Maintaining the chain of custody is an important part of the incident response process. Which of the following reasons explains why this is important?

While incident response aligns with information security policies, maintaining the chain of custody specifically addresses evidence integrity rather than policy maintenance.

Properly identifying the issue is an early step in incident response, but the chain of custody focuses on the subsequent handling and preservation of evidence gathered.

The chain of custody is a meticulously documented process that tracks the handling, transfer, and storage of evidence from the moment it is collected until it is presented in court or otherwise disposed of, ensuring its authenticity and preventing tampering. This unbroken record proves that the evidence has not been altered or compromised, making it admissible and credible in legal proceedings.

Gathering as much information as possible is part of the investigation phase, but the chain of custody specifically ensures the integrity and admissibility of that collected information, not just the quantity.