Home/BoK/Templates/Chain of Custody Log Template
Back to Hub
Last Reviewed: 2026-06-25
Reviewer Role: Insider Risk / Legal / Privacy review
Advanced Asset
Investigation ModuleInteractive Sheet

Chain of Custody Log Template

A chain of custody log documents who collected, transferred, accessed, analyzed, stored, or disposed of evidence.

Primary Audience & Scope

Investigators, Legal, forensic teams, security operations

When to Use

  • •Triage, investigation, preservation, containment, or legal review is required.
  • •A consistent record is needed across teams.
  • •A matter may require later review, audit, or legal defensibility.

Interactive Work Area

Fill or track items interactively and copy out to your Clipboard

Template Table Structure

FieldWorking prompt
Case/resource field 1Use this field to document: Assign unique evidence ID.
Case/resource field 2Use this field to document: Describe evidence item.
Case/resource field 3Use this field to document: Record source, custodian, collector, date, and time.
Case/resource field 4Use this field to document: Record collection method.
Case/resource field 5Use this field to document: Record hash or integrity check where applicable.
Case/resource field 6Use this field to document: Record every transfer with sender, recipient, date, time, and purpose.
Case/resource field 7Use this field to document: Record storage location and access controls.
Case/resource field 8Use this field to document: Record analysis copies separately.

Checklist Audit List

0% Done(0/10)
Check
Checklist item

Assign unique evidence ID.

Evidence: Owner / date / evidence

Describe evidence item.

Evidence: Owner / date / evidence

Record source, custodian, collector, date, and time.

Evidence: Owner / date / evidence

Record collection method.

Evidence: Owner / date / evidence

Record hash or integrity check where applicable.

Evidence: Owner / date / evidence

Record every transfer with sender, recipient, date, time, and purpose.

Evidence: Owner / date / evidence

Record storage location and access controls.

Evidence: Owner / date / evidence

Record analysis copies separately.

Evidence: Owner / date / evidence

Record final disposition.

Evidence: Owner / date / evidence

Retain log with case record.

Evidence: Owner / date / evidence

What Completion Looks Like

  • 1Decision documented.
  • 2Owner assigned.
  • 3Evidence and actions recorded.
  • 4Scope and authority preserved.
  • 5Follow-up action created where needed.

Insider Risk Capability Framework™ (IRCF™) Alignment

Primary IRCF™ Component
Investigation
Programmatic RelevanceSupports consistent, defensible handling of insider risk matters.
Non-legal-advice Compliance NoteThis resource is a planning aid and does not provide legal advice. Organizations should adapt it to their policies, jurisdictions, labor obligations, privacy requirements, contracts, and risk appetite. Sensitive monitoring, investigation, employment, evidence, legal hold, and employee-data activities should be reviewed by appropriate Legal, Privacy, HR, Compliance, and labor stakeholders before use.

Operationalize This Template in RiskTKO®

Use RiskTKO® or request ITMG® support to adapt this template, align it to the Insider Risk Capability Framework™, and connect the output to measurable exposure reduction. Legal Hold Checklist

Request an Insider Risk AssessmentSee RiskTKO® in Action