What is the PRIMARY reason to maintain the chain of custody on evidence that has been collected?

A.
To ensure that no evidence is lost.

B.
To ensure that all possible evidence is gathered.

C.
To ensure that it will be admissible in court

D.
To ensure that incidents were handled with due care and due diligence.

Explanation:
Real evidence, like any type of evidence, must meet the relevancy, materiality, and competency requirements
before being admitted into court. In many cases, it is not possible for a witness to uniquely identify an object in
court. In those cases, a chain of evidence (also known as a chain of custody) must be established.
Incorrect Answers:
A: Chain of custody is not used to avoid loss of evidence. It is used to ensure that evidence can be admitted.
B: Chain of custody is not used to ensure that all possible evidence is collected. It is used to ensure that
evidence can be admitted.
D: Chain of custody concern evidence, it does not concern incidents.

Stewart, James M., Ed Tittel, and Mike Chapple, CISSP: Certified Information Systems Security Professional
Study Guide, 5th Edition, Sybex, Indianapolis, 2011, p. 704