Evidence Preservation
What is Evidence Preservation?
The process of securing and maintaining the integrity of digital evidence during and after a security incident for potential legal proceedings.
Terms that appear alongside evidence preservation
Each of these is named in at least one of the same controls as evidence preservation. The number is how many controls name both.
- incident response 5 shared controls
- chain of custody 5 shared controls
- nist 4 shared controls
- lessons learned 4 shared controls
- cybersecurity 3 shared controls
- forensic readiness 3 shared controls
- remediation 2 shared controls
- incident management 2 shared controls
Frameworks that govern evidence preservation
What the standards actually require on evidence preservation
Requirements naming evidence preservation across 6 standards, quoted from the control text.
Ghana CSA Cybercrime + Lawful Access + Preservation (Parts VII + VIII of Act 1038). CYBERCRIME OFFENCES (Sec.80-104): coordinated with Budapest Cybercrime Convention (which Ghana acceded to 2018) + Malabo Convention;
GhCSA-Cybercrime-Lawful-Access-Preservation · Cybercrime Offences, Lawful Access and Electronic Evidence Preservation →Per Papua New Guinea National Cybersecurity Policy and Cybercrime Act: incident response + investigation cooperation. Requirements include (a) operate Incident Response and Notification capability including detection + triage + containment + recovery + lessons...
PNGCYBER-4 · Incident Response, Investigation, Evidence Preservation, Data Retention →UR E27 requires equipment manufacturers to deliver CBS with logging + forensic readiness capabilities aligned with IEC 62443-4-2 CR 2.8-2.12 (Auditable events) + FR 6 (Timely Response to Events).
IACS-UR-E27-Logging-Forensics-EventCapture · IACS UR E27 - Equipment Logging + Forensic Readiness + Event Capture + Tamper Detection →Chapter 5 establishes management of response to acts of unlawful interference. 5.1 Contingency Plans - each State + airport operator + aircraft operator + ATS provider + cargo operator + catering shall develop and implement contingency plans + procedures + res...
ICAO-ANX17-Chap5-Contingency-Notification-Response-UnlawfulInterference · ICAO Annex 17 Chapter 5 - Contingency Plans + Notification + Response to Acts of Unlawful Interference + Investigation →Directions 5-7 establish the technical baseline for evidence preservation + forensic readiness + time integrity. Direction 5: All service providers + intermediaries + data centres + body corporates + government organisations shall mandatorily enable logs of al...
CERTIN-Logging-180DayRetention-IndiaLocalisation-NTP-NIC-NPL-CERTIn-Access-Dir5to7 · CERT-In Directions 5-7 System Logging + Clock Synchronization - 180-Day Log Retention in India + NTP Synchronisation with NIC/NPL + Log Availability to CERT-In on Order →AI Incident Reporting + Response is critical to learning + accountability + stakeholder protection per Japan AI Guidelines for Business + Hiroshima AI Process Code of Conduct + emerging AI Bill.
JP-AIG-Incident-Reporting-Response-AISI-METI-Notification-G7-Hiroshima-Reporting-Mechanism-Voluntary · Japan AI Guidelines AI Incident Reporting + Response + AISI/METI Notification + G7 Hiroshima Reporting Mechanism + Voluntary + AI Incident Database + OECD AI Incidents Monitor + Sector Regulator Notification + Coordinated Vulnerability Disclosure →Questions people ask about evidence preservation
What is Evidence Preservation?
Why is Evidence Preservation important for compliance?
Which compliance frameworks address Evidence Preservation?
Where can I learn more about Evidence Preservation?
See how Evidence Preservation applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.