ISO/IEC 27037:2012 PDF

Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence

First page of standard ISO/IEC 27037:2012

Open preview (PDF)

Title (English):

ISO/IEC 27037:2012

Information technology — Security techniques — Guidelines for identification, collection, acquisition and preservation of digital evidence

Document status:: Active
Format:: Electronic (PDF)
Number of pages:: 38
Publication date:: October 15, 2012
Edition:: ISO/IEC IS 27037 edition 1 version 1
ICS:: 35.030

Delivery type:

Full version25 €Read online 24h10 €Read online 72h15 €

Document language:

enru

Delivery time:Immediate download

Price:25 €

Description (English):

ISO/IEC 27037:2012 provides guidelines for specific activities in the handling of digital evidence, which are identification, collection, acquisition and preservation of potential digital evidence that can be of evidential value. It provides guidance to individuals with respect to common situations encountered throughout the digital evidence handling process and assists organizations in their disciplinary procedures and in facilitating the exchange of potential digital evidence between jurisdictions. ISO/IEC 27037:2012 gives guidance for the following devices and circumstances: Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto optical disks, data devices with similar functions, Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards, Mobile navigation systems, Digital still and video cameras (including CCTV), Standard computer with network connections, Networks based on TCP/IP and other digital protocols, and Devices with similar functions as above. The above list of devices is an indicative list and not exhaustive.

Technical details

Technical committee: ISO/IEC JTC 1/SC 27 - Information security, cybersecurity and privacy protection
SKU: ISO/IEC 27037:2012

Abstract

Overview

ISO/IEC 27037:2012 - Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence - provides internationally recognized, practical guidance for handling potential digital evidence. The standard focuses on the four core processes of digital evidence handling: identification, collection, acquisition and preservation, with the objective of maintaining integrity and supporting admissibility in legal or disciplinary contexts. It is device-agnostic and applies to a wide range of sources (e.g., hard drives, mobile phones, PDAs, memory cards, CCTV, networked systems and other digital storage/media).

Key technical topics and requirements

Core processes: Clear guidance on identification, collection, acquisition (creating verified copies), and preservation of potential digital evidence.
Principles of evidence handling: Emphasis on auditability, repeatability, reproducibility, and justifiability of procedures.
Chain of custody: Documenting custody, transfer, and controls to preserve integrity and provenance.
Site precautions and evidence packaging: Guidance for first responders on securing scenes, handling personnel, packaging, transporting and storing digital devices.
Roles, responsibilities and competency: Definitions for Digital Evidence First Responders (DEFRs), Digital Evidence Specialists (DESs), incident responders and forensic lab managers, plus competency considerations.
Documentation and briefing: Minimum documentation requirements for evidence transfer, plus briefing practices for real-time incidents and personnel-specific needs.
Prioritization and preservation strategies: How to prioritize volatile vs. non-volatile data and preserve evidence across physical devices and networked environments.
Device- and context-specific notes: Practical instances covering computers, peripheral devices, digital storage, networked devices, CCTV and related systems.
Non-prescriptive tools approach: The standard defines methodology and competency expectations but does not mandate specific tools or software.

Practical applications and who uses it

ISO/IEC 27037 is used for:

Incident response teams and digital forensics practitioners establishing defensible collection and preservation procedures.
Digital Evidence First Responders (DEFRs) and Digital Evidence Specialists (DESs) as operational guidance during investigations.
Forensic laboratory managers and internal investigators developing policies that support legal or disciplinary proceedings.
Organizations implementing forensic readiness and integrating digital evidence handling into their information security programs.
Legal and compliance teams assessing the reliability and provenance of digital evidence across jurisdictions.

Keywords: ISO/IEC 27037, digital evidence, digital forensics, evidence preservation, chain of custody, incident response, forensic readiness.

Related standards

ISO/IEC 27001 and ISO/IEC 27002 (information security management controls)
ISO/IEC 17025 and ISO/IEC 17020 (laboratory and inspection competence)
ISO/TR 15801 (trustworthiness of electronic information storage)

Note: ISO/IEC 27037 complements these standards, does not cover analysis procedures or jurisdiction-specific admissibility rules, and must be applied in compliance with local laws.

Related standards

Standards mentioned in the description

Abstract

Overview

Key technical topics and requirements

Core processes: Clear guidance on identification, collection, acquisition (creating verified copies), and preservation of potential digital evidence.
Principles of evidence handling: Emphasis on auditability, repeatability, reproducibility, and justifiability of procedures.
Chain of custody: Documenting custody, transfer, and controls to preserve integrity and provenance.
Site precautions and evidence packaging: Guidance for first responders on securing scenes, handling personnel, packaging, transporting and storing digital devices.
Roles, responsibilities and competency: Definitions for Digital Evidence First Responders (DEFRs), Digital Evidence Specialists (DESs), incident responders and forensic lab managers, plus competency considerations.
Documentation and briefing: Minimum documentation requirements for evidence transfer, plus briefing practices for real-time incidents and personnel-specific needs.
Prioritization and preservation strategies: How to prioritize volatile vs. non-volatile data and preserve evidence across physical devices and networked environments.
Device- and context-specific notes: Practical instances covering computers, peripheral devices, digital storage, networked devices, CCTV and related systems.
Non-prescriptive tools approach: The standard defines methodology and competency expectations but does not mandate specific tools or software.

Practical applications and who uses it

ISO/IEC 27037 is used for:

Incident response teams and digital forensics practitioners establishing defensible collection and preservation procedures.
Digital Evidence First Responders (DEFRs) and Digital Evidence Specialists (DESs) as operational guidance during investigations.
Forensic laboratory managers and internal investigators developing policies that support legal or disciplinary proceedings.
Organizations implementing forensic readiness and integrating digital evidence handling into their information security programs.
Legal and compliance teams assessing the reliability and provenance of digital evidence across jurisdictions.

Keywords: ISO/IEC 27037, digital evidence, digital forensics, evidence preservation, chain of custody, incident response, forensic readiness.

Related standards

ISO/IEC 27001 and ISO/IEC 27002 (information security management controls)
ISO/IEC 17025 and ISO/IEC 17020 (laboratory and inspection competence)
ISO/TR 15801 (trustworthiness of electronic information storage)

Note: ISO/IEC 27037 complements these standards, does not cover analysis procedures or jurisdiction-specific admissibility rules, and must be applied in compliance with local laws.

ISO/IEC 27037:2012 PDF

Technical details

Abstract

Overview

Key technical topics and requirements

Practical applications and who uses it

Related standards

Related standards

Abstract

Overview

Key technical topics and requirements

Practical applications and who uses it

Related standards

Related standards

Information technology - Security techniques - Guidelines for identification, collection, acquisition and pre…

Information security, cybersecurity and privacy protection - Information security management systems - Requir…

Health informatics - Information security controls in health based on ISO/IEC 27002 (ISO 27799:2025)

Gas analysis - Contents of certificates for calibration gas mixtures - Amendment 1: Cross reference list to I…

Conformity assessment — Requirements for bodies performing inspection

Document management — Information stored electronically — Recommendations for trustworthiness and reliability