Standards and frameworks · Incident management / CSIRT
ISO/IEC 27037, 27041, 27042 e 27043 Digital evidence and incident investigation
PublishedPaid ·
Standards are protected by copyright and almost always sold: here you find metadata, an original summary and a link to the official catalogue page where they can be consulted or bought. The text is not reproduced.
Summary
The four standards cover the whole digital forensics path, from first response at the incident scene to presenting the findings. ISO/IEC 27037 explains how to identify, collect, acquire and preserve potential digital evidence (disks, phones, cameras, networked systems) without altering it and while documenting the chain of custody. ISO/IEC 27042 deals with analysing and interpreting evidence, ISO/IEC 27041 with showing that investigative methods and tools are suitable and validated, and ISO/IEC 27043 with the overall model of investigation processes. They help CSIRTs, corporate investigators, police forces and expert witnesses keep evidence usable in disciplinary or court proceedings, including across jurisdictions.
Parts of the series
| Reference | Official title | Published |
|---|---|---|
| ISO/IEC 27037:2012 (opens in a new tab) | Guidelines for identification, collection, acquisition and preservation of digital evidence | |
| ISO/IEC 27041:2015 (opens in a new tab) | Guidance on assuring suitability and adequacy of incident investigative method | |
| ISO/IEC 27042:2015 (opens in a new tab) | Guidelines for the analysis and interpretation of digital evidence | |
| ISO/IEC 27043:2015 (opens in a new tab) | Incident investigation principles and processes |
Related laws and documents
Related standards
Metadata and summary: CC BY 4.0 · JSON