How should a manager review a cloud line of enquiry?¶

A manager should review a cloud line of enquiry by testing the investigative question, expected value, urgency, proportionality and technical assumptions.

Evidential caution: that a cloud request is justified simply because relevant data may exist.

What this means¶

Review whether the requested records are targeted and whether preservation is needed before slower acquisition work continues.

Where attribution is central, check that the plan includes session, device, application and wider corroboration rather than relying only on an account name or IP address.

Consider provider delay, jurisdiction, cost, specialist demand and whether another evidence source may answer the question more quickly.

The manager should also test the assumptions behind the request.

Has the team confirmed that the provider records this event? Is logging enabled? Could the activity be automated? Could the account be shared or compromised?

Set a review point and stop condition.

The review should also confirm ownership of the next action. Provider requests, tenant collection, specialist analysis and legal process can stall where responsibility is left unclear.

What to check or do next¶

• Start by asking what decision the evidence could change.
• Check whether the account, tenant, service and date range have been identified accurately.
• Do not allow an open-ended cloud enquiry to continue without reassessing value.
• Record the rationale, urgency, preservation decision and any specialist or legal support required.

Evidential limits¶

Ask what the records could prove and what they could not prove alone.