Certified Information Security Manager (CISM) — Question 299

When collecting admissible evidence, which of the following is the MOST important requirement?

Answer options

• A. Need to know
• B. Due diligence
• C. Chain of custody
• D. Preserving audit logs

Correct answer: C

Explanation

The 'Chain of custody' is essential because it ensures that the evidence has been collected, handled, and stored properly, maintaining its integrity and admissibility in court. While 'Need to know', 'Due diligence', and 'Preserving audit logs' are important, they do not directly relate to the legal aspects of evidence handling as critically as the chain of custody does.