How does evidence preservation for legal hold influence incident response timelines?

• A. It has no effect on timelines
• B. It requires timely collection and retention of evidence regardless of other actions; ensures compliance and prevents spoliation
• C. It requires disabling all containment until hold is released
• D. It requires immediate deletion of logs to preserve chain of custody

Answer: (B)

Preserving evidence under a legal hold makes timely collection and retention a non‑negotiable part of incident response. When a hold is in place, you must identify what data could be relevant and capture it in a way that preserves its integrity from the moment you become aware of the incident. This means avoiding any actions that could destroy or alter evidence, maintaining a strict chain of custody, and coordinating with legal and compliance teams to determine what must be preserved and where it should be stored.

Because of this, the incident response timeline is influenced by the need to gather and securely retain evidence early and continuously, even as you work on containment and remediation. This ensures you meet legal obligations, prevents spoliation, and avoids liabilities later on. Containment actions may still occur to limit impact, but they must be performed with an eye toward not compromising the preserved evidence and with proper documentation.

So, preserving evidence for a legal hold requires timely collection and retention of evidence regardless of other actions, aligning with compliance needs and protecting the integrity of the investigation.