ISO/IEC 27035 Evidence Log Template

Give the incident a stable identifier and identify the log owner, access classification, time zone, and system of record. Capture the original event report, detection and reporting times, validation, incident decision, category, severity, affected assets and services, coordinator, assigned responders, hypotheses, decisions, actions, results, communications, evidence references, recovery checks, conclusion, and follow-up owners.

Use one append-only chronology. Each entry should contain an entry identifier, timestamp and time source, author or system, entry type, factual description, confidence or uncertainty where relevant, related asset or service, decision or action owner, approval, result, and links to supporting records. Preserve original timestamps and separate observed facts from assumptions and later corrections.

The event report should capture when, what, how, and, if known, why the event occurred; the reporter; initial affected components; business impact; and any identified vulnerability. If the event becomes an incident, add the incident category, affected information, hardware, software, communications, documentation, or processes; recovery cost where the organization tracks it; actions taken, planned, and outstanding; internal and external notifications; resolution; and conclusion. Mark unknown fields as unknown rather than guessing.

Create a separate evidence item record for material collected files, exports, images, devices, memory captures, logs, malware samples, or other potential digital evidence. The incident log should reference the evidence identifier and relevant action, not duplicate the evidence or expose sensitive content to every log reader.

For each item, record what it is, its source and owner, who identified or collected it, collection or acquisition method, date and time, tool and version where relevant, integrity information, storage location, access restriction, transfers, analysis copies, and disposition. Apply the organization's investigation and evidence procedures; ISO/IEC 27037 gives more detailed guidance for identifying, collecting, acquiring, and preserving potential digital evidence.

The incident coordinator is accountable for a complete management record, but responders, monitoring teams, service owners, communications staff, suppliers, and specialists should enter or supply records for their own work. Identify an evidence custodian when potential evidence needs controlled handling. Define alternates so logging continues across shifts and absences.

Restrict access by role and incident sensitivity. Protect personal data, credentials, vulnerabilities, legal advice, investigation material, supplier information, and other sensitive content. Give responders enough access to act, while using references or separated restricted records when broad disclosure would create risk.

A weak log mixes facts, assumptions, actions, and later conclusions in one rewritten narrative. That prevents a reviewer from seeing what responders knew at a decision point. Preserve the chronology, identify the source of each material fact, append corrections, and record why the team changed course.

Another failure is treating the log as the evidence repository. Pasting credentials, personal data, malware, or large raw exports into the chronology can increase access and integrity risks. Store protected material in the approved location and reference it by stable identifier.

At conclusion, record the closure authority, recovery acceptance, final severity and scope, required reports and their status, evidence disposition, continuing monitoring, unresolved risk, corrective-action owners, and final-report location. Lock or otherwise protect the completed chronology according to the organization's record-control procedure while allowing traceable supplements.

Set retention and disposition from applicable law, regulation, contracts, litigation or investigation holds, privacy requirements, and organizational policy. ISO/IEC 27035 does not prescribe one universal retention period. Restrict lessons-learned extracts to the information needed for improvement, awareness, metrics, or management review.