Does your organization have documented procedures for collecting, preserving, and safeguarding incident data and metadata while maintaining chain-of-custody?

This question assesses whether your organization has formal processes to handle digital evidence during security incidents in a way that maintains its integrity and admissibility. Proper evidence handling includes documenting when and how data was collected, securing it against tampering, and maintaining detailed records of who accessed it and when. Acceptable evidence would include documented incident response procedures that specifically address evidence collection and preservation, chain-of-custody forms, and tools/systems used for forensic data collection. For example, you might provide a redacted copy of your incident response playbook showing the evidence handling sections, screenshots of your evidence management system, or templates of chain-of-custody documentation.