Summary
The SAFE RFC's Evidence Preservation section specifies what evidence members must retain and provide, but does not require documentation of how that evidence was collected, transferred, stored, or handled between collection and submission. This is a chain of custody gap. It is most acute for evidence that originates from third parties — cloud provider logs, evaluation partner telemetry, tool vendor audit trails, shared infrastructure — where the reporting member did not collect the evidence directly and cannot attest to its integrity from the point of origin.
Problem
The Evidence Preservation section states:
Members must preserve and provide affected organizations with the evidence needed for a complete forensic response, including: prompts, traces, tool calls, logs, configurations, model and safeguard versions and third-party dependencies, agent and workload identities, permissions and credentials available during the run, human approval and intervention events, files and external artifacts created or modified, detection, containment and recovery events, a complete incident timeline, reproduction testing and remediation evidence.
This is a list of what to keep. It does not specify:
- How the evidence was collected (method, tool, timestamp of collection)
- Who collected it and who has had access since collection
- How it was stored (format, integrity protection, access controls)
- Whether it was transferred between parties, by whom, and when
- Whether it was modified, copied, or transformed between collection and submission
- Cryptographic integrity proof (e.g., hash attestation) that the evidence is unchanged
- Provenance documentation for evidence that originated from third parties
The Supply Chain review layer asks: "Did a cloud, evaluation, data or tooling partner invalidate assumed controls?" This addresses whether a partner's controls failed. It does not address whether evidence received from that partner can be trusted to be authentic and unaltered.
When evidence comes from a third party, the reporting member is submitting evidence they did not collect. Without chain of custody, neither SAFE reviewers, regulators, nor affected parties can verify that:
- The evidence originated from the stated source
- It has not been modified in transit or during storage
- The third party's own logging is tamper-evident
- Each party who handled the evidence between collection and submission is documented
Relationship to existing issues
This issue is distinct from:
Impact
If SAFE matures into a standard referenced by procurement or regulators, evidence submitted without chain of custody can be challenged on authenticity grounds. A member could preserve complete logs from a cloud provider but be unable to demonstrate how those logs reached their SAFE submission — making the evidence only as trustworthy as the weakest link in the transfer chain.
This also creates a structural asymmetry. Large providers with dedicated forensics teams and vendor SLAs can implement chain of custody internally. Small operators who depend on third-party infrastructure they do not control cannot prove the integrity of evidence they did not collect themselves. The gap is survivable for enterprises and a compliance trap for everyone else.
Question for the working group
Should the Evidence Preservation section require, for each evidence item, a minimum chain of custody record that documents:
- Source (who or what system collected the evidence)
- Collection timestamp and method
- Each transfer between parties (from, to, when, how)
- Storage format and integrity protection
- Cryptographic hash at collection and at submission
Should this requirement scale — mandatory for evidence from third parties, recommended for self-collected evidence — or should it apply uniformly?
Summary
The SAFE RFC's Evidence Preservation section specifies what evidence members must retain and provide, but does not require documentation of how that evidence was collected, transferred, stored, or handled between collection and submission. This is a chain of custody gap. It is most acute for evidence that originates from third parties — cloud provider logs, evaluation partner telemetry, tool vendor audit trails, shared infrastructure — where the reporting member did not collect the evidence directly and cannot attest to its integrity from the point of origin.
Problem
The Evidence Preservation section states:
This is a list of what to keep. It does not specify:
The Supply Chain review layer asks: "Did a cloud, evaluation, data or tooling partner invalidate assumed controls?" This addresses whether a partner's controls failed. It does not address whether evidence received from that partner can be trusted to be authentic and unaltered.
When evidence comes from a third party, the reporting member is submitting evidence they did not collect. Without chain of custody, neither SAFE reviewers, regulators, nor affected parties can verify that:
Relationship to existing issues
This issue is distinct from:
Impact
If SAFE matures into a standard referenced by procurement or regulators, evidence submitted without chain of custody can be challenged on authenticity grounds. A member could preserve complete logs from a cloud provider but be unable to demonstrate how those logs reached their SAFE submission — making the evidence only as trustworthy as the weakest link in the transfer chain.
This also creates a structural asymmetry. Large providers with dedicated forensics teams and vendor SLAs can implement chain of custody internally. Small operators who depend on third-party infrastructure they do not control cannot prove the integrity of evidence they did not collect themselves. The gap is survivable for enterprises and a compliance trap for everyone else.
Question for the working group
Should the Evidence Preservation section require, for each evidence item, a minimum chain of custody record that documents:
Should this requirement scale — mandatory for evidence from third parties, recommended for self-collected evidence — or should it apply uniformly?