Does your organization have documented procedures for collecting, preserving, and safeguarding incident data and metadata while maintaining chain-of-custody?

Sound evidence handling is the focus here: whether you have documented procedures for collecting, preserving, and protecting incident data and metadata while maintaining chain-of-custody. Proper evidence handling includes documenting when and how data was collected, securing it against tampering, and maintaining detailed records of who accessed it and when.

Acceptable evidence would include documented incident response procedures that specifically address evidence collection and preservation, chain-of-custody forms, and tools/systems used for forensic data collection. For example, you might provide a redacted copy of your incident response playbook showing the evidence handling sections, screenshots of your evidence management system, or templates of chain-of-custody documentation.