home/glossary/Chain of custody

Chain of custody

nounverified·updated May 9, 2026

A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.

MWENISTIR 7298: Glossary of Key Information Security Terms, Revision 2

Senses

SANS Glossary of Security Terms

Chain of Custody is the important application of the Federal rules of evidence and its handling.

ISACA Cybersecurity Glossary

A legal principle regarding the validity and integrity of evidence. It requires accountability for anything that will be used as evidence in a legal proceeding to ensure that it can be accounted for from the time it was collected until the time it is presented in a court of law. Scope Note: Includes documentation as to who had access to the evidence and when, as well as the ability to identify evidence as being the exact item that was recovered or tested. Lack of control over evidence can lead to it being discredited. Chain of custody depends on the ability to verify that evidence could not have been tampered with. This is accomplished by sealing off the evidence, so it cannot be changed, and providing a documentary record of custody to prove that the evidence was at all times under strict control and not subject to tampering.

Classifications

Entity Type

Process92%llm-generatedllm:claude-haiku-4-5
?unassignedlast reviewed

Sensitivity

Regulated85%llm-generatedllm:claude-haiku-4-5
?unassignedlast reviewed

Information Class

unclassified

Variants

plural
Chain of custodies
possessive
Chain of custody's
pluralpossessive
Chain of custodies'