SSCP Systems Security Certified PractitionerIncident Response and RecoveryHard
An organization is updating its incident response plan. The security team wants to ensure that critical evidence is properly collected and preserved for potential legal action or detailed forensic analysis. Which incident response principle is addressed by this concern?
- AMinimizing disruption
- BCommunication
- CTimeliness
- DChain of custody
Show answer & explanationAnswer & explanation
Correct answer: D. Chain of custody
Chain of custody is the meticulous documentation of who has had possession of evidence, when, and for what purpose, ensuring its integrity and admissibility in legal proceedings or forensic analysis.
Why the other options are wrong
- A. Minimizing disruption is a goal of incident response but doesn't specifically address evidence handling.
- B. Communication is crucial during an incident but does not directly relate to the technical preservation of evidence.
- C. Timeliness refers to responding quickly, which is important but not directly about evidence preservation.
Chain of Custody
A documented process that tracks the handling and storage of evidence from the moment it is collected until its final disposition, ensuring its integrity and authenticity.
- Essential for legal admissibility of evidence.
- Documents who handled the evidence, when, and why.
- Prevents tampering and maintains integrity.
Memory trick: Evidence needs a clear chain to be trusted.