Which action is essential when handling evidence at a security incident?

• A. Preserve the scene
• B. Avoid contamination
• C. Photograph or document if possible
• D. Maintain chain of custody

Answer: (D)

Maintaining the chain of custody is essential because it provides a documented, unbroken trail of evidence from collection through analysis, storage, and presentation. This record shows exactly who handled the evidence, when and where it moved, and why each transfer occurred, which helps prove that no tampering or contamination happened. In a security incident, the credibility of the evidence hinges on this provenance—investigators and courts need to trust that the items are in the same condition as when first observed and that any changes are fully accounted for.

While preserving the scene, avoiding contamination, and photographing or documenting the initial state are important practical steps, they only have value if their results are integrated into a transparent chain of custody. The chain of custody ties all actions together, ensuring the evidence remains as-is or that any alterations are properly documented, thereby maintaining its integrity and admissibility.