Collection of evidence

Organization must create processes that identify, collect and store relevant evidence information related to information security incidents. The evidence may need to have been collected in a way that can be accepted in relevant courts or other similar disciplinary bodies.

Regarding the evidence material, it should be possible to demonstrate e.g.:

• the records are complete and not altered in any way
• copies of electronic evidence are likely to be identical to the originals
• the data system from which the evidence was collected was functioning properly at the time of collection

Certification or other assurances of the competency of related personnel and tools may additionally be considered to establish more evidentiary value.

Our organization has defined the actions to be taken in the event of a breach of confidentiality. These may include e.g. the following steps:

• investigating what data was breached and how harmful this was
• investigating the intentionality of the act
• investigating what was set as conseguence on the confidentiality agreement
• deciding whether and how to proceed (e.g. legal actions)
• deciding whether outside assistance is needed