After a system was hacked by an outsider, a technician is dispatched to the system. The technician records the location of the system on a log and then signs the system over to a tier-two…

Evidence preservation refers to maintaining the integrity and state of evidence (e.g., disk imaging), not the documented transfer process between individuals.

Process documentation describes recording general procedures and steps taken, not the formal chain of handoffs between accountable parties.

Due process is a legal right to fair treatment under the law and does not describe the physical transfer and logging of evidence between custodians.

Chain of custody requires that every transfer of evidence be logged with signatures, timestamps, and identities of all parties involved to ensure evidence integrity and admissibility. The scenario explicitly describes each handoff being signed, which is the core requirement of maintaining an unbroken custody record. This practice ensures that no unauthorized access or tampering can occur without detection.