Evidence Preservation
What is Evidence Preservation?
The process of securing and maintaining the integrity of digital evidence during and after a security incident for potential legal proceedings.
Terms that appear alongside evidence preservation
Each of these is named in at least one of the same controls as evidence preservation. The number is how many controls name both.
- incident response 5 shared controls
- chain of custody 5 shared controls
- nist 4 shared controls
- lessons learned 4 shared controls
- cybersecurity 3 shared controls
- forensic readiness 3 shared controls
- remediation 2 shared controls
- incident management 2 shared controls
Frameworks that govern evidence preservation
What the standards actually require on evidence preservation
Requirements naming evidence preservation across 6 standards, quoted from the control text.
The incident response plan must include processes for preserving information that can serve as evidence (including training of operations personnel on preserving evidence when anomalies are suspected), for identifying, collecting and acquiring evidence, for fo...
api-1164::RS.AN-3 · RS.AN-3 Evidence preservation, collection and forensic analysis for root cause →Per Papua New Guinea National Cybersecurity Policy and Cybercrime Act: incident response + investigation cooperation. Requirements include (a) operate Incident Response and Notification capability including detection + triage + containment + recovery + lessons...
PNGCYBER-4 · Incident Response, Investigation, Evidence Preservation, Data Retention →Legal counsel, internal or external, with employment law expertise and experience of workplace violence cases, should be consulted during incident management.
ansi-asis-wvpi-aa-2020-workplace-violence-and-active-assailant::8.7 · 8.7 The importance of legal oversight →The capability rests on documented arrangements at three levels. An incident management policy approved by a senior executive with documented senior management commitment, aimed at everyone who is legitimately allowed into the organization's systems and premis...
iso-iec-27035-1-2023::4.5.2 · Policies, plan and process →Collected devices and acquired evidence are protected as far as possible against loss, tampering and spoliation; the central aim is to keep the evidence intact and authentic and its chain of custody unbroken.
iso-iec-27037-2012::6.9.2 · 6.9.2 Preserving potential digital evidence →Directions 5-7 establish the technical baseline for evidence preservation + forensic readiness + time integrity. Direction 5: All service providers + intermediaries + data centres + body corporates + government organisations shall mandatorily enable logs of al...
CERTIN-Logging-180DayRetention-IndiaLocalisation-NTP-NIC-NPL-CERTIn-Access-Dir5to7 · CERT-In Directions 5-7 System Logging + Clock Synchronization - 180-Day Log Retention in India + NTP Synchronisation with NIC/NPL + Log Availability to CERT-In on Order →Questions people ask about evidence preservation
What is Evidence Preservation?
Why is Evidence Preservation important for compliance?
Which compliance frameworks address Evidence Preservation?
Where can I learn more about Evidence Preservation?
See how Evidence Preservation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.