home/glossary/Chain of custody

Chain of custody

nounid 1790·updated May 9, 2026
candidate

A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.

MWE

Classifications

Entity Type

Process92%llm-generatedllm:claude-haiku-4-5

Sensitivity

Regulated85%llm-generatedllm:claude-haiku-4-5

Information Class

unclassified

Variants

plural
Chain of custodies
possessive
Chain of custody's
pluralpossessive
Chain of custodies'

Framework definitions

SANS Glossary of Security Terms1 senseview framework →
§1
Chain of Custody is the important application of the Federal rules of evidence and its handling.
ISACA Cybersecurity Glossary1 senseview framework →
§1
A legal principle regarding the validity and integrity of evidence. It requires accountability for anything that will be used as evidence in a legal proceeding to ensure that it can be accounted for from the time it was collected until the time it is presented in a court of law. Scope Note: Includes documentation as to who had access to the evidence and when, as well as the ability to identify evidence as being the exact item that was recovered or tested. Lack of control over evidence can lead to it being discredited. Chain of custody depends on the ability to verify that evidence could not have been tampered with. This is accomplished by sealing off the evidence, so it cannot be changed, and providing a documentary record of custody to prove that the evidence was at all times under strict control and not subject to tampering.
NISTIR 7298: Glossary of Key Information Security Terms, Revision 21 senseview framework →
§1
A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.
CNSSI-4009 (Glossary of Information Assurance Terms)1 senseview framework →
§1
A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.
NIST SP 800-721 senseview framework →
§1
A process that tracks the movement of evidence through its collection, safeguarding, and analysis lifecycle by documenting each person who handled the evidence, the date/time it was collected or transferred, and the purpose for the transfer.

Outgoing relationships

No outgoing triples
This term is not the subject of any RDF-style relationship yet.

Incoming relationships

No incoming triples
No other term currently asserts a relationship to this one.