What it means
Evidence can be distributed across provider control planes, tenants, managed services, workloads, network flows, identity systems, and third parties. Some evidence is short-lived or accessible only through provider APIs, making advance collection and retention decisions essential.
Why it matters
An organization that waits until an incident to discover available evidence may find that logs were disabled, overwritten, stored in the compromised account, or never collected.
Practical focus
- Define required evidence for likely incident scenarios
- Centralize logs in a protected administrative boundary
- Synchronize time and preserve resource metadata
- Document provider support, legal, and acquisition procedures
Common mistakes
- Collecting logs without testing search and export
- Storing evidence only in the affected account
- Ignoring ephemeral resource and serverless telemetry
- Assuming provider retention matches organizational needs
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: