ISO 27001 A.5.28: Preserve Reliable Incident Evidence

What A.5.28 requires in practice

Control A.5.28 asks the organisation to establish and implement procedures for identifying, collecting, acquiring and preserving evidence related to information security events. The purpose is to keep information about an event in a state that can be trusted, so that it can support internal investigation, disciplinary action, contractual disputes or legal proceedings if needed.

In practice this means knowing in advance what evidence may exist, such as logs, devices and messages, and how to gather it without altering it. It means recording who handled it and when, and storing it so that it can be shown to be unchanged. The control does not set a forensic standard for every organisation. Where legal action is plausible, specialist advice is sensible; for other cases, a clear and careful routine is the practical aim.

Prepare authority and competence before collection

Identify who may authorise collection, who is competent to perform it and when specialist or legal advice is needed. Access to a system for ordinary work does not automatically establish authority to collect all its contents for an investigation. Personal information, third-party systems and cross-border arrangements may introduce additional constraints.

Define the purpose and scope of the evidence needed. Avoid indiscriminate collection merely because information is available. Excessive collection can create privacy, confidentiality and handling burdens while obscuring the relevant facts. Record the basis for decisions and any limitations encountered.

Different evidence sources need different treatment. A running device, a paper record and a cloud audit trail present distinct preservation questions. Procedures should direct staff to competent handling rather than encourage a single shortcut, such as always restarting a device or emailing files to an investigator.

Preserve context as well as content

Evidence needs provenance: where it came from, who obtained it, when and by what authorised method. Relevant context may include the system state, time settings and limitations of the source. A record can be accurately copied yet still be misleading if its origin or meaning is misunderstood.

Maintain a traceable custody history where appropriate. Identify transfers, access and storage arrangements so that later reviewers can understand how material was protected. Integrity checks may support confidence in digital copies, but no single technical measure proves every aspect of authenticity or interpretation.

Why reliable incident evidence matters to the business

Evidence that is lost, overwritten or mishandled cannot be repaired afterwards. If an employee dispute, client claim or regulator enquiry follows an incident, the organisation's position depends on whether it can show what actually happened. Routine clean-up actions, such as rebuilding a device, can destroy the very records needed. Having a routine decided in advance lets responders balance recovery speed against preservation. It also reassures clients that serious matters will be handled carefully, and it reduces the risk that a legitimate claim becomes impossible to defend.

How to implement A.5.28

Prepare the routine before it is needed, since evidence is easily damaged in the rush to recover. A practical outline follows. Evidence preservation conflicts with the natural urge to fix things fast, so the routine must be simple and known before the pressure arrives. Responders should understand which actions could destroy information and when to pause and ask. Decide in advance who can authorise a deeper forensic approach. Even a modest routine, followed consistently, is far better than good intentions that fall apart when a real event begins.

1. Identify the sources of evidence your services produce, such as logs, devices and messages.
2. Check that logs are kept long enough and protected from alteration.
3. Write a short routine for collecting and copying evidence without changing the original.
4. Record who handled each item, when and where it was stored.
5. Store evidence securely with limited access.
6. Decide when to involve legal advisers or specialists.
7. Brief responders so they know not to rebuild or wipe systems before checking.

Illustrative construction example: a disputed document change

Illustrative IT example: a cloud log request arrives too late

A hypothetical IT provider needs service logs to investigate unexpected access. The cloud service retains the relevant detail for a limited period under the agreed arrangement. The team delays requesting it while debating whether the event is serious enough.

Preparation establishes who can request preservation and how the provider can assist. During a later exercise, the team checks the available evidence and response route before retention limits become a problem. The example does not assume the provider can produce information that was never recorded or has already been deleted.

Protect the evidence repository

Balance urgent protection and later understanding

Some incidents require immediate action to limit harm. Evidence procedures should support timely decisions rather than imply that preservation always overrides every other concern. Obtain suitable advice, record the reason for consequential actions and identify what may no longer be recoverable.

Inform ordinary staff about reporting and preservation boundaries. They can note observations and follow instructions without attempting unauthorised investigation. Connect these expectations with event reporting. A person who discovers a concern should not inadvertently alter material while trying to prove it.

Evidence that the collection process works

For this control, useful assurance includes approved procedures, competence and authority arrangements, protected custody records and exercise results. The organisation need not expose sensitive case evidence widely to demonstrate that it has a functioning process.

Common failures include missing source context, undocumented transfers, live evidence altered during troubleshooting and claims that a hash alone proves a complete chain of custody. Test a representative scenario with synthetic material and verify whether another competent person can reconstruct the handling history.

Common nonconformities with A.5.28

Findings usually reflect evidence handling left to chance. Findings usually reflect evidence handling left to chance. An auditor may ask how responders would collect information after a laptop compromise, and look for a routine that people can describe consistently.

• No routine for collecting evidence, so responders wipe or rebuild systems first.
• Logs that rotate away before an investigation can use them.
• No record of who handled evidence or where it was held.
• Evidence stored where many staff can alter it.