What are essential steps to preserve evidence during an incident involving a security breach?

• A. Close the incident area and keep everyone out until cleared.
• B. Secure the area, limit access, document all activities, and follow agency evidence-handling procedures.
• C. Immediately delete unrelated logs to speed up review.
• D. After the incident, collect evidence and then share publicly.

Answer: (B)

Preserving evidence during a security breach hinges on controlling the scene, keeping data intact, and following established procedures so the investigation can be trusted and effective. Securing the area and limiting access prevents tampering and accidental contamination of physical evidence and digital data. Documenting every action and change in the scene creates a clear, auditable timeline, showing who did what, when, and why, which is essential for a reliable reconstruction and for maintaining the chain of custody. Following agency evidence-handling procedures ensures consistent labeling, storage, transfer, and preservation of evidence, so it remains admissible and verifiable in investigations or reviews. Together, these steps protect the integrity of the evidence, support a thorough investigation, and help maintain safety.

Other approaches fall short because simply closing the area without proper documentation or procedures can leave gaps in the record; deleting logs destroys potential evidence and undermines the investigation; and collecting evidence after the fact and publicizing details prematurely can reveal vulnerabilities and compromise both investigation and safety.