Which of the following needs to be documented to preserve evidences for presentation in court?

Separation of duties is an access control policy that divides responsibilities among individuals to prevent fraud, not a mechanism for preserving evidence.

An incident response policy outlines procedures for handling incidents but is not itself a record that documents the handling and custody of physical or digital evidence.

Chain of custody is the documented, chronological record showing who collected, handled, transferred, and stored evidence at every stage. Without this documentation, evidence integrity can be challenged in court, potentially rendering it inadmissible. It is a foundational legal and forensic requirement in any incident investigation intended for prosecution.

Account lockout policy is a security configuration that limits failed login attempts and has no role in evidential documentation for legal proceedings.