How do I decide whether cloud evidence needs urgent action?¶

Cloud evidence becomes urgent when delay is likely to lose useful records, allow continuing harm, or make the account state harder to reconstruct.

The seriousness of the offence matters, but it is not the same thing as evidential urgency. A modest incident can still need immediate preservation if the relevant session, audit or deleted-item records are short-lived.

Start by identifying what may change¶

Imagine a cloud account where an unfamiliar administrator session is still active.

The provider currently shows:

You now have two risks:

• the session may continue to expose data; and
• the current account state may change as soon as containment begins.

Both matter.

Use four questions to decide priority¶

This is the balance to manage.

Preservation and containment should be coordinated¶

Where operationally possible:

1. identify the account, tenant, resource and time range;
2. preserve the short-lived or volatile records first;
3. capture the current access and permission state;
4. carry out the containment action;
5. record exactly what changed; and
6. verify whether the risk actually ended.

What should I do if a cloud account may be compromised? develops that sequence.

If immediate harm requires action before full preservation, act to protect people or data and document the evidential effect. The aim is not to keep a perfect untouched scene while damage continues.

The practical point is: cloud urgency is a race against both evidence loss and continuing harm. Preserve the fragile records, then make each containment action traceable.