ISO/IEC 27043:2015 — Information technology — Security techniques — Incident investigation principles and processes
The fundamental purpose of the digital forensics standards ISO/IEC 27037, 27041, 27042, 27043 and 27050 is to promote good practice methods and processes for forensic capture and investigation of digital evidence. While individual investigators, organizations and jurisdictions may well retain certain methods, processes and controls, it is hoped that standardization will (eventually) lead to the adoption of similar if not identical approaches internationally, making it easier to compare, combine and contrast the results of such investigations even when performed by different people or organizations and potentially across different jurisdictions.
Scope and purpose
The standard concerns the principles behind, and the forensic processes involved in, investigating incidents.
“provides guidelines that encapsulate idealized models for common incident investigation processes across various incident investigation scenarios involving digital evidence. This includes processes from pre-incident preparation up to and including returning evidence for storage or dissemination as well as any general advice and caveats on such processes. The guidelines describe processes and principles applicable to various kinds of investigations ... In summary, this International Standard provides a general overview of all incident investigation principles and processes without prescribing particular details.”
[quoted from the DIS version]
Status of the standard
The standard was published in 2015.
ISO/IEC 27037 concerns the initial capturing of digital evidence.
ISO/IEC 27041 offers guidance on the assurance aspects of digital forensics e.g. ensuring that the appropriate methods and tools are used properly.
ISO/IEC 27042 covers what happens after digital evidence has been collected i.e. its analysis and interpretation.
This standard covers the broader incident investigation activities, within which forensics usually occur.
ISO/IEC 27050 (in 4 parts) concerns electronic discovery ... which is pretty much what the other standards cover.
British Standard BS 10008:2008 “Evidential weight and legal admissibility of electronic information. Specification.” may also be of interest.
I am puzzled why SC 27 is developing several distinct forensics standards, covering different aspects of forensics, when they are in reality complementary parts of the same process. A multi-part standard would make more sense to me, with the normal overview (part 1) explaining how the jigsaw pieces fit together.