CAS-002 · Question #782
A forensic analyst works for an e-discovery firm where several gigabytes of data are processed daily. While the business is lucrative, they do not have the resources or the scalability to adequately…
The correct answer is C. Using a community cloud with adequate controls. A community cloud shared by organizations with common legal and compliance obligations provides the scalability needed while preserving the chain-of-custody controls critical to e-discovery work.
Question
A forensic analyst works for an e-discovery firm where several gigabytes of data are processed daily. While the business is lucrative, they do not have the resources or the scalability to adequately serve their clients. Since it is an e-discovery firm where chain of custody is important, which of the following scenarios should they consider?
Options
- AOffload some data processing to a public cloud
- BAligning their client intake with the resources available
- CUsing a community cloud with adequate controls
- DOutsourcing the service to a third party cloud provider
How the community answered
(36 responses)- A8% (3)
- B3% (1)
- C78% (28)
- D11% (4)
Why each option
A community cloud shared by organizations with common legal and compliance obligations provides the scalability needed while preserving the chain-of-custody controls critical to e-discovery work.
A public cloud is available to the general public and lacks the dedicated compliance controls and auditability required to maintain legal chain of custody.
Aligning client intake to existing resources solves neither the scalability problem nor the inadequate infrastructure, and limits the firm's ability to serve clients.
NIST defines a community cloud as infrastructure provisioned for exclusive use by a specific community of consumers with shared concerns such as mission, security requirements, or compliance obligations. For an e-discovery firm, a community cloud shared with other legal or forensic organizations includes contractual and technical controls - such as audit logging and custodial accountability - that support chain of custody, while also providing greater scale than the firm can afford alone.
Outsourcing to a generic third-party cloud provider does not guarantee the shared legal compliance posture or chain-of-custody controls specific to e-discovery requirements.
Concept tested: Community cloud deployment model for compliance-sensitive workloads
Source: https://csrc.nist.gov/publications/detail/sp/800-145/final
Topics
Community Discussion
No community discussion yet for this question.