An administrator responded to an incident where an employee copied financial data to a portable hard drive and then left the company with the data. The administrator documented the movement of the…

Preserving the chain of custody involves meticulously documenting every person who handled evidence, when they handled it, and where it was stored, ensuring its integrity and admissibility in legal or disciplinary proceedings.

Implementing data protection policies occurs proactively to prevent incidents, whereas preserving chain of custody is a reactive measure taken during incident response.

Informing law enforcement is a potential action in an incident, but it is distinct from the administrative task of documenting evidence movement.

Creating a summary of the incident is a report, which might include chain of custody details, but it is not the act of documenting the movement of evidence itself.