+DER.2.2.A10 Forensic Securing of IT Evidence [Process Owner] (S)

DER.2.2.A10 Forensic Securing of IT Evidence [Process Owner] (S)

Storage media SHOULD be forensically duplicated as completely as possible. If this is not possible (e.g. in the case of volatile data in RAM or SAN partitions), a method that changes as little data as possible SHOULD be selected.

The original storage media SHOULD sealed and retained. Cryptographic checksums that are documented in writing SHOULD be created from the storage media. These SHOULD be kept separately and in multiple copies. In addition, it SHOULD be ensured that the checksums documented in this way cannot be changed. A witness SHOULD confirm the corresponding procedure and certify the checksums so that the data is admissible in court.

Only trained personnel (see DER.2.2.A6 Training Personnel on Forensic Securing of Evidence) or a provider of forensic services (see DER.2.2.A3 Pre-Selection of Forensic Service Providers) SHOULD be assigned to secure evidence.

1. Panoramica

1.1 Riferimenti

1.2 Requisiti identificati

1.3 Regolamentazioni correlate

2. Requisiti identificati

Requisiti

3. Regolamentazioni correlate

Regolamentazioni

Ticket collegati

Collegamenti
blocks G 0.17 Loss of Devices, Storage Media and Documents
blocks G 0.22 Manipulation of Information
blocks G 0.31 Incorrect Use or Administration of Devices and Systems
blocks G 0.37 Repudiation of Actions
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information