CLD-008 Cloud Services
Who is the customer or account holder?¶
The customer or account holder has the contractual or administrative relationship with the provider. That does not necessarily identify the person who used the service.
Evidence and questions to consider¶
- registered account details;
- payment and recovery methods;
- contracting organisation or tenant;
- administrators and allocation processes;
- employment, directory and device-assignment records;
- authorised users and delegated access.
Keep the sources separate¶
A provider record, customer-administrator report, application screen and device artefact may describe related activity without proving the same thing. Preserve exact identifiers, dates, times and time zones, and test shared access, delegation, automation, compromise and changing account control.
Key takeaway
Treat customer details as evidence of registration or control, then establish who actually performed the activity.