What is "chain of custody" and why does it matter during incident reporting?

Chain of custody is the documented, unbroken record of who collected, handled and stored each piece of evidence — so it can be used in court.

If an incident might lead to legal action (prosecuting an attacker, an insurance claim, a regulatory case), the evidence is only useful if you can prove it was not tampered with. Logging every transfer and access — who, what, when, where — preserves that integrity. Break the chain and even genuine evidence can be thrown out. This is why forensic evidence must be collected carefully and methodically from the very start of an incident.

Go deeper:

• Chain of custody (Wikipedia) — the legal chain-of-custody concept behind digital forensics: documenting custody, control, transfer and analysis so evidence is admissible.