管理者は、従業員が財務データをポータブル ハード ドライブにコピーし、そのデータを持って会社を退職したというインシデントに対応しました。管理者は証拠の移動を文書化しました。管理者が実証した概念は次のうちどれですか?
正解:A
Preserving chain of custody is a concept that refers to the documentation and tracking of who handled, accessed, modified, or transferred a piece of evidence, when, where, why, and how. Preserving chain of custody can help establish the authenticity, integrity, and reliability of the evidence, as well as prevent tampering, alteration, or loss of the evidence. An administrator who documented the movement of the evidence demonstrated the concept of preserving chain of custody. Implementing data protection policies, informing law enforcement, and creating a summary of the incident are not concepts that describe the action of documenting the movement of the evidence.