Managing evidence information for information security incidents

Critical
High
Normal
Low

Organization must create processes that identify, collect and store relevant evidence information related to information security incidents. The evidence may need to have been collected in a way that can be accepted in relevant courts or other similar disciplinary bodies.

Regarding the evidence material, it should be possible to demonstrate e.g.:

  • the records are complete and not altered in any way
  • copies of electronic evidence are likely to be identical to the originals
  • the data system from which the evidence was collected was functioning properly at the time of collection

Certification or other assurances of the competency of related personnel and tools may additionally be considered to establish more evidentiary value.

Connected other frameworks and requirements:
5.28: Collection of evidence
ISO 27001

Disciplinary process for security breaches

Critical
High
Normal
Low

Our organization has defined the actions to be taken in the event of a breach of confidentiality. These may include e.g. the following steps:

  • investigating what data was breached and how harmful this was
  • investigating the intentionality of the act
  • investigating what was set as conseguence on the confidentiality agreement
  • deciding whether and how to proceed (e.g. legal actions)
  • deciding whether outside assistance is needed
Connected other frameworks and requirements:
7.2.3: Disciplinary process
ISO 27001
PR.IP-11: Cybersecurity in human resources
NIST CSF
5.28: Collection of evidence
ISO 27001
6.4: Disciplinary process
ISO 27001
7.3: Awareness
ISO 27001
No items found.