Topic-specific policies
ISO/IEC 27043

Search this site

ISMS templates

< Previous standard      ^ Up a level ^      Next standard >


ISO/IEC 27043:2015 — Information technology — Security techniques — Incident investigation principles and processes (first edition)



“ISO/IEC 27043:2015 provides guidelines based on idealized models for  common incident investigation processes across various incident  investigation scenarios involving digital evidence. ...”
[Source: ISO/IEC 27043:2015]


The fundamental purpose of the digital forensics standards ISO/IEC 27037, 27041, 27042, 27043 and 27050 is to promote good practice methods and processes for forensic capture and investigation of digital evidence. While individual investigators, organisations and jurisdictions may well retain certain methods, processes and controls, it is hoped that standardization will (eventually) lead to the adoption of similar if not identical approaches internationally, making it easier to compare, combine and contrast the results of such investigations even when performed by different people or organisations and potentially across different jurisdictions.


Scope and purpose

The standard concerns the principles behind, and the forensic processes involved in, investigating incidents.


Status of the standard

The standard was first published in 2015 and confirmed unchanged in 2020.


Related standards

ISO/IEC 27037 concerns the initial capturing of digital evidence.

ISO/IEC 27041 offers guidance on the assurance aspects of digital forensics e.g. ensuring that the appropriate methods and tools are used properly.

ISO/IEC 27042 covers what happens after digital evidence has been collected i.e. its analysis and interpretation.

This standard covers the broader incident investigation activities, within which forensics usually occur.

ISO/IEC 27050 (in 4 parts) concerns electronic discovery ... which is pretty much what the other standards cover.

British Standard BS 10008:2008 “Evidential weight and legal admissibility of electronic information. Specification.” may also be of interest.


Personal comments

I am puzzled why SC 27 publishes and maintains several distinct forensics standards covering different aspects of forensics, when they are in reality complementary parts of the same process. A multi-part standard would make more sense to me, with an overview (conventionally “part 1”) explaining how the jigsaw pieces fit together.


< Previous standard      ^ Up a level ^      Next standard >

Copyright © 2024 IsecT LtdContact us re Intellectual Property Rights