ISO 27001 Collection of Evidence Explained – Control 5.28

ISO 27001 Collection of Evidence Explained – Control 5.28

/ ISO 27001 Controls / By

When security incidents escalate, evidence quality determines outcomes. Over my 30 years in governance, risk, and compliance, I have seen far too many incident response teams rush to reboot compromised servers, restore backups, or wipe infected drives to restore uptime, completely destroying volatile forensic memory in the process. When you scramble without a plan, you destroy the digital footprint needed to hold attackers accountable, support an insurance claim, or defend your actions in court. Annex A 5.28 ensures your organization treats evidence as a high-value asset, preserving credibility under strict legal, regulatory, and disciplinary scrutiny.

ISO 27001:2022 includes Annex A 5.28 to ensure your business collects, handles, and preserves digital and physical evidence related to information security incidents in a reliable, defensible, and legally admissible manner. This control updates former 2013 requirements (16.1.7) and connects forensic readiness directly with logging baselines, time synchronization, chain of custody protocols, and incident escalation playbooks.

Quick Summary: What ISO 27001 Annex A 5.28 Requires

At a practical level, Annex A 5.28 is about establishing a defensible process to capture “the truth” following an incident. It does not require hiring full-time digital forensics expert teams for minor malware alerts; it expects risk-proportionate, legally aware evidence handling. Here is what you need to do in plain English:

  • Establish Evidence Collection Procedures: Document step-by-step forensic collection workflows before an incident occurs (Annex A 5.37).
  • Ensure Technical Forensic Readiness: Maintain centralized SIEM logging (Annex A 8.15) and accurate NTP time synchronization across all network assets (Annex A 8.17).
  • Protect Evidence Integrity & Authenticity: Utilize cryptographic hashing (e.g., SHA-256) and write-blockers to prove evidence has not been altered.
  • Maintain a Strict Chain of Custody: Log every individual who accesses, transfers, or analyzes digital or physical evidence.
  • Train & Authorize Competent Handlers: Ensure designated incident leads understand proper evidence preservation techniques to avoid accidental contamination.
  • Balance Containment with Preservation: Train SecOps teams to capture volatile RAM and system states *before* executing destructive containment steps (e.g., re-imaging).

Why Poor Evidence Handling Is a Critical Hazard

When an incident escalates to formal HR disciplinary action, regulatory investigation (such as a GDPR breach report), or law enforcement prosecution, evidence that has been mishandled or altered becomes completely inadmissible.

Ignoring evidence collection and preservation controls exposes your business to severe hazards:

  • Inadmissible Legal & HR Evidence: HR tribunals or courts dismissing cases against malicious insiders because system logs were modified or proper chain of custody was broken (Annex A 6.4).
  • Rejected Cyber Insurance Claims: Insurance providers denying coverage payouts because the organization wiped infected systems without preserving forensic proof of the ransomware vector.
  • Inability to Determine Breach Root Cause: Rebooting or re-imaging machines prematurely, erasing volatile memory (RAM) and hiding the attacker’s persistence mechanism.
  • Time Desynchronization Chaos: Log timestamps across firewalls, cloud portals, and domain controllers failing to match, making cross-system event correlation impossible.

My 8 Step Plan to Implement Annex A 5.28 Fast

You do not need a high-cost forensic lab on retainer to satisfy an ISO 27001 auditor. Here is my pragmatic, 8-step plan to establish an audit-ready evidence collection framework.

1. Establish Technical Forensic Readiness

Evidence can only be collected if your underlying systems capture it accurately in advance (Annex A 8.9):

  • Network Time Protocol (NTP): Synchronize all servers, firewalls, network switches, and cloud instances to an authoritative NTP clock source (Annex A 8.17).
  • Centralized Immutable Logging: Route system, application, and access logs to a central SIEM or write-once cloud storage bucket with log-tampering protection enabled (Annex A 8.15).
  • Memory & Disk Capture Capabilities: Equip your IT/SecOps teams with pre-approved, lightweight forensic acquisition tools (e.g., FTK Imager, Volatility, or native cloud snapshot tools).

2. Define Evidence Identification and Priority Tiers

Train incident responders to collect volatile evidence based on order of volatility (Order of Volatility principle):

  • 1. Volatile Memory (Highest Priority): CPU cache, routing tables, ARP cache, active process memory (RAM), and active network connections.
  • 2. Temporary & System State: File system swap space, temporary cache, and active system registry hives.
  • 3. Persistent Storage: Local hard drives, cloud block storage volumes, solid-state drives, and virtual machine disks.
  • 4. Static Archives & Backups: Off-site backup media, centralized SIEM log archives, and physical access badge records (Annex A 7.2).

3. Enforce Cryptographic Integrity Protections

Prove to court authorities, regulators, and auditors that evidence has not been tampered with post-collection:

  • Generate cryptographic hash values (SHA-256) immediately upon capturing any digital image, log extract, or memory dump.
  • Re-verify hash values regularly during analysis to prove the forensic working copy remains identical to the original image.
  • Store primary forensic disk images on read-only media or access-controlled, immutable cloud repositories.

4. Document a Formal Chain of Custody Protocol

Maintain an unbroken, auditable trail documenting the physical and digital lifecycle of every piece of evidence:

  • Log key tracking metadata: Unique Evidence ID, date/time collected, precise source location/MAC address, collecting officer name, and item description.
  • Require explicit sign-in/sign-out signatures whenever physical media or digital files are transferred between analysts or legal teams.
  • Store physical evidence (stolen drives, compromised laptops, USB media) inside a locked, access-controlled safe (Annex A 7.10).

5. Integrate Evidence Preservation into Incident Playbooks

Ensure that containment actions do not destroy vital evidence during active threat mitigation (Annex A 5.26):

  • Train SecOps engineers to isolate compromised virtual machines or endpoints via network segmentation rather than instantly powering them off or terminating instance states.
  • Take cloud disk snapshots and memory dumps *before* deploying anti-malware remediation scripts or re-imaging hardware.
  • Incorporate an explicit “Preserve Evidence?” checkpoint inside every major incident escalation workflow.

6. Manage Legal, Regulatory, and Privacy Boundaries

Digital evidence collection often involves handling personal employee data or confidential client records:

  • Ensure evidence collection workflows comply with regional data protection laws (e.g., GDPR, CCPA) regarding personal privacy (Annex A 5.34).
  • Consult internal Legal Counsel or DPO before seizing personal BYOD devices or inspecting personal communication channels (Annex A 6.7).
  • Sanitize or redact non-relevant PII from evidence files when sharing reports with external third-party auditors or insurers.

7. Authorize and Train Competent Evidence Handlers

Unqualified personnel attempting digital forensics often contaminate evidence, rendering it useless:

  • Designate specific, trained incident response leads authorized to execute digital evidence collection.
  • Provide specialized training on forensic acquisition methods, memory preservation, and chain-of-custody documentation.
  • Establish retained contracts with qualified external digital forensics and incident response (DFIR) specialists for high-severity breaches.

8. Conduct Post-Incident Evidence Audits and Reviews

Use completed incident investigations to refine your evidence handling procedures continuously:

  • Conduct post-incident reviews (Annex A 5.27) to evaluate whether collected evidence was sufficient, defensible, and timely.
  • Review evidence storage retention rules to ensure closed incident files are securely purged once statutory or legal retention limits expire (Annex A 5.33).
  • Provide anonymized chain-of-custody logs and forensic acquisition records as proof of compliance during ISO 27001 audits.

Common Implementation Pitfalls and How to Fix Them

When preparing clients for ISO 27001 audits, I frequently spot the same evidence collection mistakes. Here are the main traps and how to solve them:

  • Problem: Powering Off or Rebooting a Compromised Server, Wiping RAM Memory Completely
    Ninja Solution: Train incident responders to isolate systems on the network and capture volatile RAM memory *before* powering down or rebooting hardware.
  • Problem: Unsynchronized Server Clocks Making Cross-System Event Correlation Impossible
    Ninja Solution: Enforce mandatory NTP time synchronization across all internal servers, cloud instances, and network security appliances (Annex A 8.17).
  • Problem: Analyzing Live Primary Evidence Files Directly Instead of Working Copies
    Ninja Solution: Write-protect original evidence images immediately, calculate SHA-256 hashes, and conduct all technical analysis strictly on secondary working copies.
  • Problem: Zero Chain-of-Custody Records Kept for Laptops Seized During Insider Fraud Cases
    Ninja Solution: Implement a standard physical/digital Chain-of-Custody form that must be completed and signed whenever media is handled.

The ISO 27001 Ninja Bottom Line

ISO 27001 Annex A 5.28 is about protecting the integrity of facts when an incident escalates. Not every incident leads to formal legal proceedings or regulatory scrutiny, but when it does, the quality, integrity, and defensibility of your evidence determines the outcome.

By establishing technical readiness via NTP time synchronization and immutable logging, training staff on order of volatility, enforcing SHA-256 cryptographic hashing, documenting strict chain-of-custody logs, balancing containment speed with evidence capture, and engaging competent DFIR specialists, you build a legally defensible incident response posture, protect organizational credibility, and satisfy your ISO 27001 auditor with complete confidence.