Evidence is consistently preserved and chain of custody maintained during incident investigation
Preserving evidence and recording chain of custody consistently is the process leg of A.5.28, one facet among policy and automated capture. It gives incident response what to preserve during investigations but supports the control rather than covering the full scope alone.