Collection of evidence

Plain-language summary

Having procedures to identify, collect, acquire and preserve evidence of security events in a way that keeps it usable — for disciplinary action, insurance claims, regulatory notifications or court — with a documented chain of custody from the moment it is taken.

What the clause is really asking

When an incident may lead to a dismissal, a lawsuit, an insurance claim or a criminal case, how evidence was handled matters as much as what it shows. This control asks you to establish and apply procedures for identifying, collecting, acquiring and preserving evidence related to security events. The procedure should address chain of custody (who had the evidence, when, and what they did with it); integrity, for example working from hashed forensic copies, not the original; securing logs before they are overwritten; the competence of whoever collects it; and the legal requirements of every jurisdiction involved. The common misunderstanding is that the first step after a compromise is to wipe and rebuild, which destroys the evidence of what was taken and whether POPIA section 22 notification is needed. Most organisations of 50 to 500 people will not have forensic skills in-house, so the practical answer is a basic first-response procedure plus a forensic provider arranged in advance, often through the cyber insurer's panel. Evidence for disciplinary cases should also stand up at the CCMA.

What auditors look for

Auditors ask for the evidence handling procedure and then for an incident where evidence was collected, especially one that led to disciplinary action, an insurance claim or a police case. They look for a chain of custody record, hash values or other integrity checks, and where the evidence is stored and who can reach it. They ask whether log retention is long enough to investigate an incident discovered weeks later. They interview the person who would do the first response. The hard question: if you needed to prove at a hearing that this log has not been altered, how would you do it?

Typical evidence

Evidence collection and preservation procedure; chain of custody forms; evidence register with storage location and access list; forensic images and hash records; log retention settings sufficient for investigation; agreement with an external forensic provider or insurer panel; training records for first responders; legal advice on admissibility where obtained.

How to comply — recommendations

Write a two-page first-response procedure for evidence: do not switch off or wipe affected systems before deciding on evidence, isolate them from the network instead; record what you see, with times; export and protect the relevant logs; and state who may collect what. Add a chain of custody form to the incident record template. Set log retention for critical systems long enough to investigate an incident found months later, and keep a copy outside the systems an attacker could reach. Identify a forensic provider in advance, and check whether your cyber insurer requires its own panel. Brief HR on evidence standards for disciplinary cases involving misuse of IT.

Common nonconformities

No procedure for collecting or preserving evidence; affected systems rebuilt before evidence was captured; no chain of custody records; logs overwritten before an investigation started; evidence stored where anyone with admin rights could alter it; no forensic support arranged; disciplinary cases failing because IT evidence could not be shown to be reliable.

Resources for this clause

• ArticlePOPIA section 19 and ISO 27001: how the standard evidences the law — and why a certificate is not compliance
• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $29Incident & Breach Response KitWhen something happens the questions arrive faster than the facts: is it an incident, how bad, is it a POPIA breach, who must be told and by when, what do we write, what do we keep. This kit answers them in order.
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.