← ISO 27001 Annex A in plain English

A.5.28 A.5

Organizational / A.5.28

Collecting and preserving evidence

Think of it likePhotographing the damage before starting to clear it up.

In plain English

The family preserves what happened before tidying it away, because the evidence is usually destroyed by the clean-up rather than by the incident.

Related CSF and CIS controls (unofficial mapping)