ISO 27001 Control 5.28: Collection of Evidence

Alan Parker, ISO 27001 Consultant & Internal Auditor,
Helping UK SMEs hit ISO 27001 in 90 days.
B.Sc (Hons) Information Systems · Certified ISO 27001 Lead Auditor · CISMP · ITIL Expert · 30+ years in IT governance and security.
Read full bio →

Introduction

Most people I work with think control 5.28 simply does not apply to them. Evidence collection sounds like something for police forensics teams and large corporates with legal departments, not a twenty-person business. They will never be in a scenario where evidence is needed.

I have been there. Around 2023, an organisation I worked with was taken to court, not over any individual, but over its own conduct and whether it had followed due process. It brought in PwC to help pull together the evidence for its response. I can tell you that it can be very difficult to do, and incredibly costly if you get pulled into a court case or similar without being ready. The incidents that end up needing evidence are rarely the ones you expect: a dismissal that becomes a tribunal claim, a fraud discovered months later, an insurance claim after ransomware, a former employee who took the client list with them.

You do not need forensic skills to meet this control. You need a “break glass in case of emergency” plan: a short set of steps that tells whoever is handling the incident when to stop, what not to destroy, how to record what they collect, and who to call. Without one, you may find yourself bringing in expensive outside specialists to do the basics for you, or discovering that the evidence you needed was wiped in the first hour.

What control 5.28 actually asks for

The requirement is that the organisation establishes and implements procedures for the identification, collection, acquisition and preservation of evidence related to information security events. In practice:

• Knowing when evidence matters: recognising the incidents that could end up in a dispute, disciplinary, claim or prosecution.
• Not destroying it: preserving systems, accounts and logs before they are cleaned up or overwritten.
• Collecting it properly: in a way that shows it has not been altered.
• Recording chain of custody: who collected what, when, how, and who has had it since.
• Knowing who to call when it is beyond what you can do yourself.

In the 2013 edition this was control A.16.1.7. The intent is unchanged.

Where 5.28 sits among the incident controls

5.28 runs alongside the response, not after it.

The decision about evidence has to be made during the response, not after. By the time the review starts, a wiped laptop or a rolled-over log is already gone. That is why the first-hour steps in control 5.26 include deciding whether evidence matters.

When it matters

Evidence becomes important whenever an incident could end up in front of someone who will test it. For a small business the realistic scenarios are:

• Employee misconduct: data taken by a leaver, misuse of systems, a dismissal that may be challenged at tribunal.
• Fraud: invoice redirection, payment diversion, or internal fraud discovered after the fact.
• Insurance claims: your cyber insurer will want to understand what happened, and may need evidence to pay out.
• Criminal activity: extortion, ransomware, or anything reported to Report Fraud (formerly Action Fraud) or the police.
• Disputes with customers or suppliers: who caused a breach, and whether contractual obligations were met.
• Regulatory enquiries: the ICO may ask what happened and what you did about it.

The rule of thumb: if there is any chance an incident ends up in one of those places, treat it as evidence from the start. You can always relax later. You cannot recover what has already been destroyed.

The break glass plan

This is the core of the control for a small business: a short, plain set of steps, kept where your incident lead can find it.

1. Stop and decide. Could this end up in a dispute, dismissal, claim or police report? If there is any chance, treat it as evidence from now on.
2. Do not switch off, wipe or rebuild. Isolate devices from the network instead, leaving them powered on. Do not log in as the user to “have a look”. Do not delete the suspicious email or the forwarding rule until it has been recorded.
3. Preserve logs straight away. Export sign-in logs, mailbox audit logs and firewall logs before they roll over. Many cloud services keep them for a limited period.
4. Record everything you collect: what it is, where it came from, who collected it, when and how, and where it is stored.
5. Limit who touches it. One named person collects and stores. Everyone else keeps away.
6. Call for help early. Your cyber insurer’s helpline (many policies require this before you engage anyone else), your solicitor, and a digital forensics provider if needed.
7. Involve HR and legal advice before accessing an employee’s accounts or devices in a misconduct matter. Monitoring and accessing employee data has its own legal requirements.

Chain of custody

Chain of custody sounds like something from a television drama, but the idea is simple. If evidence might be relied on later, you need to be able to show that what you are presenting is what you collected, and that nobody has changed it in between.

For a small business that means a log, one line per item, recording what it is, where it came from, who collected it, when, how, where it is stored, and every time it changes hands. Store it somewhere access-controlled, not in someone’s downloads folder. For digital files, recording a hash (a fingerprint of the file) when you collect it is good practice, and any forensics provider can show you how.

It takes five minutes per item. The alternative is an opposing lawyer asking how you know the log file has not been edited, and nobody being able to answer.

Proportion: what you do not need

You do not need forensic software, forensic training, or a dedicated evidence locker. For the rare incident that genuinely needs forensic work, you bring in a specialist, and the best thing you can have done before they arrive is not to have destroyed anything.

What you do need is for the person leading an incident to recognise the moment, follow a short plan, and know who to call. That is a page of steps, a log and a contact list, and it is the difference between a manageable situation and an expensive one.

What auditors will look for

In an audit, I would typically work through 5.28.

1. A procedure. Is there a written process for identifying and preserving evidence, even a short one?
2. Awareness. Does the incident lead know it exists and when to use it?
3. Contacts. Do you know who you would call: insurer, solicitor, forensics provider?
4. Log retention. How long are your key logs kept, and could you export them in time?
5. A real case, if there was one. If an incident in the last year could have gone legal, how was evidence handled?
6. HR involvement. How would you handle evidence in an employee misconduct case, and has HR been involved in agreeing that?

Common issues

• No procedure, on the assumption it will never be needed.
• Affected laptops wiped and reimaged before anyone considered evidence.
• Suspicious emails and forwarding rules deleted before being recorded.
• Logs rolled over or expired before anyone thought to export them.
• Several people “having a look” at a compromised account, contaminating the trail.
• Employee accounts accessed in a misconduct case without HR or legal advice.
• The insurer called after outside help was engaged, putting the claim at risk.
• No idea who to call for forensic help, and a very expensive emergency engagement as a result.

The self-check

Five questions. If you cannot answer them today, an auditor will find that out for you.

• If an employee were suspected of taking client data tomorrow, what would you do first, and what would you avoid doing?
• How long are your Microsoft 365 or Google Workspace sign-in and audit logs kept?
• Does your cyber insurance policy require you to call them before engaging outside help?
• Who would you call for digital forensics, and do you have the number?
• Would your IT provider know not to wipe a compromised laptop?

The last one catches people out. Rebuilding a compromised machine is the right instinct for recovery and the wrong one for evidence, and IT providers are usually measured on recovery.

A worked example

These numbers are typical of what I see, not taken from one client. This is a composite of what goes wrong without a plan, and what a plan changes.

A 15-person consultancy. A senior consultant resigns and joins a competitor. Two months later, several clients follow. The business suspects the client list and proposals were taken.

Without a plan

• The consultant’s laptop had been wiped and reissued to a new starter the week they left, as standard.
• Their mailbox had been deleted after 30 days, as standard.
• Cloud audit logs only went back as far as the default retention period, and the relevant period had passed by the time anyone asked.
• The solicitor’s advice was that, without evidence, the claim was not worth pursuing.

What changed

• A one-page break glass plan, and an addition to the leaver process: for senior or high-risk leavers, retain the laptop and mailbox for six months before wiping.
• Audit log retention extended in Microsoft 365 for key accounts.
• Insurer, solicitor and a forensics provider recorded on the contacts sheet.
• The IT provider briefed: no wiping of a device involved in any incident without the incident lead’s agreement.

None of this is costly. All of it would have changed the outcome.

How control 5.28 links to other clauses and controls

• Control 5.26, Response to information security incidents. The decision to preserve evidence is made during the response.
• Control 5.27, Learning from information security incidents. Preserved evidence is also what makes a sound root cause analysis possible.
• Control 8.15, Logging. Logs are usually the most important evidence, and only if they still exist.
• Control 5.33, Protection of records. Evidence and chain of custody records need protecting like any other important record.
• Control 6.4, Disciplinary process. Misconduct cases are where small businesses most often need evidence.
• Control 5.5, Contact with authorities. The police may give instructions on how evidence should be preserved.

What I find in audits

Because logs are so rarely reviewed (see 5.25), nobody usually notices that the retention period is too short until the evidence has already gone. More detail is in my findings report.

Frequently asked questions

Sources and further reading

Official legislation, standards and guidance referred to on this page.

• Report Fraud. The national service for reporting cyber crime and fraud, run by City of London Police. It replaced Action Fraud in December 2025.
• Report a breach. ICO guidance on assessing and reporting a personal data breach.
• Incident management. NCSC guidance on planning for and responding to cyber incidents.
• Computer Misuse Act 1990. The main UK law on unauthorised access to computer systems.
• ISO/IEC 27001:2022, Information security management systems. The standard itself, published by ISO.

Internal Audit Service

Get an independent view of your ISO 27001 ISMS before you go into an audit.

“Alan from Iseo Blue truly came to our rescue. His support ahead of our internal audit was outstanding, and he helped us get our ISMS 100% ready for the Phase 2 audit.“

– Quartile.

✓ Gain confidence
✓ Audit plan
✓ Independent view
✓ An ISO 27001 requirement

✓ Audit findings report
✓ Recommendations
✓ Review meeting
✓ Fixed price

£2,500

+ VAT where applicable

View DetailsBook a discovery call