Evidence gathered during a fraud-related incident may later be presented in court. What is MOST important for the security manager to ensure during evidence handling?
Select an answer to reveal the explanation.
Short Explanation
Think of evidence like a package with a signature at every hand-off. If there's a gap, the other side will say anybody could've tampered with it. Chain of custody is that signature trail, and without it you may never get the evidence into the courtroom.
Full Explanation
Evidence that may be used in legal proceedings must be shown to be authentic and unaltered. A chain of custody records who collected each item, when and how, every subsequent transfer, where it was stored and who accessed it, so that the organization can demonstrate integrity from collection to presentation. Gaps in that record give opposing parties grounds to challenge admissibility or weight. Encrypting evidence with a single investigator's personal key protects confidentiality but creates a dependency on one person and does not by itself document handling; if that person leaves or the key is lost, the evidence may become unusable. Storing copies on a shared drive open to the whole team weakens access control and makes it difficult to prove who handled the evidence. Having the discovering administrator analyse original media risks altering it and mixes roles; analysis should be performed by trained personnel on verified copies while originals are preserved. Exam caveat: legal counsel should guide evidence requirements when litigation is possible, and procedures should be defined in advance rather than improvised. Operational check: confirm chain-of-custody forms are completed for each item, hashes are recorded, storage is access-controlled and every transfer is signed.