ISO 27001 A.5.28 - Collection of Evidence

Requirement

“The organization shall establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events.”

Plain-language meaning

The organization must know how to identify, collect, acquire, preserve, store, and protect evidence related to security events so it remains complete, reliable, and usable.

Why this matters

Poor evidence handling can destroy legal, regulatory, disciplinary, insurance, or root-cause value. Evidence must be protected from alteration, loss, contamination, and unauthorized access.

Implementation guidance

1. Define when evidence collection is triggered, including suspected legal, regulatory, disciplinary, insurance, supplier, or serious security cases.
2. Document how to identify, collect, acquire, preserve, label, store, transfer, and dispose of evidence.
3. Maintain chain of custody showing who handled evidence, when, why, and under what controls.
4. Use forensically sound copies for investigation where original evidence may be needed later.
5. Restrict evidence storage so unauthorized people cannot access, modify, or destroy it.
6. Align procedures with applicable legal, regulatory, and forensic requirements; verify official requirements for the jurisdiction and case type.

Audit guidance

Auditors should verify that evidence procedures exist, are activated early enough, protect chain of custody, restrict access, and preserve quality and completeness.

Evidence examples

Strong evidence

• Evidence procedure covers identification, collection, acquisition, preservation, storage, access, transfer, and disposal.
• Chain-of-custody logs are complete and timestamped.
• Evidence storage is access-controlled and tamper-resistant.
• Forensic copies are used where original evidence must be preserved.
• Evidence collection starts early enough to avoid contamination or destruction.

Weak evidence

• Screenshots or logs are saved without custody records.
• Evidence is stored in shared folders with broad access.
• Original systems are modified before evidence is captured.
• No trigger criteria for evidence collection.
• No record of who handled evidence.

Common failures

Exam traps

• A.5.28 is broader than legal proceedings, but legal defensibility is a major driver.
• Evidence preservation starts early, not after the incident is closed.
• Chain of custody proves control over evidence handling.
• Forensic copies protect original evidence from alteration.
• Evidence quality and completeness matter, not only existence.

Related controls and concepts

• A.5.25 Assessment and Decision on Information Security Events
• A.5.26 Response to Information Security Incidents
• A.5.27 Learning from Information Security Incidents
• Internal Audit
• Incident Management Plan
• Evidence Request List

KB-ready summary

A.5.28 requires a controlled part of the incident-management lifecycle: The organization must know how to identify, collect, acquire, preserve, store, and protect evidence related to security events so it remains complete, reliable, and usable. In practice, this means defined criteria, assigned ownership, recorded decisions, operating evidence, and improvement links back into the ISMS.

Templates and checklists

• Evidence Collection and Chain of Custody Log
• A.5.28 Audit Checklist