Which statement about chain of custody in EOCA incident documentation is correct?

Which statement about chain of custody in EOCA incident documentation is correct?

• A. The chain of custody refers to the chain of command in EOCA operations.
• B. The documented, secure transfer of evidence and artifacts from one person to another to preserve integrity.
• C. The documented process for labeling and inventorying all tools on site.
• D. The method for releasing evidence to the public after analysis.

Answer: (B)

Chain of custody is the documented, verifiable trail that records who handled evidence or artifacts, when, where, and under what conditions, to preserve its integrity and authenticity. In EOCA incident documentation, this means capturing every transfer of evidence from collection through storage and analysis, including the people involved, timestamps, locations, and any changes in its state or custody. Maintaining this trail with secure handling, proper seals, and secure storage prevents tampering or contamination and ensures the evidence can be trusted and admissible if needed. This is why the statement describing secure transfer of evidence to preserve integrity is the correct fit. It isn’t about who commands the team, nor about labeling all tools, nor about releasing information to the public—the focus is specifically on keeping a trustworthy record of possession and handling of evidence.

Chain of custody is the documented, verifiable trail that records who handled evidence or artifacts, when, where, and under what conditions, to preserve its integrity and authenticity. In EOCA incident documentation, this means capturing every transfer of evidence from collection through storage and analysis, including the people involved, timestamps, locations, and any changes in its state or custody. Maintaining this trail with secure handling, proper seals, and secure storage prevents tampering or contamination and ensures the evidence can be trusted and admissible if needed. This is why the statement describing secure transfer of evidence to preserve integrity is the correct fit. It isn’t about who commands the team, nor about labeling all tools, nor about releasing information to the public—the focus is specifically on keeping a trustworthy record of possession and handling of evidence.