RS.AN-07:

Incident data and metadata are collected, and their integrity and provenance are preserved

Implementation Examples

Ex1:

Collect, preserve, and safeguard the integrity of all pertinent incident data and metadata (e.g., data source, date/time of collection) based on evidence preservation and chain-of-custody procedures