In this ultimate how to audit guide to ISO 27001 Annex A 5.28 Collection of Evidence, you will learn directly from an ISO 27001 Lead Auditor:
- 10 Key Audit Steps
- Verification Criteria
- Required Evidence
- The Pass / Fail Test
I am Stuart Barker, the ISO 27001 Lead Auditor and author of the Ultimate ISO 27001 Toolkit.
Using over 30 years of industry experience across hundreds of audits, I’m giving you the exact templates, walkthroughs, and practical examples you need to achieve ISO 27001 certification.
Table of contents
- 1. Identification of Evidence Sources Verified
- 2. Forensic Readiness Plan Formalisation Verified
- 3. Chain of Custody Documentation Integrity Confirmed
- 4. Technical Evidence Preservation Tools Validation Confirmed
- 5. Personnel Competence for Evidence Collection Validated
- 6. Protection of Collected Evidence Integrity Verified
- 7. Evidence Storage Security Controls Confirmed
- 8. Adherence to Jurisdictional Legal Requirements Verified
- 9. External Specialist Engagement Protocols Validated
- 10. Post-Collection Evidence Disposal Procedures Confirmed
Auditing ISO 27001 Annex A 5.28 is a critical verification process to ensure that digital and physical evidence is legally defensible. The Primary Implementation Requirement centers on maintaining a rigorous chain of custody, providing the Business Benefit of forensic integrity during legal or disciplinary proceedings.
1. Identification of Evidence Sources Verified
Verification Criteria: The organisation has identified all potential sources of evidence (e.g. log files, system images, physical media, mobile devices) within the ISMS scope that may be required for legal or disciplinary action.
Required Evidence: Asset Register cross-referenced with the Incident Management Plan identifying specific evidence-bearing systems.
Pass/Fail Test: If the organisation cannot identify which systems generate legally admissible logs during an active incident, mark as Non-Compliant.
2. Forensic Readiness Plan Formalisation Verified
Verification Criteria: A documented forensic readiness plan exists that outlines the procedures for identifying, collecting, and preserving evidence to ensure its admissibility in court or disciplinary hearings.
Required Evidence: Approved Forensic Readiness Policy or an Evidence Collection Standard Operating Procedure (SOP).
Pass/Fail Test: If the organisation relies on ad-hoc collection methods without a formalised, documented preservation plan, mark as Non-Compliant.
3. Chain of Custody Documentation Integrity Confirmed
Verification Criteria: Every piece of evidence collected is accompanied by a Chain of Custody record that tracks its movement, handling, and storage from the moment of collection.
Required Evidence: Completed Chain of Custody forms or digital logs showing timestamps, handler names, and transfer reasons for recent incidents.
Pass/Fail Test: If any piece of evidence lacks a continuous, documented record of who possessed it at any given time, mark as Non-Compliant.
