A.5.28 Audit Evidence Pack

What the auditor wants to verify

The auditor wants to confirm that procedures exist and operate for identifying, collecting, acquiring, preserving, storing, and protecting evidence related to information security events.

Evidence to request

Strong evidence

• Evidence procedure covers identification, collection, acquisition, preservation, storage, access, transfer, and disposal.
• Chain-of-custody logs are complete and timestamped.
• Evidence storage is access-controlled and tamper-resistant.
• Forensic copies are used where original evidence must be preserved.
• Evidence collection starts early enough to avoid contamination or destruction.

Weak evidence

• Screenshots or logs are saved without custody records.
• Evidence is stored in shared folders with broad access.
• Original systems are modified before evidence is captured.
• No trigger criteria for evidence collection.
• No record of who handled evidence.

Sample interview questions

• When is evidence collection activated?
• How do responders preserve original evidence?
• Show a chain-of-custody record.
• Who can access stored evidence?
• How do you prove evidence was not modified or destroyed without authorization?

Common nonconformities

• Evidence collection begins too late.
• Responders overwrite logs during recovery.
• No chain of custody.
• Evidence access is not restricted.
• Forensic work is performed on originals instead of copies.
• Procedures ignore jurisdictional or legal admissibility requirements.

Related notes

• A.5.28 Collection of Evidence
• Evidence Collection and Chain of Custody Log
• A.5.28 Audit Checklist