ISO 27001:2022 Annex A Control 5.28

• See ISO 27002:2022 Control 5.28 for more information.
• See ISO 27001:2013 Annex A 16.1.7 for more information

The Purpose of Annex A 5.28

The revised ISO 27001:2022 Annex A 5.28 Collection of Evidence ensures that organisations manage evidence in a robust and consistent manner throughout the reporting and resolution of information security incidents.

It is crucial to collect accurate evidence in a timely manner as it informs everything from disciplinary proceedings to legal proceedings.

Who Has Ownership of Annex A 5.28?

ISO 27001:2022 Annex A 5.28 deals with the explicit legal and disciplinary consequences of collecting evidence relating to an information security incident. Annex A 5.28 primarily deals with internal technical issues relating to information security, but there are circumstances where procedural adherence is legal.

Organisations should consider delegating Annex A 5.28 ownership to a member of senior management who is responsible for HR and/or legal matters.

General Guidance on Annex A 5.28

In Annex A 5.28, it is explicitly stated that evidence collection procedures should be devised with the express intention of fulfilling the disciplinary and/or legal obligations of the organisation.

Additionally, the collection of evidence should focus on fulfilling obligations across a wide range of regulatory environments and legal jurisdictions, so that incidents can be analysed by several distinct external bodies to the same degree, across a wide range of variables, such as:

• Assets and Devices.
• Device Status (Such as login attempts, power status etc).
• Storage Media.

It is important for organisations to demonstrate:

• Records of their incidents are complete and have not been altered.
• Where applicable, electronic evidence is a perfect replica of physical evidence.
• During the recording of evidence, internal systems and ICT platforms had the operational capacity to collect evidence.
• Evidence is collected by individuals who are appropriately qualified and certified in their roles.
• Where necessary, they are legally entitled to collect digital evidence.

Additional Supplementary Guidance for Annex A 5.28

As noted in Annex A 5.28, organisations should not make assumptions about the relevance of evidence collected in future litigation.

In order to avoid accidental or intentional destruction of incident-related evidence, organisations are encouraged to seek legal advice and/or involve law enforcement authorities as soon as possible.