If civil litigation is a goal for an organizational response to a security incident, the PRIMARY step should be to:

When an organization anticipates civil litigation following a security incident, ensuring the admissibility of evidence in a court of law is paramount. The primary step to achieve this is maintaining and documenting a strict chain of custody. The chain of custody provides a chronological, verifiable paper trail that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. Without a documented chain of custody, opposing legal counsel can easily challenge the integrity, authenticity, and reliability of the evidence, rendering it inadmissible in court. Proper forensic procedures must prioritize this documentation from the very moment evidence is identified and collected.

A: Contacting law enforcement is typically associated with criminal investigations, whereas civil litigation is a private legal dispute between organizations or individuals. C: Standard server-backup utilities modify file metadata (such as access times) and do not create the forensically sound bit-by-bit images required for legal evidence. D: Rebooting affected machines destroys highly valuable volatile data stored in RAM and alters the system state, violating core digital forensic principles.

- ISACA CISM Review Manual, 15th Edition, Chapter 4: Information Security Incident Management, Section 4.8 Incident Response Phases, pp. 245-247.

- NIST Special Publication 800-86, Guide to Integrating Forensic Techniques into Incident Response, Section 3.1.2 Chain of Custody.