Key takeaways
- Collect and preserve evidence about incidents properly.
- If an incident leads to legal action, poorly handled evidence may be unusable.
- Start here: define how evidence is identified, collected and preserved.
Purpose
Collect and preserve evidence about incidents properly.
Requirement
Requirement summaryThe organization shall establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events.
Why it matters
If an incident leads to legal action, poorly handled evidence may be unusable.
How to implement
- Define how evidence is identified, collected and preserved.
- Maintain chain of custody records.
- Know when to involve forensic specialists or legal counsel.
- Store evidence securely with restricted access.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.28. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Simple instructions for collecting and preserving evidence during an incident (logs, screenshots, emails).
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.28 marked as used or not used, a short reason, and its current status.
Records and examples to show
- An incident record showing evidence was saved before clean-up, with who handled it.
- Log retention settings showing logs are kept long enough to investigate.
Things you should be able to show or explain
- Be able to explain who may collect evidence and how it is stored.
How much to show: One incident where evidence was kept, or a walkthrough.
Common mistakes
- Evidence deleted during clean-up.
- No record of who handled evidence.
- Rebuilding a compromised machine before taking an image.
- No record of who handled evidence.
- Tip: Document chain of custody for anything that could go to court.
Policies & documents to have
- Incident Response Plan
FAQ
Is A.5.28 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.28?
Be ready to explain how the control works in your organisation and to provide things like: Simple instructions for collecting and preserving evidence during an incident (logs, screenshots, emails)…