Key Facts
- Regulator
- ISO/IEC JTC 1/SC 27 (published by ISO and IEC)
- Latest version
- ISO/IEC 27037:2012, Edition 1 (Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence)
- Effective
- 15 October 2012
- Official text
- www.iso.org ↗
What is ISO/IEC 27037?
ISO/IEC 27037, often searched as ISO 27037, is the international standard of guidelines for handling potential digital evidence: identification, collection, acquisition and preservation. ISO and IEC publish it through committee JTC 1/SC 27. It is aimed at individuals dealing with evidence in common situations, and at organisations running disciplinary procedures or exchanging evidence between jurisdictions.
The current version is ISO/IEC 27037:2012, Edition 1, Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO catalogue entry). ISO last reviewed and confirmed it in 2018 and states that "this version remains current". A further review closed on 3 December 2023 (stage 90.60), and ISO shows no revision project.
The short version of the ISO/IEC 27037 digital evidence guidelines: it is a handling process in four activities, not a management system. It covers how potential evidence is treated so that it keeps its evidential value. Analysis and reporting are not among the four activities it names.
Why it matters
The disciplinary case rests on a laptop, and three people have already opened it.
ISO/IEC 27037 matters because it names the stages where potential digital evidence is kept or lost.
Two situations bring most readers to it:
- Disciplinary and internal matters. A documented approach to identification, collection, acquisition and preservation gives you something to point to when someone asks how the evidence was handled.
- Evidence crossing borders. When potential evidence moves between jurisdictions, a shared international reference gives both sides common terms for how it was handled.
Evidence handled informally is hard to defend afterwards.
Who it applies to
In practice, ISO/IEC 27037 is for the people who first touch a device that may matter later: IT and security staff, HR and legal teams running an internal case, and the forensic providers they bring in.
- Who should look at it: anyone who may have to find, copy or hold digital evidence for a disciplinary matter or a cross-border request.
- Who usually doesn't need it: firms that never handle evidence, and teams whose only concern is securing their own systems, where ISO 27001 is the usual reference.
Obligation. ISO publishes ISO/IEC 27037 as guidelines. The ISO page does not make it a legal requirement, and the sources we checked show no law or regulator requiring it. Treat it as voluntary unless a contract, an instructing party or an internal policy names it.
ISO 27001 and ISO/IEC 27037 come from the same committee, JTC 1/SC 27, but do different jobs: ISO 27001 is a management system, while ISO/IEC 27037 is a handling process for evidence. The nearest Annex A control is A.5.28 Collection of evidence, which expects procedures for handling evidence of security events; ISO/IEC 27037 is guidance you can draw on when you write them.
The UK position
A UK firm rarely meets ISO/IEC 27037 as a requirement. We found no UK statute or regulator that names it. The closest UK regime is the statutory Forensic Science Regulator. Its guidance collection is for anyone who performs forensic science activities, and includes method validation in digital forensics (FSR-G-218). That page does not cite ISO/IEC 27037, so treat the overlap in subject matter as context, not a requirement. BSI publishes the standard in the UK as BS EN ISO/IEC 27037:2016, with text identical to ISO/IEC 27037:2012.
Key requirements
ISO/IEC 27037 organises its guidelines around four activities in handling potential digital evidence. This summary follows the public ISO abstract; the detailed requirements sit in the paywalled text.
- Identification. Recognising which items and data might hold potential evidence.
- Collection. Gathering the devices or media that hold it.
- Acquisition. Creating a copy of the data.
- Preservation. Keeping the potential evidence intact so that it retains evidential value.
All four serve one aim: potential digital evidence "that can be of evidential value".
A forensic tool is not a process. ISO/IEC 27037 describes the process.
Devices and circumstances covered
The scope names a range of devices and circumstances:
- storage media;
- mobile phones;
- cameras, including CCTV;
- networked computers;
- TCP/IP networks.
ISO says this list is indicative, not exhaustive.
Frequently asked questions
The ISO catalogue page for ISO/IEC 27037 shows no certification scheme. The standard gives guidelines for handling potential digital evidence; it is not a management system like ISO 27001, which organisations are certified against. If a provider advertises "ISO 27037 certification", ask exactly what is assessed, and by whom.
No. ISO/IEC 27037 is published as guidelines, and we found no UK statute or regulator that names it. ISO/IEC 27037 becomes binding only when someone writes it in, such as a client contract or an investigator's terms of engagement. A firm can also name it in its own incident or disciplinary policy, so staff know which method to follow before a case starts.
ISO/IEC 27037:2012 is the current edition. The 2016 date on EN ISO/IEC 27037:2016 and BS EN ISO/IEC 27037:2016 is when the European and British adoptions were published, not a new edition: BSI states its version is identical to ISO/IEC 27037:2012. Cite the 2012 edition, or the national adoption if a contract names that one.
No. ISO/IEC 27037 is not part of ISO 27001, and an ISO 27001 certification audit does not assess you against it. Under A.5.28, an auditor looks at your own evidence procedure. Following ISO/IEC 27037 is one way to write that procedure, and it adds handling detail, such as how to acquire a copy of data, that ISO 27001 leaves to you.
No. ISO/IEC 27037 covers the steps up to and including preservation. Analysis and interpretation sit in ISO/IEC 27042:2015, assurance that investigative methods are suitable sits in ISO/IEC 27041:2015, and the wider investigation process sits in ISO/IEC 27043:2015. All three belong to the same "Security techniques" series as ISO/IEC 27037, and a full forensic procedure can draw on all four.