A company suspects that data was exfiltrated through its SaaS customer relationship management application. It has no access to the provider's servers, hypervisors or storage. What most determines what forensic evidence the company can obtain?
Select an answer to reveal the explanation.
Short Explanation
In SaaS you're a tenant, not the landlord, so you can't go pulling up the floorboards yourself. What you can get is whatever the provider can supply and the contract says they have to. The trap is assuming you've got hands-on access you never had.
Full Explanation
In SaaS the provider operates the entire stack, so the customer's forensic reach is limited to what the application exposes, such as audit logs, sign-in records and administrative activity, plus whatever additional support the provider agrees to give. The contract and supporting agreements therefore determine the evidence available: which logs are retained and for how long, whether the provider will preserve data on request, how quickly it will respond, what formats it will deliver, and how it will cooperate with investigations and legal processes. A general right-to-audit clause typically permits review of controls, often through third-party reports, and does not entitle a customer to image multi-tenant storage holding other customers' data. Endpoint forensics can show what a user's device did, but browser caches cannot reconstruct server-side logs, API calls or bulk exports performed elsewhere. Regulators may compel disclosure in some circumstances, but they do not routinely obtain raw disk images on a customer's behalf, and multi-tenant storage makes such images inappropriate anyway. Exam caveat: the 2026 outline cites CSA guidance and ISO/IEC 27037, 27041, 27042 and 27043 for forensic requirements. Operational check: confirm the SaaS contract specifies log retention, export formats, preservation on request, response times and a named contact for investigations, and that available audit logs are already being collected.