ISO 27001 Annex A 5.28 Procedures for collecting and preserving evidence

This control partially overlaps E8-AC-ML2.8.

E8-AC-ML2.8 requires timely analysis of cyber security events to identify cyber security incidents. Annex A 5.28 relates by requiring procedures to identify, collect and preserve evidence associated with information security events, which often occurs during/after analysis and triage. E8-AC-ML2.8 is about speed and effectiveness of analysis for incident identification, while Annex A 5.28 is about evidentiary handling and forensic soundness.

This control partially overlaps E8-AH-ML2.14.

E8-AH-ML2.14 requires timely analysis of internet-facing server event logs to detect cyber security events. ISO/IEC 27001:2022 Annex A 5.28 requires procedures to identify, collect, acquire and preserve evidence related to information security events, which often leverages event logs as evidence. They overlap where analysed server logs become preserved evidence, but 5.28 focuses on evidentiary handling and chain-of-custody rather than ongoing detection monitoring.

This control partially overlaps E8-RA-ML3.9.

E8-RA-ML3.9 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. Annex A 5.28 requires procedures to identify, collect and preserve evidence related to information security events, which often relies on workstation logs as an evidence source. They overlap because timely log analysis under E8-RA-ML3.9 can trigger evidence collection, but Annex A 5.28 is broader and focused on evidentiary handling and preservation rather than detection monitoring.

This control supports E8-RA-ML2.7.

E8-RA-ML2.7 requires privileged account and group management events to be centrally logged. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identifying, collecting and preserving evidence related to security events, which is strengthened by having central, complete records of privileged identity and group changes. E8-RA-ML2.7 provides a key evidence source, while Annex A 5.28 focuses on the broader forensic process and handling requirements rather than what must be logged.

This control supports E8-RA-ML2.8.

E8-RA-ML2.8 requires event logs to be protected from unauthorised modification and deletion to preserve trustworthy evidence of activity. Annex A 5.28 of ISO/IEC 27001:2022 requires procedures for identifying, collecting, acquiring and preserving evidence related to security events, which relies on logs being intact and tamper-resistant. E8-RA-ML2.8 supports Annex A 5.28 by ensuring log-derived evidence remains reliable, though Annex A 5.28 also covers broader evidence handling beyond logs.

This control depends on E8-AH-ML2.13.

E8-AH-ML2.13 requires event logs to be protected from unauthorised modification and deletion so they remain trustworthy. Annex A 5.28 requires procedures to collect and preserve evidence related to information security events, which relies on tamper-resistant logs as a key evidence source. E8-AH-ML2.13 strengthens the reliability of evidence handled under Annex A 5.28, but does not by itself establish end-to-end evidence handling procedures.

This control partially overlaps ISM-0043.

ISM-0043 requires incident response plans to include steps necessary to ensure the integrity of evidence relating to a cyber security incident. ISO/IEC 27001:2022 Annex A 5.28 directly relates by requiring procedures for identification, collection, acquisition and preservation of evidence associated with information security events. ISM-0043 embeds evidence integrity within a broader incident response plan (including reporting and escalation), whereas Annex A 5.28 is deeper and more focused on the evidence lifecycle itself.

This control partially overlaps ISM-0137.

Annex A 5.28 requires the organisation to implement procedures for identifying, collecting and preserving evidence from information security events. ISM-0137 overlaps by requiring legal advice before allowing intrusion activity to continue for the purpose of collecting additional data or evidence, which directly affects how evidence collection procedures are executed. ISM-0137 is narrower and situational (intrusion continuation for evidence-gathering), while Annex A 5.28 is broader and applies to evidence handling across all event types.

This control partially overlaps ISM-0138.

ISM-0138 requires investigators to preserve the integrity of investigation evidence by recording actions, maintaining chain of custody, and following law enforcement instructions. ISO/IEC 27001:2022 Annex A 5.28 relates by requiring documented procedures for identifying, collecting, acquiring, and preserving evidence from information security events, supporting evidence integrity and defensibility.

This control partially overlaps ISM-0580.

ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored. Annex A 5.28 establishes procedures for identification, collection, acquisition and preservation of evidence related to information security events, which commonly includes log handling and chain-of-custody considerations. ISM-0580 is broader for logging policy and monitoring, while Annex A 5.28 is narrower and incident/evidence-focused (forensic defensibility).

This control partially overlaps ISM-1609.

ISM-1609 requires consulting system owners before allowing an intrusion to continue for evidence collection, while Annex A 5.28 focuses on the processes for handling evidence from security events. Both involve decisions related to evidence, but ISM-1609 specifically involves governance and authorization for intrusion handling.

This control partially overlaps ISM-1731.

ISM-1731 requires organisations to plan and coordinate intrusion remediation activities from trusted systems separate from compromised systems. Annex A 5.28 focuses on having procedures to identify, collect, acquire and preserve evidence for information security events, which commonly needs trusted tooling and systems to avoid tampering by an attacker. The overlap is in incident-response handling on trusted resources, but Annex A 5.28 is evidence-centric while ISM-1731 is remediation coordination-centric.

This control partially overlaps ISM-2051.

ISM-2051 requires event logs sufficient for cyber event detection. ISO/IEC 27001:2022 Annex A 5.28 involves procedures for identifying, collecting, and preserving evidence of security events, overlapping where logs are used as evidence but not focused on log generation.

This control supports ISM-0988.

ISM-0988 requires an accurate and consistent time source for event logging so timelines derived from logs are defensible. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identification, collection and preservation of evidence related to security events, which relies on accurate timestamps to establish sequence of events. Annex A 5.28 is about evidentiary handling and chain-of-custody, whereas ISM-0988 is about ensuring the underlying log time data is accurate.

This control supports ISM-1566.

ISM-1566 requires central logging of unprivileged access to create an auditable record of user actions. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identifying, collecting, acquiring and preserving evidence related to information security events. ISM-1566 supports Annex A 5.28 because centralised unprivileged-access logs are a primary evidence source that those procedures can preserve and present.

This control supports ISM-1623.

ISM-1623 requires centralised collection of detailed PowerShell activity logs (module, script block and transcription). Annex A 5.28 focuses on procedures to collect and preserve evidence related to information security events, which relies on high-quality, centrally available logs when incidents occur. ISM-1623 supports Annex A 5.28 by improving the availability and completeness of forensic evidence for PowerShell-driven activity.

This control supports ISM-1976.

ISM-1976 requires security-relevant events on macOS to be centrally logged, improving availability and consistency of audit trails. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identifying, collecting, acquiring and preserving evidence related to information security events, for which centralised logs are a key evidence source. ISM-1976 supports evidence preservation by ensuring macOS logs are captured centrally, but Annex A 5.28 extends to procedural chain-of-custody and broader evidence types beyond logs.

This control depends on ISM-1537.

ISM-1537 requires organisations to centrally log security-relevant database events so that database activity can be reconstructed and reviewed. Annex A 5.28 focuses on procedures to identify, collect and preserve evidence for information security events. Centralised database logging under ISM-1537 directly strengthens the ability to collect reliable database evidence, but 5.28 adds chain-of-custody and preservation processes not covered by ISM-1537.

This control depends on ISM-1819.

ISM-1819 requires the organisation to enact its cyber security incident response plan following identification of an incident. ISO/IEC 27001:2022 Annex A 5.28 supports that response by requiring procedures to identify, collect and preserve evidence related to information security events, which is a key activity frequently executed during incident response. Annex A 5.28 does not itself require activation of the plan, but it strengthens the quality and defensibility of actions taken once ISM-1819 is triggered.

This control depends on ISM-1988.

ISM-1988 requires event logs to be retained in a searchable manner for at least 12 months. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for collecting and preserving evidence related to information security events, which often relies on the existence and accessibility of historical logs. ISM-1988 strengthens Annex A 5.28 by ensuring logs are available and searchable to support evidence preservation, but it does not define broader evidence-handling procedures (e.g. chain of custody).

This control depends on ISM-2159.

ISM-2159 requires the organisation to generate and centrally collect detailed records of agentic AI tool calls, external requests, and outputs for incident investigations. ISO/IEC 27001:2022 Annex A 5.28 requires procedures for identification, collection, acquisition, and preservation of evidence related to information security events, which directly governs how ISM-2159-produced AI audit logs should be handled as evidence (e.g., preservation and integrity). Annex A 5.28 is process/chain-of-custody focused, while ISM-2159 is a technical evidence-generation requirement specific to agentic AI activity.

This control depends on IT.DET-01.1.

IT.DET-01.1 requires event logs to be protected from unauthorised access, modification or deletion, including through encryption and by securing the systems and accounts that store and manage them. Protecting logs in this way preserves their integrity and availability, which supports the preservation of evidence related to information security events required by Annex A 5.28. Annex A 5.28 requires procedures for identifying, collecting, acquiring and preserving evidence, which IT.DET-01.1 does not itself establish.

This control depends on IT.DET-01.3.

IT.DET-01.3 requires a centralised event log storage capability that protects logs from unauthorised access or modification. Holding logs in a protected central store preserves their integrity so they can be relied on as evidence of information security events, which supports the evidence preservation required by Annex A 5.28. Annex A 5.28 requires procedures for identifying, collecting, acquiring and preserving evidence generally, while IT.DET-01.3 addresses only the secure storage of logs.