Chain of custody is the documented, unbroken record showing who collected, handled, transferred, and analyzed a piece of evidence from the moment it was seized through any legal proceeding. Its purpose is to prove the evidence presented is the same evidence that was gathered, unaltered. A single gap in that record can render otherwise damning evidence inadmissible and sink an entire case.
In digital work this means using write blockers so the original media cannot change, hashing the evidence immediately and again after imaging to prove integrity, and logging every action with a timestamp, a name, and a signature. Analysis happens on forensic copies, never the original. The mistake that quietly ruins investigations is sloppy handoff paperwork, since opposing counsel will probe every transfer looking for a moment the evidence was unaccounted for.
Why does chain of custody matter for the CISSP exam?
Chain of custody lives in Domain 7: Security Operations, with ties to assessment work in Domain 6. Candidates should know evidence handling and preservation requirements, the roles involved in a transfer, and how these procedures link incident response to potential prosecution down the line.
Related terms: Incident Response, Audit Trail