Chain of Custody Policy

Download as docx, pdf, or txt
Download as docx, pdf, or txt
You are on page 1of 7

Chain of Custody Policy

Version: 1.0
Last Updated: 04/20/2020
DCN: VMD-CON-019

Confidential and Proprietary – All Rights Reserved

Approval Date: 04/20/2020


Approved By: CON
DCN: VMD-CON-019
Version: 2.0
Chain of Custody Policy
Version: 2.0
Approved By: CON, 04/20/2020

Table of Contents
1 Policy Statement................................................................................................................................1

2 Purpose..............................................................................................................................................1

3 Scope.................................................................................................................................................1

4 Policy.................................................................................................................................................1
4.1 Collection......................................................................................................................................................... 1

4.2 Control of Evidence..........................................................................................................................................2

4.3 Proof of Custody...............................................................................................................................................2

Appendices..................................................................................................................................................1
Appendix A: Acronyms and Key Terms..........................................................................................................................1

List of Tables
Table 1: Acronyms and Key Terms..................................................................................................................................1

List of Figures
No table of figures entries found.

VMD-CON-019 Confidential and Proprietary – All Rights Reserved i


Printed copy valid for 24 hours from time of printing unless otherwise indicated “CONTROLLED COPY”.
Date printed 2/18/21 1:02 a2/p2
Chain of Custody Policy
Version: 2.0
Approved By: CON, 04/20/2020

Revision History
Rev. # Release Date Author Reviewer(s) Approver Description of Change
1.0 04/17/20 J. Weiss Baseline version of document
2.0 06/30/20 S. Hyland Update to reflect re-branding

VMD-CON-019 Confidential and Proprietary – All Rights Reserved ii


Printed copy valid for 24 hours from time of printing unless otherwise indicated “CONTROLLED COPY”.
Date printed 2/18/21 1:02 a2/p2
Chain of Custody Policy
Version: 2.0
Approved By: CON, 04/20/2020

1 Policy Statement
The Chain of Custody Policy ensures that evidence (both digital and physical) has been properly and legitimately
gathered and protected in line with the organization’s best practices.

2 Purpose
The law is clear that all evidence, both physical and digital is held to the same standard of duty to preserve. The duty
to preserve is triggered when a party reasonably foresees that evidence may be relevant to issues in litigation. In
those instances, VMD has a duty to preserve all evidence in VMD’s “possession, custody, or control,” and we know
that generally, evidence is considered to be within the corporation’s “control” when the party has the legal authority
and practical ability to access it.

3 Scope
This policy applies to all VMD employees, contractors, and third-party employees.

4 Scope

4.1 Employees
This policy applies to all VMD employees, contractors, and third-party employees.

4.2 Documentation
The documentation shall consist of a Chain of Custody Policy and related procedures and guidelines including
security requirements stated in federal regulations.

4.3 Document Control


The Chain of Custody Policy document and all other referenced documents shall be controlled. Version control shall
be used to preserve the latest release and the previous version of any document.

4.4 Records
Records being generated as part of the Chain of Custody Policy shall be retained for a period of time deemed
appropriate by the MRB and done so in accordance with corporate records management procedure. Records shall be
in hard copy or electronic media. The records shall be owned by the Contracts Department and shall be audited
annually.

4.5 Distribution and Maintenance


The Chain of Custody Policy document shall be made available to all concerned persons. All changes and new
releases of this document shall be made available to all concerned persons upon approval. The maintenance
responsibility of the document shall be with the Director of Contracts. Access to this policy shall be incorporated
into all supplier agreements and shall be certified to at the beginning of each relationship, and audited annually for
compliance with all legal, regulatory, and necessary security requirements.

VMD-CON-019 Confidential and Proprietary – All Rights Reserved 1


Printed copy valid for 24 hours from time of printing unless otherwise indicated “CONTROLLED COPY”.
Date printed 2/18/21 1:02 a2/p2
Chain of Custody Policy
Version: 2.0
Approved By: CON, 04/20/2020

5 Privacy
The Chain of Custody Policy document shall be considered as “non-confidential” and shall be made available to all
concerned persons. Subsequent changes and versions of this document shall be controlled.

6 Policy
The VMD Director of Contracts is responsible for the Chain of Custody Policy. In addition, the organization should
ensure compliance and enforce the requirements of the agreements with corporate oversight by the MRB. Any
deficiencies that arise will be reported through monthly review with the Director of Quality and documented with
action created for response and correction. The following protocols must be adhered to following an incident to
ensure a proper chain of custody is properly maintained.

6.1 Collection
This is the identification, recording and the gathering of information from credible sources that maintain the
integrity of the information and evidence gathered. Data must be carefully documented upon initial collection.
 Completely fill out the chain of custody form with necessary date and proper signatures
 Isolated storage areas for evidence with proper labelling (i.e., model, and serial number)
 If digital, a second copy must be made for analysis and the original left untampered
 Proper release and disclosure agreements for the lawful owner of evidenced and witnesses
Chain of custody documents should include everything pertinent about the information. This includes the date the
information was collected, the location, the individual who collected it, the owner of the data, and more. eDiscovery
chain of custody documents may include the reason that the data was collected and detailed information about the
physical location of the data, such as the serial number of a hard drive.
Changes and transfers to the data must be documented at all times. Log with proper timeline and signatures as to
who has had possession and who has examined the data to date and what changes were made. The chain of custody
must include any transfers and copies of the data, eventually holding a complete history of the data following its
collection. Thorough notes should be taken regarding any interactions with the data, to ensure that nothing is missed.
Collect and preserve all metadata attributes.
If feasible special software should always be used to preserve as much of the original data of the file as possible.
That includes metadata, which may identify when a document was last modified and by who. Metadata attributes
can be easily overwritten or forgotten if the data is transferred by someone unaware of their relevance. Do not use
‘copy and paste’ when preserving information as it can affect this metadata and risk the chain of custody.

6.2 Control of Evidence


When not being analyzed, data must be kept in a central repository for all eDiscovery information, regardless of the
file format. Through this, employees of VMD tasked with management will be able to ensure that the chronological
history of each file is accurate. The eDiscovery platform will also be able to detect and prevent any potential
alterations to these files.
 Examination: Data can be collected in two ways - automated and manual. Examiners for VMD will carve
out information that will be used during proceedings. While performing this action, all aspects of the
process and results of the investigation must be recorded and noted with explicit detail.

VMD-CON-019 Confidential and Proprietary – All Rights Reserved 2


Printed copy valid for 24 hours from time of printing unless otherwise indicated “CONTROLLED COPY”.
Date printed 2/18/21 1:02 a2/p2
Chain of Custody Policy
Version: 2.0
Approved By: CON, 04/20/2020

 Analysis: Investigators for VMD will use justifiable methods to decrypt useful information that resulted
from the examination to answer the questions that arise in a specific case. While performing the final
analysis, all processes applied, and conclusions reached must be noted and recorded with explicit detail.
 Reporting: The documentation of the analysis and examination stages must then be collected and reported.
Reporting must a statement regarding the chain of custody, an explanation of the tools used, and any issues
and vulnerabilities that were identified.

6.3 Proof of Custody


What must be answered in the final report to prove chain of custody:
 Where is the proof?
 How did you acquire it?
 When was it gathered?
 Who handled it?
 Why did that specific person handle it?
Information governance and record management for compliance and legal is complicated and intricate. Poor
management of the eDiscovery chain of custody could lead to serious issues in litigation and jeopardize the results
of the case. Strictly adhering to the steps stated in this policy will mitigate risk of a chain of custody being rendered
invalid.

7 Enforcement
The VMD Contracts Department verifies compliance to this policy through various methods, including but not
limited to, periodic internal and external audits, and reviews.
Any exception to the policy must be approved by the Director of Contracts in advance.
A relationship or agreement not in compliance with the guidelines set out in this policy risks being terminated is
immediate corrective action is not taken.

VMD-CON-019 Confidential and Proprietary – All Rights Reserved 3


Printed copy valid for 24 hours from time of printing unless otherwise indicated “CONTROLLED COPY”.
Date printed 2/18/21 1:02 a2/p2
Chain of Custody Policy
Version: 2.0
Approved By: CON, 04/20/2020

Appendices

Appendix A: Acronyms and Key Terms


The following tables present the definitions for acronyms and key terms used in this document.

Table 1: Acronyms

Acronym / Term Definition


CON Contracts
VMD VMD Corp.

Table 2: Key Terms

Acronym / Term Definition


Buy / Outsource Item A “buy / outsource” item is any item or work effort to be purchased by VMD that is not produced
or performed by VMD or its affiliates, subsidiaries, or divisions.
Contract A binding written agreement between VMD and a third party which sets forth the terms and
conditions of a business relationship. Contracts include, but are not limited to contracts,
agreements, amendments to existing contracts or agreements, contract supplements (e.g., exhibits,
statements of work, performance standards, riders, addenda, attachments), letters of
understanding, letter agreements, confidentiality agreements, non-disclosure agreements, binding
term sheets, and the like executed on behalf of, or for the benefit of VMD.
Flow-down Clause Any contractual clause that is required by terms of the contract to be included in any subcontracts
agreed to as part of the performance of the contract.
Kickback Micro-purchase Threshold – See FAR Part 2.101 for the most up-to-date micro-purchase
threshold amount and FAR Part 13.2, Actions at or Below the Micro-Purchase Threshold, for
further information.
Organizational Conflict of An OCI occurs where, because of other activities or relationships, VMD is unable (or potentially
Interest (OCI) unable) to render impartial assistance or advice to the Government; VMD’s objectivity in
performing the contract work is impaired; or VMD has an unfair competitive advantage.
Personal Conflict of Anything that might cause an individual’s private interest to interfere in any way – or even appear
Interest (PCI) to interfere – with the interests of VMD.
RFP Request for Proposals; a solicitation for bids
Simplified Acquisition See FAR Part 2.101 for the most up-to-date simplified acquisition threshold amount and FAR
Threshold Part 13, Simplified Acquisition Procedures, for further information.
Small Business Small business shall include all certified small businesses, veteran-owned small business, service-
disabled veteran-owned small business, HUBZone small business, small disadvantaged.

VMD-CON-019 Confidential and Proprietary – All Rights Reserved 1


Printed copy valid for 24 hours from time of printing unless otherwise indicated “CONTROLLED COPY”.
Date printed 2/18/21 1:02 a2/p2

You might also like