As companies move more critical systems and data into cloud and SaaS environments, investigating a cyber incident can become a complicated exercise in reconstructing events across systems an organization doesn’t fully control. If important evidence is unavailable or incomplete, determining what happened—and demonstrating what did or didn’t happen—can become much harder. NIST’s work on cloud forensics highlights the distinct challenges investigators face when collecting and analyzing evidence in cloud computing environments.
Access to that evidence isn’t always a given. In 2024, CISA, OMB and ONCD worked with Microsoft to expand cloud audit logging for federal customers regardless of license tier and increase default retention from 90 to 180 days, part of a broader push to make critical security logs available without added licensing barriers. That highlights a larger business risk: An organization may discover the limits of its forensic visibility only after an incident, when legal teams, regulators and insurers are looking for clear answers.
Cybersecurity leaders therefore need to look beyond whether their cloud environments can detect suspicious activity and determine whether those environments can support a credible investigation after a breach or other security incident. Members of the Senior Executive Cybersecurity Think Tank bring deep experience in enterprise security, incident response, risk management, regulatory compliance and cloud security. Below, they examine how leaders can strengthen forensic readiness before an incident occurs and where evidence gaps can create the greatest problems once an investigation is underway.
Preserve the Evidence Before You Need It
Ken Grohe, President of LeverageGTM, Inc., brings more than 35 years of experience in the SaaS, IT and security sectors to the question of forensic readiness. He details steps to help companies take charge of collecting and protecting essential data.
“Extract critical identity, network and API logs from cloud environments and securely store them in an isolated, long-term storage location separate from the cloud provider,” he says.
Grohe also emphasizes keeping a clear record of the decisions and actions taken as an incident unfolds.
“Avoid mixing incident data with everyday IT ticketing,” he advises. “Use a specialized platform like Cytactic to establish a time-stamped, tamper-evident log of every executive decision, legal sign-off and communication.”
Preparation also needs to extend to the organization’s response procedures.
“Build response workflows that explicitly dictate immediate log preservation and legal-hold steps the moment an anomaly is detected,” Grohe says. “Use live crisis simulations to pressure-test your response. This helps identify exactly which cloud logs are missing before a real auditor or cyber-insurance underwriter demands them.”
“Centralize logs into a SIEM you control, outside the vendor’s environment, so you’re not dependent on their retention policy post-incident.”
Build Visibility Beyond Vendor Logs
Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA, has worked across national intelligence, cybersecurity research, consulting and enterprise security. He stresses the importance of preparing before an incident, not during it, starting with the agreements established with vendors.
“Set log retention of 12 or more months as a contractual requirement with cloud and SaaS vendors up front rather than leaving it as something to be discovered during renewal,” Ritesh says. “Centralize logs into a SIEM you control, outside the vendor’s environment, so you’re not dependent on their retention policy post-incident.”
He also looks beyond evidence generated inside an organization’s own systems.
“Layer in preemptive external visibility, continuous attack surface monitoring and threat intelligence so you know what’s exposed and who’s probing it before an incident forces the question,” Ritesh says. “That external context often fills gaps internal logs can’t, like early reconnaissance or initial access vectors.”
Some missing evidence, he cautions, can be particularly difficult to overcome once investigators need to reconstruct events.
“The gaps causing the most legal and insurance pain include missing authentication logs, thin API and/or admin trails in SaaS, and inconsistent timestamps that break timeline reconstruction,” Ritesh says. “If you can’t prove data wasn’t accessed, assume it was.”
Make Forensic Readiness Part of Risk Management
Bhavya Bhandari, Cybersecurity Risk Management Leader, Financial Services at Ernst & Young US LLP, has more than 15 years of experience leading security, regulatory and risk transformation programs for global financial services organizations. He highlights a dangerous oversight too many businesses fall prey to.
“Many organizations invest heavily in prevention but overlook forensic readiness,” Bhandari says. “After an incident, missing logs, limited SaaS visibility and inconsistent evidence collection can create regulatory, legal and insurance challenges.”
Such challenges can be costly: In its cyber insurance guidance, the Federal Trade Commission identifies several potential consequences associated with cyber incidents, including regulatory inquiries, litigation, settlements, damages and fines. For organizations that can’t clearly establish what happened, those legal questions may be even harder to resolve.
For Bhandari, that makes understanding an organization’s evidence capabilities an important part of preparing for both an investigation and its aftermath.
“Leaders need to understand the data being logged, how long it is retained and whether it covers critical cloud and third-party environments,” he says. “If you can’t reconstruct or retrace what has happened, showcasing compliance and recovery can become difficult.”
Build Forensic Readiness Before an Incident
- Store critical logs somewhere you control. Preserve identity, network and API records outside the provider environment so evidence remains available if vendor retention limits become a problem.
- Make evidence preservation part of incident response. Response plans should specify when logs must be preserved, when legal holds begin and how key decisions are documented.
- Set retention expectations with vendors up front. Contractual requirements for cloud and SaaS logging can help prevent unpleasant surprises when an investigation is already underway.
- Look beyond internal logs for investigative context. Attack surface monitoring and threat intelligence can help fill gaps around reconnaissance, exposure and initial access.
- Treat forensic readiness as a business risk issue. Missing or incomplete evidence can complicate regulatory inquiries, legal proceedings, insurance claims and compliance reviews.
- Know what evidence your environment can actually produce. Leaders should understand which systems are logged, how long records are retained and whether cloud and third-party environments are adequately covered.
Prepare Now for the Questions That Come Later
Cloud and SaaS environments give organizations flexibility and scale, but they can also complicate the work of reconstructing an incident after the fact. Strong forensic readiness means deciding in advance what evidence must be collected, where it will be stored, how long it will be retained and how quickly it can be preserved when something goes wrong.
As more critical operations move outside infrastructure companies directly control, those preparations are likely to become an increasingly important part of cyber risk management. Organizations that understand their evidence gaps before an incident will be better positioned to investigate what happened, demonstrate compliance and respond to the legal, regulatory and insurance questions that may follow.
