has to be gathered in a way a national court or other disciplinary forum will accept, which means being able to show that records are complete and untouched, that copies of electronic evidence are very likely identical to the originals, and that the systems it came from were working properly when it was recorded. Where possible, personnel and tools should hold certification or other qualification, strengthening the preserved evidence. When digital evidence crosses organizational or jurisdictional lines, the organization must make sure it is entitled to collect it. Other information: whether an event will lead to court action is often unclear at first, so evidence can be lost, deliberately or not, before the seriousness is understood; seek legal or law enforcement advice early; ISO/IEC 27037 covers digital evidence handling and the ISO/IEC 27050 series covers electronic discovery.

Purpose in the standard’s terms, in our words: Ensures evidence related to incidents is managed consistently and effectively for disciplinary and legal purposes.

Attribute values in one line: Corrective; Confidentiality, Integrity, Availability; Detect, Respond; Information security event management; Defence.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• Evidence handling procedures covering identification, collection, acquisition and preservation for different media and for powered-on and powered-off devices
• Chain of custody records for evidence collected during incidents
• Forensic images with hash values demonstrating that copies match originals
• Qualifications or certifications of forensic personnel and validated forensic tools
• Legal review of jurisdictional requirements for admissibility and entitlement to collect cross-border evidence
• Records showing legal advice or law enforcement engaged early where legal action was contemplated

Where audits commonly find gaps

• Responders reimage or power off systems before evidence is captured
• No chain of custody is kept, so evidence would not be admissible
• Copies are made without hashing, so integrity cannot be demonstrated
• Cross-border evidence is collected without checking the legal right to do so

What ISO/IEC 27028 changes for this control

It carries a single control type, corrective, which sets what the evidence has to prove. Its earlier numbering (16.1.7) is kept in the register so an older audit file can still be traced.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.24 Information security incident management planning and preparation
• 5.25 Assessment and decision on information security events
• 5.26 Response to information security incidents

Read the five attributes All 93 controls