CompTIA CySA+ (CS0-003)Incident Response and ManagementMedium
An organization is updating its incident response plan. A key discussion point is how to handle evidence collected during an incident to ensure its admissibility in potential legal proceedings. Which of the following elements is MOST critical to establish for every piece of evidence collected?
- AA comprehensive chain of custody document.
- BA detailed technical analysis report.
- CAn estimated financial damage assessment.
- DA list of all personnel with security clearances.
Show answer & explanationAnswer & explanation
Correct answer: A. A comprehensive chain of custody document.
A comprehensive chain of custody document is paramount for legal admissibility. It meticulously records who had access to the evidence, when, and for what purpose, proving that the evidence has not been tampered with or compromised since its collection.
Why the other options are wrong
- B. A technical analysis report is important for understanding the incident but doesn't primarily ensure the legal admissibility of the evidence itself.
- C. Financial damage assessment is for business impact, not for the legal admissibility of collected evidence.
- D. A list of security-cleared personnel is irrelevant to the direct integrity and handling of evidence for legal purposes.
Chain of Custody
A documented chronological history of the seizure, custody, control, transfer, analysis, and disposition of physical or electronic evidence.
- Proves evidence integrity and authenticity.
- Essential for legal admissibility.
- Records every handler and action.
Memory trick: For court, you need a 'Chain' of trust, not just a 'Report'.