Digital Evidence
What is Digital Evidence?
Information stored or transmitted in digital form that may be used as evidence in legal proceedings or investigations.
Terms that appear alongside digital evidence
Each of these is named in at least one of the same controls as digital evidence. The number is how many controls name both.
- cybersecurity 5 shared controls
- nist 3 shared controls
- remediation 2 shared controls
- incident management 2 shared controls
- incident response 2 shared controls
- security incident 2 shared controls
- ransomware 2 shared controls
- breach notification 2 shared controls
Frameworks that govern digital evidence
What the standards actually require on digital evidence
Requirements naming digital evidence across 6 standards, quoted from the control text.
Maintaining the integrity and original condition of potential digital evidence and digital evidence (3.13) through every class of the model, not only while it is stored (9.6); required by the definition of digital investigation (3.6).
iso-iec-27043-2015::11.6 · 11.6 Preserving digital evidence process →Evidence may be wanted for quite different purposes, and each weighs evidential quality, speed of analysis, getting services back and the cost of gathering differently.
iso-iec-27037-2012::5.1 · 5.1 Context for collecting digital evidence →At first response, preserve digital evidence, which held term 3.31 defines as binary data or information, whether stored or in transit, that can be used as evidence, and preservation (3.32) as keeping it intact and in its original condition: identify the syste...
iso-37003-2025::8.4.3 · Digital evidence first response →Identifies, collects, examines and preserves digital evidence under controlled and documented technique.
NICE-IN-WRL-002 · Digital Evidence Analysis →Interpretation draws meaning from digital evidence by evaluating the data and analysing it in its circumstances; it establishes facts and sometimes adds opinion to them, and may send the team back to further analysis or collection.
iso-iec-27042-2015::8.1 · 8.1 General →A mechanism is to be provided so personnel can report information security events they notice or suspect, promptly and through the right channels. Purpose: support reporting of events that personnel can spot in a timely, consistent and effective way.
iso-27002-2022::6.8 · Information security event reporting →Questions people ask about digital evidence
What is Digital Evidence?
Why is Digital Evidence important for compliance?
Which compliance frameworks address Digital Evidence?
Where can I learn more about Digital Evidence?
See how Digital Evidence applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.