Control A.5.28Collection of evidence
The organisation must establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events.
The control that matters at the moment nobody is thinking about it. Evidence that may be needed for disciplinary action, for a claim, for a regulator or for a prosecution has to be collected in a way that preserves its integrity and its chain of custody — and decisions taken in the first hour of an incident routinely destroy it.
Rebuilding a compromised machine restores service and removes the evidence. Both may be the right call; the point is that it should be a decision, taken knowingly, and not a default.
The procedures need to say who may collect evidence, how it is recorded and stored, and when to stop and bring in specialists. For most organisations the honest implementation is a short internal capability and a pre-arranged relationship with an external one — arranged in advance, because negotiating an engagement during an incident costs the time the evidence does not have.
How to put this in place
If an incident leads to disciplinary action, a claim or prosecution, poorly handled evidence may be unusable. Deciding the method in advance avoids destroying it in the rush to recover.
- Decide who may collect evidence and which incidents call for it.
- Document how logs and disk images are copied and protected, and require copying before any rebuild.
- Record chain of custody for each item.
- Arrange a retained forensic provider if you lack the skill.
- Make sure logs are kept long enough to be saved before they roll over.
Evidence an auditor usually looks for: the evidence handling procedure, chain-of-custody records from a past incident, and the forensic provider arrangement.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.