SIST EN ISO/IEC 27037:2017 PDF

Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012)

Title (English):

SIST EN ISO/IEC 27037:2017

Information technology - Security techniques - Guidelines for identification, collection, acquisition and preservation of digital evidence (ISO/IEC 27037:2012)

Document status:: Active
Format:: Electronic (PDF)
Number of pages:: 48
Publication date:: November 14, 2016
Edition:: ISO/IEC 27037:2012
ICS:: 35.030

Document language:

enru

Delivery time:1–7 days

Price:97 €

Description (English):

ISO/IEC 27037:2012 provides guidelines for specific activities in the handling of digital evidence, which are identification, collection, acquisition and preservation of potential digital evidence that can be of evidential value. It provides guidance to individuals with respect to common situations encountered throughout the digital evidence handling process and assists organizations in their disciplinary procedures and in facilitating the exchange of potential digital evidence between jurisdictions. ISO/IEC 27037:2012 gives guidance for the following devices and circumstances: Digital storage media used in standard computers like hard drives, floppy disks, optical and magneto optical disks, data devices with similar functions, Mobile phones, Personal Digital Assistants (PDAs), Personal Electronic Devices (PEDs), memory cards, Mobile navigation systems, Digital still and video cameras (including CCTV), Standard computer with network connections, Networks based on TCP/IP and other digital protocols, and Devices with similar functions as above. The above list of devices is an indicative list and not exhaustive.

Technical details

Technical committee: ITC - Information technology
SKU: SIST EN ISO/IEC 27037:2017

Abstract

Overview

EN ISO/IEC 27037:2016 (ISO/IEC 27037:2012) provides guidelines for identification, collection, acquisition and preservation of digital evidence. Published by CEN as the European adoption of ISO/IEC 27037, it sets out practical, non-prescriptive guidance to ensure the integrity and authenticity of potential digital evidence from a wide range of devices and environments. The standard helps organizations and practitioners manage digital evidence in ways that support legal admissibility, cross-jurisdiction exchange, and internal disciplinary procedures.

Key Topics

Scope of digital evidence: covers digital storage media, standard computers, mobile phones, PDAs/PEDs, memory cards, navigation systems, digital still/video cameras (including CCTV), networked devices and other similar devices.
Core processes: clear guidance for the four key stages - identification, collection, acquisition, and preservation of potential digital evidence.
Principles and requirements: emphasizes auditability, repeatability, reproducibility, and justifiability of handling methods to maintain evidential value.
Chain of custody: detailed guidance on documenting custody, transfers, and handling to preserve integrity and provenance.
On-site precautions: procedures for securing incident sites, protecting personnel, and identifying potential digital evidence.
Roles, responsibilities and competency: defines responsibilities for Digital Evidence First Responders (DEFRs), Digital Evidence Specialists (DESs), incident responders and forensic managers; highlights required skills and training.
Documentation and briefing: minimum documentation requirements for evidence transfer and clear briefing practices for real-time incidents.
Device- and context-specific guidance: practical notes for computers, storage media, networked devices and CCTV systems; packaging and transport considerations.

Applications

Digital forensics and incident response teams use EN ISO/IEC 27037 to standardize evidence handling and improve court admissibility of digital evidence.
Organizations apply the guidance in internal investigations, HR disciplinary processes, and when coordinating cross-border evidence exchange.
Forensic laboratories and legal decision‑makers rely on the standard to assess the reliability and integrity of presented digital evidence.
IT security and risk teams integrate the guidelines to improve readiness for incident containment and evidence preservation.

Related Standards (if applicable)

EN ISO/IEC 27037 is part of the broader ISO/IEC 27000-series on information security. Organizations often align evidence-handling procedures with ISO/IEC 27001/27002 information security management controls and incident response policies.

Keywords: EN ISO/IEC 27037:2016, ISO/IEC 27037:2012, digital evidence, digital forensics, identification collection acquisition preservation, chain of custody, incident response.

Related standards

Mentioned in the description and other SIST standards

Abstract

Overview

Key Topics

Scope of digital evidence: covers digital storage media, standard computers, mobile phones, PDAs/PEDs, memory cards, navigation systems, digital still/video cameras (including CCTV), networked devices and other similar devices.
Core processes: clear guidance for the four key stages - identification, collection, acquisition, and preservation of potential digital evidence.
Principles and requirements: emphasizes auditability, repeatability, reproducibility, and justifiability of handling methods to maintain evidential value.
Chain of custody: detailed guidance on documenting custody, transfers, and handling to preserve integrity and provenance.
On-site precautions: procedures for securing incident sites, protecting personnel, and identifying potential digital evidence.
Roles, responsibilities and competency: defines responsibilities for Digital Evidence First Responders (DEFRs), Digital Evidence Specialists (DESs), incident responders and forensic managers; highlights required skills and training.
Documentation and briefing: minimum documentation requirements for evidence transfer and clear briefing practices for real-time incidents.
Device- and context-specific guidance: practical notes for computers, storage media, networked devices and CCTV systems; packaging and transport considerations.

Applications

Digital forensics and incident response teams use EN ISO/IEC 27037 to standardize evidence handling and improve court admissibility of digital evidence.
Organizations apply the guidance in internal investigations, HR disciplinary processes, and when coordinating cross-border evidence exchange.
Forensic laboratories and legal decision‑makers rely on the standard to assess the reliability and integrity of presented digital evidence.
IT security and risk teams integrate the guidelines to improve readiness for incident containment and evidence preservation.

Related Standards (if applicable)

EN ISO/IEC 27037 is part of the broader ISO/IEC 27000-series on information security. Organizations often align evidence-handling procedures with ISO/IEC 27001/27002 information security management controls and incident response policies.

Keywords: EN ISO/IEC 27037:2016, ISO/IEC 27037:2012, digital evidence, digital forensics, identification collection acquisition preservation, chain of custody, incident response.

SIST EN ISO/IEC 27037:2017 PDF

Technical details

Abstract

Overview

Key Topics

Applications

Related Standards (if applicable)

Related standards

Abstract

Overview

Key Topics

Applications

Related Standards (if applicable)

Related standards

Information technology — Security techniques — Guidelines for identification, collection, acquisition and pre…

Information security, cybersecurity and privacy protection - Information security management systems - Overvi…

Method to calculate GHG emissions at LNG plant (ISO 6338:2023)

Additive manufacturing of metals - Powder bed fusion (PBF) - In-situ coaxial photodiode monitoring for lack o…

Facility management - Development of the facility management organization (ISO 41002:2026)

Rigid cellular plastics - Determination of compressive properties (ISO 844:2026)

Processing of health care products - Information to be provided by the medical device manufacturer for the pr…

Ophthalmic optics - Uncut finished spectacle lenses - Part 4: Specifications and test methods for the propert…