Who controls the affected system?¶

Before requesting records or directing action, identify who actually controls the affected system.

Evidential caution: that the organisation experiencing the harm possesses and controls all relevant data.

What this means¶

A business may use systems managed by an internal IT team, an outsourced service provider, a software supplier, a cloud platform, a hosting company, a parent organisation or several of these at once.

Different parties may control different layers.

The organisation may control user accounts but not the underlying infrastructure.

A managed service provider may administer devices and retain endpoint logs.

A cloud provider may host the service, while the customer controls audit configuration and data retention.

A security provider may hold alerts and investigation notes but not the original application records.

A software vendor may control a hosted platform used by many customers.

Identify:

the business owner of the system;

the technical administrator;

the service provider;

the data controller or contractual customer;

the account or tenant identifier;

the physical or cloud hosting arrangement;

the person authorised to approve preservation and collection.

Control also affects attribution. An action recorded against an administrator account may have been performed by an employee, contractor, service provider, automated process or attacker.

Map the environment before assuming where evidence sits. This prevents requests being sent to the wrong organisation and reduces the risk that one provider refers you to another after retention has expired.

================================================================================

Evidential limits¶

Do not rely only on job titles. The “IT manager” may not have access to cloud logs. The affected employee may use the system but have no authority to export records. A third-party provider may require formal authorisation from its customer.