ISO/IEC 27037:2012
How to find, take, copy and keep potential digital evidence so it stays intact and authentic and can be relied on later: relevance, reliability and sufficiency; auditable, repeatable, reproducible and justified handling; a chain of custody record from the first moment; scene security, safety and evidence risk assessment; competent first responders and specialists, properly briefed; volatile data captured first; verified copies with master and working sets; tamper-evident packaging, controlled storage and escorted transport; and device-specific handling for stand-alone computers and storage media, networked and mobile devices, and CCTV. 52 guidance leaves read against the complete English text.
ISO/IEC 27037:2012 is a compliance framework from International (ISO/IEC JTC 1/SC 27) with 3 domains and 52 controls that map to 4 other frameworks. The largest domains are Clause 7: Instances by device type – ISO/IEC 27037:2012 (22 controls), Clause 6: Key components of evidence handling – ISO/IEC 27037:2012 (18 controls), Clause 5: Overview, principles and handling processes – ISO/IEC 27037:2012 (12 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are AI-assisted interpretations for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Clause 5: Overview, principles and handling processes – ISO/IEC 27037:2012
| Code | Title |
|---|---|
| iso-iec-27037-2012::5.1 | 5.1 Context for collecting digital evidence |
| iso-iec-27037-2012::5.2 | 5.2 Principles of digital evidence |
| iso-iec-27037-2012::5.3.1 | 5.3.1 General |
| iso-iec-27037-2012::5.3.2 | 5.3.2 Auditability |
| iso-iec-27037-2012::5.3.3 | 5.3.3 Repeatability |
| iso-iec-27037-2012::5.3.4 | 5.3.4 Reproducibility |
| iso-iec-27037-2012::5.3.5 | 5.3.5 Justifiability |
| iso-iec-27037-2012::5.4.1 | 5.4.1 Overview |
| iso-iec-27037-2012::5.4.2 | 5.4.2 Identification |
| iso-iec-27037-2012::5.4.3 | 5.4.3 Collection |
| iso-iec-27037-2012::5.4.4 | 5.4.4 Acquisition |
| iso-iec-27037-2012::5.4.5 | 5.4.5 Preservation |
Clause 6: Key components of evidence handling – ISO/IEC 27037:2012
| Code | Title |
|---|---|
| iso-iec-27037-2012::6.1 | 6.1 Chain of custody |
| iso-iec-27037-2012::6.2.1 | 6.2.1 General |
| iso-iec-27037-2012::6.2.2 | 6.2.2 Personnel |
| iso-iec-27037-2012::6.2.3 | 6.2.3 Potential digital evidence |
| iso-iec-27037-2012::6.3 | 6.3 Roles and responsibilities |
| iso-iec-27037-2012::6.4 | 6.4 Competency |
| iso-iec-27037-2012::6.5 | 6.5 Use reasonable care |
| iso-iec-27037-2012::6.6 | 6.6 Documentation |
| iso-iec-27037-2012::6.7.1 | 6.7.1 General |
| iso-iec-27037-2012::6.7.2 | 6.7.2 Digital evidence specific |
| iso-iec-27037-2012::6.7.3 | 6.7.3 Personnel specific |
| iso-iec-27037-2012::6.7.4 | 6.7.4 Real-time incidents |
| iso-iec-27037-2012::6.7.5 | 6.7.5 Other briefing information |
| iso-iec-27037-2012::6.8 | 6.8 Prioritizing collection and acquisition |
| iso-iec-27037-2012::6.9.2 | 6.9.2 Preserving potential digital evidence |
| iso-iec-27037-2012::6.9.3.1 | 6.9.3.1 Baseline activities: packaging of potential digital evidence |
| iso-iec-27037-2012::6.9.3.2 | 6.9.3.2 Additional activities: packaging of potential digital evidence |
| iso-iec-27037-2012::6.9.4 | 6.9.4 Transporting potential digital evidence |
Clause 7: Instances by device type – ISO/IEC 27037:2012
| Code | Title |
|---|---|
| iso-iec-27037-2012::7.1.1.1 | 7.1.1.1 Physical incident scene search and documentation |
| iso-iec-27037-2012::7.1.1.2 | 7.1.1.2 Non-digital evidence collection |
| iso-iec-27037-2012::7.1.1.3 | 7.1.1.3 Decision-making process for collection or acquisition |
| iso-iec-27037-2012::7.1.2.1.2 | 7.1.2.1.2 Baseline activities: powered on digital device collection |
| iso-iec-27037-2012::7.1.2.1.3 | 7.1.2.1.3 Additional activities: powered on digital device collection |
| iso-iec-27037-2012::7.1.2.2.2 | 7.1.2.2.2 Baseline activities: powered off digital device collection |
| iso-iec-27037-2012::7.1.2.2.3 | 7.1.2.2.3 Additional activities: powered off digital device collection |
| iso-iec-27037-2012::7.1.3.1.1 | 7.1.3.1.1 Overview |
| iso-iec-27037-2012::7.1.3.1.2 | 7.1.3.1.2 Baseline activities: powered on digital device acquisition |
| iso-iec-27037-2012::7.1.3.1.3 | 7.1.3.1.3 Additional activities: powered on digital device acquisition |
| iso-iec-27037-2012::7.1.3.2.2 | 7.1.3.2.2 Acquisition of powered off digital device |
| iso-iec-27037-2012::7.1.3.3 | 7.1.3.3 Mission-critical digital devices |
| iso-iec-27037-2012::7.1.3.4 | 7.1.3.4 Partial acquisition |
| iso-iec-27037-2012::7.1.3.5 | 7.1.3.5 Digital storage media |
| iso-iec-27037-2012::7.1.4 | 7.1.4 Preservation |
| iso-iec-27037-2012::7.2.1.1 | 7.2.1.1 Overview |
| iso-iec-27037-2012::7.2.1.2 | 7.2.1.2 Physical incident scene search and documentation |
| iso-iec-27037-2012::7.2.2.1 | 7.2.2.1 Overview |
| iso-iec-27037-2012::7.2.2.2 | 7.2.2.2 Guidelines for networked device collection |
| iso-iec-27037-2012::7.2.2.3 | 7.2.2.3 Guidelines for networked device acquisition |
| iso-iec-27037-2012::7.2.2.4 | 7.2.2.4 Guidelines for networked device preservation |
| iso-iec-27037-2012::7.3 | 7.3 CCTV collection, acquisition and preservation |
Your Compliance Coverage
If you comply with ISO/IEC 27037:2012, you already cover:
Maps to 4 other frameworks
Coverage is not the same as your position
This page shows what ISO/IEC 27037:2012 overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is ISO/IEC 27037:2012 and who does it apply to?
ISO/IEC 27037:2012 is a compliance framework from International (ISO/IEC JTC 1/SC 27) with 3 domains and 52 controls. How to find, take, copy and keep potential digital evidence so it stays intact and authentic and can be relied on later: relevance, reliability and sufficiency; auditable, repeatable, reproducible and justified handling; a chain of custody record from the first moment; scene security, safety and evidence risk assessment; competent first responders and specialists, properly briefed; volatile data captured first; verified copies with master and working sets; tamper-evident packaging, controlled storage and escorted transport; and device-specific handling for stand-alone computers and storage media, networked and mobile devices, and CCTV. 52 guidance leaves read against the complete English text. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does ISO/IEC 27037:2012 actually require?
ISO/IEC 27037:2012 has 52 controls organised across 3 domains. The largest domains are Clause 7: Instances by device type – ISO/IEC 27037:2012 (22 controls), Clause 6: Key components of evidence handling – ISO/IEC 27037:2012 (18 controls), Clause 5: Overview, principles and handling processes – ISO/IEC 27037:2012 (12 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of ISO/IEC 27037:2012 do I already cover?
ISO/IEC 27037:2012 maps to 4 other compliance frameworks. The top mapping partners are ISO/IEC 27043:2015 (92% coverage), ISO 27002:2022 (21% coverage), ISO/IEC 27042:2015 (12% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement ISO/IEC 27037:2012?
Start your ISO/IEC 27037:2012 compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about ISO/IEC 27037:2012 requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 52 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 727 frameworks.
Get Started Free →Free forever — no credit card required