The company has a formal approach to preserving evidence when a security incident occurs
A written approach to preserving evidence touches the same incident lifecycle but serves evidence collection rather than the detection and response planning this control covers.
Writing down what to capture first, who may handle evidence, and when to call in specialists sets policy. A.5.28 needs evidence identified, collected and kept usable, which this written commitment supports but does not itself perform.