Skip to content
Cyber security incidents
ASD ISMISM-0138

ASD ISM 0138 Maintaining integrity of evidence in investigations

What it says

The integrity of evidence gathered during an investigation is maintained by investigators: - recording all their actions - maintaining a proper chain of custody - following all instructions provided by relevant law enforcement agencies.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Investigators keep evidence intact by documenting actions, ensuring custody, and following law enforcement guidance.

When investigating a cyber incident, it's crucial to keep evidence untouched and properly documented. If evidence is mishandled, it could lead to the wrong conclusions, legal issues, or the culprit remaining unidentified.

Why it matters

If investigation evidence isn't preserved properly, it can lead to failed prosecutions, mishandled incidents, and loss of trust with stakeholders.

How to implement

  1. Investigators should keep a detailed log of every action they take during an investigation.

    Document each step immediately to avoid forgetting details; use a digital or physical logbook.

  2. The office manager should assign a responsible person to oversee the chain of custody for evidence.

    Ensure this person is trained in documenting who handles evidence, from first collection to storage.

  3. IT staff should consult closely with law enforcement when handling evidence.

    Follow explicit instructions to ensure evidence is admissible in court if needed, maintaining communication through clear channels.

  4. Managers need to set up a regular review process of evidence handling procedures.

    This involves scheduling bi-annual meetings to update staff on best practices and any changes in policy or law.

  5. The HR team should provide staff training on the importance of evidence integrity.

    This could be part of an induction program or an annual refresher course, highlighting real-world consequences of negligence.

Keep it running

Regularly check that staff adhere to evidence handling procedures and update them on any changes in legal requirements or best practices.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    the detailed log of actions taken during a specific investigation.

    Look at

    the completeness and timeliness of the entries.

    Good evidence

    All actions are described clearly, with times and dates.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Clear, consistent record showing every person involved.

  3. Check 3 of 5What an auditor asks for

    Ask for

    to see communication records between the organisation and law enforcement.

    Look at

    acknowledgement from law enforcement of instructions given.

    Good evidence

    Documented guidelines and dates of communication.

  4. Check 4 of 5What an auditor asks for

    Look at

    attendance records and training materials.

    Good evidence

    Regular sessions with high staff attendance and comprehensive content.

  5. Check 5 of 5What an auditor asks for

    Ask for

    the policy document governing evidence integrity.

    Look at

    recent updates and approval signatures.

    Good evidence

    Document is current, with a clear review history and compliance with legal standards.

Mappings

Closest match in ISO/IEC 27001: A.5.26, Response to information security incidents, which this control partially meets.

ISO 27001

ISO/IEC 27001: 2 mappings

  • A.5.26Response to information security incidentsPartially meets
  • A.5.28Procedures for collecting and preserving evidencePartially overlaps
Essential Eight

ASD Essential Eight: 1 mapping

  • E8-AH-ML2.13Protect event logs from unauthorised changes or deletionDepends on

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.