Why it matters
Evidence collected badly after an incident can be useless for a legal case or root-cause analysis later.
How a self-led small team implements it
Know in advance what logs you'd pull and how you'd preserve them — you don't need forensic tooling at small scale, just a plan.
What auditors expect to see
Evidence handling procedure.
Track A.5.28 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS