Question

A cloud forensics investigator at a financial services firm is collecting log data from a CSP-managed SIEM to support an anticipated fraud lawsuit. To ensure the collected logs will be admissible and defensible in court, which control is MOST critical for the investigator to establish and document throughout the collection and handling process?

Accepted Answer

An unbroken chain of custody with cryptographic hashing of each log artifact at the point of collection

Answer

A data retention schedule that keeps the logs for at least seven years to satisfy regulatory minimums

Answer

Tokenization of any personally identifiable information contained within the log entries before review

Answer

Encryption of the log repository at rest using customer-managed keys stored in an HSM