[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-28":3},{"item":4,"lessons":16,"controls":18,"related":19},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-28","Annex A 5.28","Collection of evidence",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Set up and follow procedures to identify, collect, acquire and preserve evidence relating to information security events so that it can be relied on in disciplinary or legal proceedings.\n\n**In practice.** Responders know which sources matter, such as logs, disk and memory images, mailbox data and access records, and how to capture them without altering them. Procedures cover chain of custody, hashing, secure storage, retention and when to call in specialist forensic support or legal counsel. Requirements differ by jurisdiction, so the approach is checked with legal advisers. Evidence of the control includes the documented procedure, trained staff or a retained forensics provider, and custody records from past cases.\n\n**Common gaps.** Many organisations have no procedure until an incident happens, and first responders reboot or reimage systems before evidence is captured. Log retention is often too short, and chain of custody is undocumented, weakening any later legal action.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[],[],[]]