An analyst is investigating a cyber-incident involving a laptop on the corporate network. The analyst secures the area, documents the scene, and collects and logs evidence.
Throughout this process, the analyst documents all individuals who had access to the laptop and the evidence gathered. Which of the following is the analyst attempting to maintain?
B. Escalation criteria
C. Legal hold
D. Forensics report
E. Chain of custody