← ISO 27001 · A.5 — Organisational
A.5.28 — Collection of evidence
medium
incident-responseloggingrecords
Requirement
The organisation shall establish and implement procedures for the identification, collection, acquisition and preservation of evidence related to information security events.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Required element 1 — any one of
evidenceforensicpreservechain of custody
Supporting terms — specificity signals
immutablelog retentionsnapshotlegal holdtimeline
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| SOC 2 | CC2.1 | Quality information for internal control | logging records |
| GDPR | Art.5(2) | Accountability | records |
| GDPR | Art.30 | Records of processing activities | records |
| GDPR | Art.33 | Notification of a breach to the supervisory authority | incident-response |
| CCPA/CPRA | Regs 7101 | Records of consumer requests kept for 24 months | records |
| SOC 2 | CC7.2 | Monitoring for anomalies | logging |
| SOC 2 | CC7.3 | Evaluation of security events | incident-response |
| SOC 2 | CC7.4 | Incident response programme | incident-response |