ISO/IEC 27037.

What ISO/IEC 27037 governs

ISO/IEC 27037 is the international guideline for the first and most fragile phase of any digital investigation: getting hold of the evidence without destroying it. It sits inside the broader ISO/IEC 27000 family alongside ISO/IEC 27001, but where 27001 tells you how to run a management system, 27037 tells your responders exactly how to handle a running server, a seized laptop, a phone, or a cloud account so that what you capture can later stand up to scrutiny. It covers four activities in sequence: identifying potential digital evidence, collecting physical devices, acquiring data from them, and preserving both the devices and the copies through to handover.

The standard introduces two roles that practitioners come back to constantly. The Digital Evidence First Responder (DEFR) is the person on the scene who decides what to seize and how. The Digital Evidence Specialist (DES) has the deeper technical skill to handle the awkward cases, such as live systems, encrypted volumes, or unusual hardware. Both are expected to document every decision, because the value of digital evidence rests less on the bytes themselves and more on whether you can prove they were not altered.

Chain of custody and the principles behind it

27037 rests on a handful of principles that reappear in every credible forensic method. Acquired evidence should be relevant, reliable, and sufficient. Actions taken on the original should be kept to the minimum necessary and fully justified. Anyone competent should be able to repeat the process and reach the same result, which is why imaging tools, write blockers, and verification hashes matter so much. The thread that ties it together is chain of custody: a continuous, documented record of who held the evidence, what they did with it, and when, from the moment of collection until it is presented.

• Identification: recognising what could be evidence, from disks and phones to volatile memory and network captures.
• Collection: removing devices from the scene, with the order of volatility deciding what you capture first.
• Acquisition: producing a verifiable copy, typically a forensic image validated by a cryptographic hash.
• Preservation: protecting the original and the copies against alteration, loss, or contamination.

Where it fits in incident response and the wider family

In practice 27037 is the bridge between detecting an incident and being able to do anything useful with the artefacts afterwards. An internal SOC that pulls a disk image the wrong way, or wipes volatile memory by rebooting a compromised host, can detect an attacker perfectly and still end up with evidence no court or regulator will trust. That is why it is read alongside the incident management guidance in ISO/IEC 27035 and the controls of ISO/IEC 27001 Annex A. The discipline is the same whether the goal is a criminal prosecution, an employment dispute, an insurance claim, or simply an internal report that survives challenge.

For practitioners the takeaway is procedural, not theoretical. Decide in advance who your DEFR and DES are, give them validated tools, write the chain-of-custody form before you need it, and rehearse the order of volatility so nobody reboots the one machine that mattered. When an investigation goes wrong it is almost never the analysis that fails. It is the first hour, which is exactly the hour 27037 is written about.