Chain of Custody
What is Chain of Custody?
The documented process of maintaining and tracking evidence from collection through presentation. In digital forensics, chain of custody ensures that evidence is admissible and has not been tampered with.
Terms that appear alongside chain of custody
Each of these is named in at least one of the same controls as chain of custody. The number is how many controls name both.
- nist 25 shared controls
- integrity 17 shared controls
- audit 15 shared controls
- incident response 13 shared controls
- ransomware 9 shared controls
- lessons learned 9 shared controls
- remediation 8 shared controls
- policy 8 shared controls
Frameworks that govern chain of custody
What the standards actually require on chain of custody
Requirements naming chain of custody across 6 standards, quoted from the control text.
Maintain media inventory and tracking per NIST SP 800-88 Rev 1 Chapter 3 (Information Sanitization Process) + Chapter 4 (Decision Flow).
NISTSP88-5 · Media Inventory, Tracking, Chain of Custody, and Sanitization Records →The DEFR can account for all data and devices acquired while they are in the DEFR's custody. A chain of custody record, one or several related documents started at collection or acquisition, traces each item's movement and handling from when the team identifie...
iso-iec-27037-2012::6.1 · 6.1 Chain of custody →Keeping an unbroken record of who held each item of potential digital evidence, when, where and for what purpose, from collection to return or destruction, so that tampering can be ruled out; required by the definition of digital investigation (3.6).
iso-iec-27043-2015::11.5 · 11.5 Preserving chain of custody process →The supply-chain control and transparency system shall be supported by documentation providing at least a description of the raw material including trade name and type;
eu-batteries-regulation-regulation-eu-2023-1542::Art 49(2) · Chain-of-custody documentation for each raw material →Depending on the matter, it can be important to trace or establish the creation, change history, handling, ownership and other provenance or lineage of ESI;
iso-iec-27050-1-2019::9.2 · Chain of custody and provenance →Where a claim is made about a traded product, for example about its provenance, its chain of custody, or its assured or identity-preserved status, information backing the claim must be obtainable, from the supplier or from an independent source, so that it can...
brcgs-global-standard-for-food-safety-issue-9::9.4.3 · 9.4.3 Supporting information for provenance, chain of custody and assured status claims →Questions people ask about chain of custody
What is Chain of Custody?
Why is Chain of Custody important for compliance?
Which compliance frameworks address Chain of Custody?
Where can I learn more about Chain of Custody?
See how Chain of Custody applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.