ISO 27001:2022 Annex A 5.28 collection of evidence: tribunal-ready

A sales director resigns on Friday. By Monday you suspect the client list went with them, HR wants to act, and someone in IT has offered to have a quick look at the laptop. That quick look is where an employment tribunal case can be lost.

This guide covers ISO 27001:2022 Annex A 5.28 collection of evidence for UK regulated firms and B2B scale-ups of 25–250 staff. It sets out what the control requires, the collection process under UK GDPR, a proportionate set-up, logging and custody, automation, and how auditors test it when you have never had an incident.

What does ISO 27002:2022 control 5.28 require?

ISO 27002:2022 control 5.28 collection of evidence requires a routine, agreed before any incident, for spotting, capturing and safeguarding digital evidence so legal and disciplinary proceedings can rely on it. The evidential bar has three parts: nothing altered, copies that mirror the source exactly, and a source system that was operating normally.

The control belongs to the incident cluster. It extends incident planning (A.5.24) and incident response (A.5.26) into the forensic and legal dimension. Those controls decide how you handle an event, and 5.28 decides how the material from it is gathered so a disciplinary panel, tribunal or court will accept it. The NCSC cyber incident response guidance makes the underlying point: careful tracking of a response matters most in cases later reviewed by regulators or courts.

The control is corrective: it operates after something has gone wrong and shapes the response so you can pursue accountability. It touches all three security properties. Evidence often holds sensitive material that must stay confidential, its integrity is the whole point, and it must stay available through a long legal timeline.

Each limb of the evidential bar needs its own habit:

• Nothing altered: hash every capture, with SHA-256 the usual norm, so you can later show the file has not changed.
• A faithful copy: work on copies, never originals, so the source stays exactly as you found it.
• A normally operating source: record the state the device was in and note that the system was working normally at capture.

Evidence you cannot prove untouched is just a story.

Why does ISO 27001:2022 Annex A 5.28 collection of evidence matter to a 50-person firm?

Annex A 5.28 matters because the realistic trigger is a leaver suspected of taking the client list or an insider fraud HR wants to act on, not a Hollywood breach. Mishandle the laptop in the first hour and the tribunal case collapses, or the collection itself breaches privacy law.

The timing trap is subtler. At the moment an event is detected, nobody knows whether it will end up in front of lawyers. Material gets wiped or overwritten in the clean-up before anyone realises it mattered.

The liability also faces the other way. Imaging a device or reading a mailbox without checking your entitlement can breach UK GDPR and employment law, which turns the employer from victim into defendant.

A common misreading treats 5.28 as the control for routine ISMS audit documentation, the records you show an auditor to prove other controls operate. It is not. The control covers evidence from security events that may become disciplinary, civil or criminal matters. Routine records of controls operating are a separate question.

For regulated firms there is a further cost. An inability to support a proper investigation reads badly with supervisors and insurers when an incident is picked over after the fact.

That is why the control asks for a routine agreed in advance, not a plan improvised in the first hour.

How does the ISO 27001 Annex A collection of evidence process work under UK GDPR?

The process follows a fixed order: stop touching the machine, call the named custodian, confirm legal entitlement to collect, acquire working copies with hashes and a note of system state, then log every handover. Legal and HR join early on anything that could turn disciplinary or criminal.

The sequence in full:

1. Stop touching the machine. Everyone except the named custodian leaves the device alone. Each file opened changes timestamps, and those timestamps are part of the evidence.
2. Call the named custodian. The runbook carries a name and a number, not a job title nobody fills.
3. Confirm legal entitlement and lawful basis. Monitoring a mailbox or imaging a device has UK GDPR and employment-law dimensions. Data that crosses borders or sits in a third party's cloud adds jurisdiction questions. A call to your employment lawyer before acquisition costs far less than a claim afterwards.
4. Acquire working copies. Capture copies, hash each one with SHA-256, and write down the state of the device and that the system was working normally. Physical items go into tamper-evident bags in a locked location. Digital images go to storage nobody can rewrite.
5. Log every handover. Record who, what, when, where and why for each transfer.
6. Involve legal and HR early. Their call on what to preserve, made on day one, is what saves the case on day ninety.
7. Set retention. Decide how long the material stays and who approves its deletion.

Evidence often contains personal data, so retention needs a documented schedule. The ICO storage limitation principles say you must not keep personal data longer than you need it, and you must be able to justify the period. An open case justifies holding the material. Once the case closes, that justification weakens, so record the lawful basis and a review date when the case opens.

Does a 25–250 person firm need an in-house forensics lab?

No. At 25–250 staff the right-sized answer is a short evidence-handling section inside the incident response procedure plus a retained external DFIR firm, vetted and under NDA before any incident. In-house staff secure the scene and preserve; certified specialists perform genuine acquisition for contested cases.

The evidence-handling section needs only three things:

• Who may handle evidence: a named custodian and a deputy.
• What triggers preservation mode: the events that move an incident from clean-up to case-building.
• The golden rule for everyone else: stop touching the machine and call the named person.

Genuine acquisition is a specialist job at this scale. Agree the external DFIR firm (digital forensics and incident response) now, with vetting done, an NDA signed and contact details in the runbook, rather than shopping for one mid-crisis. Certified people and tools make the material far more likely to hold up later.

Expect a day or two of bolt-on work, done once the incident response procedure covering A.5.24 to A.5.26 exists. There is no point defining evidence handling before an incident process exists for it to live inside. Revisit the section after your first real investigation, because that is where the gaps show.

Size does not lower the bar. The most common trigger at small scale is an employment dispute, not a nation-state attack, and tribunals apply the same evidential standards to a 30-person firm as to a bank. Spend the budget on the retainer, not on tooling.

A 20-page forensics manual nobody is qualified to run protects no one.

How does ISO 27002:2022 control 5.28 logging and chain of custody work?

Logs shipped to immutable, write-once storage make integrity a property of the pipeline, and NCSC recommends retaining incident-answering logs for at least six months. Chain of custody is a record of every item: who collected it, when, where it has been, each signed handover and why.

The NCSC security logging guidance frames the six months around the questions an investigation would ask. Start with the sources that answer who did what and when: identity provider sign-ins, mailbox and file-sharing audit logs, endpoint and VPN records. Choose them by the questions you would need answered, not by what is easiest to export.

Six months is a floor for logs that answer incident questions. Where logs hold personal data, the retention justification from the process section still applies, so document the period rather than defaulting to forever. NCSC notes that breaches are often found long after they start, so keep logs longer where budget allows.

A chain-of-custody record should hold, for every item:

• A unique identifier.
• Who collected it, and when.
• Where it has been held, including overnight.
• Every handover, signed by both parties.
• Why each transfer happened.

To prove custody in an employment tribunal or court, produce that record, the hash taken at capture and a fresh hash of the stored copy. If the two hashes match and every handover is signed, the file demonstrably has not changed since capture.

Alongside the custody log, keep a decision record: what was done, why, and what could not be captured. The NCSC incident guidance notes that a record of decisions, actions and data captured or missing is especially useful when you must show your response to a regulator.

The usual failure is not a missing log. It is a custody log that exists but has gaps: missing signatures, unrecorded transfers, no note of where the item sat overnight. Each gap hands the other side something to widen, and the next section shows how to make the record assemble itself.

How can you automate forensic readiness for control 5.28?

Four automations carry most of the load: write-once log destinations, custody tracked as a ticket trail, SHA-256 hashing scripted into every capture, and a legal-hold flag that suspends reimaging and mailbox deletion for named users. Each turns a human promise made under pressure into a pipeline property.

Here is how each one is built:

• Write-once log destinations. Stream system and audit logs to immutable storage as a matter of course. The integrity argument then needs no defending in cross-examination.
• Custody as a ticket trail. Run evidence handling through your ticketing system. Each transfer becomes a timestamped action with an owner, and the custody record builds itself as a by-product.
• Hashing built into capture. Script acquisitions so every artefact is hashed and the value logged at collection time, with no reliance on someone remembering under pressure.
• Legal-hold flag. A "preserve" switch in the incident workflow suspends device reimaging and mailbox deletion for named users.

The legal-hold flag answers the timing trap described earlier. An HR decision can take weeks, while the service desk's reimaging queue moves in days. Tie the flag to the leaver process so the laptop waits for a decision, not the other way round.

The flag should drive your platform's own hold. In Microsoft 365, a mailbox on hold is kept as an inactive mailbox even after the leaver's account is deleted. In Google Workspace, deleting the user deletes their Vault data too, so suspend or archive the account instead.

Judgement stays human: deciding when to raise the flag and when to call legal. The pipeline handles the repeatable parts, which is where panic does the most damage.

Reissuing a leaver's laptop before HR has decided what to do is destroying the case by calendar.

How do auditors test A.5.28 when you have never had an incident?

ISO/IEC 27002:2022 control 5.28 collection of evidence is tested through the procedure's existence and readiness arrangements when no incident exists: named custodians, a retained DFIR firm and an exercised custody-log template. Where an incident has occurred, the auditor traces its custody log, hashes and storage end to end.

Expect questions like these in the room:

• "Walk me through what happens to a suspect laptop from the moment an incident is declared."
• "Who in the business is allowed to collect evidence, and what training or external backing do they have?"
• "Show me the chain-of-custody record for your last investigation."
• "How would you prove this file is the same one you captured six months ago?"
• "Before imaging a member of staff's device, how do you confirm you have the legal right to?"

With no incident history, the auditor may talk the procedure through as a scenario instead of sampling a live case. That is why an exercised template counts: auditors accept a custody log completed in a tabletop walk-through where no real case exists.

Have these artefacts ready:

• The incident or evidence-handling procedure, showing collection steps, authorised custodians and retention rules.
• A completed custody log from a real incident or a tabletop.
• Hash records and imaging logs wherever digital acquisition has happened.
• The DFIR firm's contract, NDA and credentials, proving the specialist route was arranged in advance.
• Notes showing system condition was recorded at capture, plus secure-storage records for held items.

Certification bodies tend to grade gaps by consequence. A real incident in which material the organisation needed was demonstrably not preserved is the breakdown case and grades major. An absent procedure with no incident history, an unsigned custody log or an expired DFIR retainer is more likely a minor finding, though a pattern of them can aggregate to major.

Run one tabletop, complete the custody log and keep the retainer current, and the auditor has real artefacts to sample.

Frequently asked questions