In the chain of evidence in the context of security forensics, the concept that evidence is controlled and accounted for as to not disrupt its authenticity and integrity.