Why is preserving evidence important after a security incident?

• A. It has no impact on investigations.
• B. It speeds up retirement benefits.
• C. Preserving evidence helps maintain integrity of the investigation and possible legal proceedings.
• D. It delays the incident response.

Answer: (C)

Preserving evidence is essential because it keeps the investigation credible and usable in any legal process. When a security incident occurs, data can be altered, deleted, or overwritten as systems keep running. Capturing and safeguarding evidence promptly, and doing so in a way that preserves the original state, establishes a solid chain of custody and prevents tampering. This intact evidence lets investigators accurately reconstruct what happened, when it happened, how it happened, and who was involved, which is crucial for both resolving the incident and pursuing any legal action if needed. It also helps prevent spoliation, ensuring that conclusions and any resulting remedies are based on reliable information. Proper preservation can be integrated into incident response without unduly delaying containment, by following established forensics procedures and using proven tools.