CISM Certified Information Security Manager – Question1508

When responding to an incident, which of the following is required to ensure evidence remains legally admissible in court?

A.
Law enforcement oversight
B. Chain of custody
C. A documented incident response plan
D. Certified forensics examiners

Correct Answer: B