Certified Information Systems Auditor (CISA) — Question 450

Which of the following BEST facilitates the legal process in the event of an incident?

Answer options

• A. Right to perform e-discovery
• B. Preserving the chain of custody
• C. Results of a root cause analysis
• D. Advice from legal counsel

Correct answer: B

Explanation

Preserving the chain of custody is crucial because it ensures that evidence remains intact and is tracked properly, making it admissible in court. The other options, while important, do not directly relate to maintaining the integrity of evidence needed for legal processes. E-discovery, root cause analysis, and legal counsel are valuable but do not replace the necessity of a preserved chain of custody.