Glossary: Security Operations and Incident Response

Chain of custody

Also written: chain of custody form

A written record of every person who handled a piece of evidence, with signed and timed handoffs from collection to court. A gap, such as a laptop left on a desk overnight with no record, can lead a court to reject the evidence.