Your two-person security team has no evidence room — which custody controls do you mandate for intrusion cases?

## The real constraint A two-person team will handle a small number of cases a year where custody actually matters, has no evidence room, no dedicated storage, no full-time examiner, and no practice at doing any of it. The failure mode is not ignorance of good practice — it is a procedure written to look complete, never rehearsed, and abandoned in the first hour of a real intrusion. The design goal is therefore *the smallest set of controls that survives contact with a real case*, not the most thorough set. ## 1. Define the trigger before the controls The first decision is what invokes the procedure at all. Something like: a declared intrusion; any matter where an employee is a subject; anything involving a supplier or contract dispute; anything a regulator or insurer may examine; anything counsel touches. Everything below the line gets an ordinary case record and no custody form. This is a genuine tradeoff and it should be stated as one. Draw the line too low and analysts perform custody theatre on phishing reports until they stop doing it at all. Draw it too high and the one case that mattered was handled without it. Reviewing where the line actually fell — after the fact, against the cases that arose — is more valuable than getting it right on paper first. ## 2. One form, used identically every time A single custody form, printed, living in the runbook and in the kit, with fixed fields: item identifier, date/time and timezone, released by, received by, reason, location, seal number and state, two signatures. The value of *one* form is that it does not have to be recalled or designed under pressure. A team that improvises a custody record during an incident produces records that differ case to case, and the differences are what a receiving examiner asks about. ## 3. Attributable storage, not an evidence room You cannot buy a room. What you can achieve is **attributable access**: one lockable container, a single named keyholder rather than a shared key in a drawer, and a record of every opening. A cheap cabinet with one accountable holder is materially more defensible than an expensive safe whose combination six people know. Tamper-evident bags with numbered seals are the other high-value, low-cost item, because they let you say something concrete about a container even when the surrounding record is thin. ## 4. A note store whose clock you do not own A local document that the author can edit without trace makes the record's timing an assertion by the person with the most interest in it. Writing notes into the ticketing system, an append-only case log or any store with independent server-side timestamps means the *when* is corroborated by something other than the note itself. This costs nothing and removes an entire category of challenge. ## 5. Originals sealed, work on copies Seal the original, store it, and do the work on a duplicate. For a small team this is as much operational hygiene as evidential discipline: it is what stops the only copy of the material being altered by an analyst learning a tool in the middle of a case. ## 6. Agree the handoff before you need it This is the control small teams most reliably lack, and the one that breaks first. Before any incident, settle with the retained IR firm and with counsel: who is authorised to release material and who signs for it at the far end; what custody documentation they expect and in what form; how material physically moves — courier, encrypted transfer, hand delivery — and what proof of transfer comes back; and where the boundary sits between your work and theirs. Negotiating this at 02:00 with an unfamiliar examiner is precisely when items get handed over unsigned. Then rehearse it once, on something harmless. A transfer that has never been performed is the transfer that fails. ## 7. Know when not to touch it The most defensible action available to a two-person team is frequently to stop, preserve and hand over. Examination performed by someone without practice, using tools they do not know well, on the only copy, generates limitations that no amount of custody paperwork repairs. Writing that boundary into the procedure — these categories go to the firm before we examine them — is a leadership decision, not a technical one, and it is one of the few that visibly improves outcomes. ## Keeping it alive between cases With three qualifying cases a year, the procedure decays. Countermeasures are unglamorous: the form lives inside the incident runbook rather than in a separate document nobody opens; the kit — bags, seals, marker, printed forms, a spare drive — is a physical box that is checked on a schedule; and one short dry run a year, ideally as part of an existing exercise, where somebody actually completes a form and moves a sealed item. If the procedure has never been executed, assume it does not exist. ## What you are explicitly choosing not to do State the omissions rather than leaving them implicit: no dedicated evidence room, no full-time examiner, no in-house capability for certain classes of examination, and a trigger line below which no custody record is kept at all. A procedure that is honest about its limits is one people follow. A procedure that claims capabilities the team does not have fails in the first real case, and the failure is discovered by the person on the other side of the handoff.