Incident Response: Preserving Footage and Chain of Custody

When something happens on site, recorded video is often the best evidence. But footage can be lost, or questioned, if it is not handled well. This guide gives security supervisors and facility managers a simple routine, from the first minutes to closing the case.

What is chain of custody?

Chain of custody is a written record of who had the evidence, when, and what they did with it. It starts when the footage is found. It ends when the footage is handed over. A complete record shows that nobody could have changed the evidence along the way.

The first hour

1. Safety first. Make sure people are safe. Call the emergency services if needed.
2. Note the facts. Write what happened, where, when, and who reported it.
3. Find the cameras and the time window. Use timeline playback in SSMS. If the time is unclear, use the method in reviewing footage when you don't know the exact time.
4. Tell your supervisor. One person should lead the case from here.
5. Protect the footage from being overwritten. Recordings are kept for a limited time, so act fast. Ask IT or Skyline how to keep that footage longer in your deployment.
6. Start the paperwork. Open a chain-of-custody form, and add an entry to the footage access register.

What Saudi law says

For facilities covered by the Law on the Use of Security Surveillance Cameras:

• When an incident is reported, the recording must stay unaltered until the investigation ends. It must be handed to the Ministry of Interior or the Presidency of State Security when they ask (Article 4).
• Recordings may not be transferred or published without the approval of the Ministry of Interior or the Presidency of State Security, a court order, or a request from the competent investigating authority (Article 6).

Source: the law as published in the Umm Al-Qura gazette. This is orientation, not legal advice. Outside Saudi Arabia, follow your local law. A short summary is on the SSMS Saudi Arabia page.

Copies and the original

The original recording stays in SSMS, untouched. Any copy is made, checked, labelled and handed over exactly as described in handing over CCTV footage safely. Follow that guide step by step. Do not work from memory.

The chain-of-custody form

Use one form for each item. An item is, for example, one copy on one storage device. Fill the form in at the time, in pen, and never erase anything.

Every time the item changes hands, add a new transfer line. Even a move inside your own team counts. A gap in the chain raises doubts about the evidence.

Keeping the evidence safe

• Store copies in a locked cabinet or safe until they are handed over.
• Share case details inside the organisation only with people who need to know.
• Never discuss or share the footage on social media or in messaging groups.
• Keep the forms and receipts together in the case file.

Closing the case

1. Record the outcome and the date the case closed.
2. Check that every copy is accounted for: handed over, or destroyed under your policy with a written record.
3. Ask what the cameras missed. Blind spots, poor night images and bad angles are useful lessons.
4. If you need new or moved cameras, raise a request with Skyline. See adding a new camera.
5. Share the lessons with your operators at the next briefing.

Quick checklist

• People are safe, and the facts are written down.
• The cameras and time window are identified.
• The footage is protected from being overwritten.
• The original is untouched, and copies follow the safe-handling guide.
• A chain-of-custody form exists for every item, with every transfer signed.
• Copies are locked away, and the case is closed with lessons recorded.