After an incident, people may need to understand what happened, why decisions were made, and what was changed. An evidence bundle helps answer those questions. It is a controlled collection of relevant records, rather than a large folder of screenshots with no explanation.
Understand the idea
Choose records that support specific facts: original alerts, relevant logs, a timeline, affected systems, decisions, and correction results. Record who collected each item, when, and from where. Limit access and unnecessary personal information. Keep originals separate from working notes and explain any known gaps.
- Question
Identify the actions and systems you need to understand.
- Preserve
Keep appropriate original records and collection context.
- Handle
Document access, copies, retention, and disposal decisions.
A practical example
Imagine a team investigating an unwanted account change. It keeps the provider’s original export, records how it was obtained, and adds a timeline linking the change to the response actions. A later reviewer can follow the sources without needing the original responder to retell the story.
What to do next
- Collect for a purpose. Choose original records that answer the incident questions. Note the source, collection time, method, and person collecting them.
- Keep a clear timeline. Record event times and time zones, response actions, approvals, and known uncertainty.
- Protect originals. Use controlled storage and access. Keep working analysis separate and avoid unnecessary copies of personal information.
- Explain the gaps. List missing records and unverified assumptions. Let the responsible legal or privacy adviser direct any relevant handling requirements.
How to check the result
Ask another authorized person to locate a fact and trace it back to its source. Where legal or regulatory obligations may apply, involve the appropriate adviser in scope, handling, and retention decisions.
Is a screenshot enough evidence of the event?
It can be useful, but it may omit timestamps, queries, identities, and surrounding events. Preserve the underlying record where appropriate and document what the screenshot represents.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
