Evidence Gathering
Create a policy that ensures all evidence is collected and handled in a secure and efficient manner. Remember, you are writing a policy, not procedures. Focus on the
high-level tasks, not the individual steps.
Address the following in your policy:
Description of information required for items of evidence
Documentation required in addition to item details (personnel, description of circumstances, and so on)
Description of measures required to preserve initial evidence integrity
Description of measures required to preserve ongoing evidence integrity
Controls necessary to maintain evidence integrity in storage
Documentation required to demonstrate evidence integrity