Does your organization require incident leads to document security incidents in detail and maintain the integrity of all incident documentation and information sources?

This question assesses whether your organization has formal requirements for incident documentation that preserve the chain of custody and accuracy of information during security incidents. Proper documentation by a designated incident lead ensures accountability, provides a reliable record for post-incident analysis, and supports potential legal or compliance requirements. It also helps maintain consistency in how incidents are recorded across the organization. Evidence could include an incident response policy document that explicitly assigns documentation responsibilities to incident leads, incident report templates that include fields for documenting information sources, or completed incident reports showing proper documentation practices with chain of custody maintained.