What should be done to preserve evidence during an SCI security incident?

• A. Preserve evidence and follow investigation procedures
• B. Delete evidence after incident
• C. Move evidence to non-secure area
• D. Share evidence with coworkers

Answer: (A)

Preserving evidence and following established investigation procedures is essential when an SCI security incident occurs. Evidence must be kept in its original state, time-stamped, and its handling documented to maintain the chain of custody. Adhering to the incident response plan helps ensure that the data and devices involved aren’t altered or destroyed, which allows investigators to accurately reconstruct what happened, determine the root cause, and support any subsequent actions or remediation. This approach also protects sensitive information and ensures accountability within the security program.

Deleting evidence would erase critical information needed for analysis and accountability. Moving evidence to a non-secure area risks exposure, tampering, or loss and breaks the chain of custody. Sharing evidence with coworkers without proper authorization breaches need-to-know requirements and can compromise confidentiality and integrity. By preserving evidence and following procedures, you maintain integrity, security, and a clear, auditable trail for the investigation.