CLD-004 Cloud Services
Does “in the cloud” mean the data is stored in one place?¶
No. Live content, versions, backups, deletion records, audit logs and local copies may exist in different places and may not be identical at every moment.
Evidence and questions to consider¶
- user devices and cached material;
- cloud account and live data;
- customer organisation records;
- provider logs and backups;
- linked applications and shared users;
- the authoritative source for each question.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
Describe the specific system, export, log or device source rather than saying only that evidence came “from the cloud”.