Chain of Custody
Chain of custody is the chronological record of who collected, handled, transferred, and stored security evidence—supporting integrity and legal defensibility.
Chain of Custody
Definition
Chain of custody is the chronological record documenting who collected, accessed, transferred, analyzed, and stored a piece of evidence—and when each action occurred.
It extends Provenance with explicit custodian accountability, critical for legal, regulatory, and high-severity incident scenarios.
SentriScope Usage
Routine SOC investigations may use lightweight provenance; legal hold or forensic escalation increases chain-of-custody rigor. Investigation governance: KID-INV-0001.
Related Terms
- Provenance —
KID-GLS-0014 - Evidence Integrity —
KID-GLS-0017 - Evidence —
KID-GLS-0001
Related Knowledge
- Evidence Lifecycle —
KID-CON-0015 - Evidence in Audit and Compliance —
KID-CON-0018