CompTIA CySA+ (CS0-003)Incident Response and ManagementMedium
An organization is developing its incident response plan. A key discussion point is how to ensure that evidence collected during an incident is admissible in legal proceedings. Which of the following components is MOST critical to establish and maintain for all collected evidence?
- AIncident severity rating
- BChain of custody
- CEvidence encryption
- DForensic imaging
Show answer & explanationAnswer & explanation
Correct answer: B. Chain of custody
Chain of custody is paramount for legal admissibility. It provides a documented, unbroken record of everyone who has had access to the evidence, when they had it, and what they did with it, proving that the evidence has not been tampered with or altered.
Why the other options are wrong
- A. Incident severity rating helps prioritize response but has no direct bearing on evidence admissibility.
- C. Evidence encryption protects confidentiality but doesn't prove integrity or non-tampering during handling.
- D. Forensic imaging ensures an exact copy is made, but without chain of custody, the image itself could be questioned if its handling isn't tracked.
Chain of Custody
A documented, unbroken record of the chronological sequence of possession, transfer, analysis, and disposition of physical or electronic evidence.
- Crucial for legal admissibility of evidence.
- Tracks who handled the evidence, when, and for what purpose.
- Ensures evidence integrity and prevents tampering claims.
Memory trick: Admissibility is about proving the evidence is 'Truly Untouched'.