org.cispec.custody-chain
required: evidence Change Itemsorg.cispec.custody-chain records the chronological custody record for
a Change Item handled as digital evidence — who collected it, who has
held it, and any transfers, consistent with the identification,
collection, acquisition, and preservation processes described in
ISO/IEC 27037:2012.
This term attests preservation integrity — that custody has been tracked and the record is unbroken. It does not attest findings or interpretation; that remains a human, certified function outside this specification’s scope.
Value format
A structured value referencing the custody record (a hash chain, a log reference, or a pointer to the organisation’s own evidence-management system). This specification does not mandate a specific encoding.
org.cispec.custody-chain=sha256:9f86d0...:case-2026-0142
Conformance
org.cispec.custody-chain is REQUIRED for evidence Change Items
intended for external verification — audit, regulatory, or
court-admissible use.
Document identifier
OID: 1.3.6.1.4.1.42387.5
GUID: 99ac3fc9-035d-58b9-99e2-41969039a970