ISO/IEC 27043
ISO/IEC 27043:2015 — Information technology — Security techniques — Incident investigation principles and processes
(first edition)
Abstract
“ISO/IEC 27043:2015 provides guidelines based on idealized models for common incident investigation processes across various incident investigation scenarios involving digital evidence. ...”
[Source: ISO/IEC 27043:2015]
Introduction
The fundamental purpose of the digital forensics standards ISO/IEC 27037, ISO/IEC 27041, ISO/IEC 27042, ISO/IEC 27043 and ISO/IEC 27050 is to promote good practice methods and processes for forensic capture and investigation of digital evidence. While individual investigators, organisations and jurisdictions may well retain certain methods, processes and controls, it is hoped that standardisation will (eventually) lead to the adoption of similar if not identical approaches internationally, making it easier to compare, combine and contrast the results of such investigations even when performed by different people or organisations and potentially across different jurisdictions.
Scope
The standard concerns the principles behind, and the forensic processes involved in, investigating digital incidents.
Structure
Main sections:
5: Digital investigations
6: Digital investigation processes
7: Readiness processes
8: Initialization processes
9: Acquisitive processes
10: Investigative processes
11: Concurrent processes
12: Digital investigation process model schema
Annex A: Digital investigation processes: motivation for harmonization
Status
The current first edition was published in 2015 and confirmed unchanged in 2020.
Commentary
I am puzzled why SC 27 publishes and maintains several distinct forensics standards covering different aspects of forensics, when they are in reality complementary parts of the same process:
ISO/IEC 27037 concerns the initial capturing of digital evidence.
ISO/IEC 27041 offers guidance on the assurance aspects of digital forensics e.g. ensuring that the appropriate methods and tools are used properly.
ISO/IEC 27042 covers what happens after digital evidence has been collected i.e. its analysis and interpretation.
This standard covers the broader incident investigation activities, within which forensics usually occur.
ISO/IEC 27050 (in 4 parts) concerns electronic discovery ... which is pretty much what the other standards cover.
British Standard BS 10008 “Evidential weight and legal admissibility of electronically stored information (ESI), Specification.” may also be of interest.
A multi-part standard would make more sense to me, with a “part 1” overview explaining how the jigsaw pieces fit together.