A cloud administrator has received a physical disk that was analyzed by the incident response team. Which of the following documents should the cloud administrator update?

Chain of custody is the formal record that tracks every transfer, possession, and handling of physical evidence throughout its lifecycle, including receipt from an incident response team. Updating it when the disk is returned ensures an unbroken, legally defensible audit trail. Failing to document this transfer would compromise the integrity of the evidence and any findings derived from it.

Incident taxonomy is used to classify and categorize incident types, not to track the physical handling or transfer of evidence.

A risk register documents identified organizational risks and their mitigation status, not the custody or movement of forensic evidence.

An incident playbook contains predefined response procedures and workflows, not a log of who physically possessed evidence at each point in time.