A company in litigation must identify, preserve, collect and produce email and attachments held in its SaaS collaboration platform. Which approach best aligns with ISO/IEC 27050 and CSA guidance on eDiscovery in the cloud?
Select an answer to reveal the explanation.
Short Explanation
In SaaS you don't own the disks, so you can't image them; you own the data and the tools the provider gives you. That's why eDiscovery and legal hold capabilities need to be in the contract before you ever get sued. Watch out for answers that assume physical access or let users collect their own evidence.
Full Explanation
ISO/IEC 27050 describes electronic discovery as a process of identification, preservation, collection, processing, review, analysis and production of electronically stored information, with defensibility and documentation throughout. CSA guidance notes that in SaaS the customer has no access to underlying infrastructure and therefore depends on the provider's capabilities and contractual commitments. The defensible approach is to apply legal hold to the relevant custodians, then search and export the data with its metadata through the provider's eDiscovery tooling, documenting each step for chain of custody. Imaging physical disks is impractical in a multi-tenant SaaS service, where mailboxes are distributed across shared storage that also holds other customers' data. Letting users export their own mailboxes is not defensible: custodians may omit or alter items, metadata can be lost and the process is not documented. Waiting for a court order before preserving data violates the duty to preserve once litigation is reasonably anticipated, and normal retention or deletion during the wait could lead to spoliation sanctions. Exam caveat: confirm before contracting that the provider supports holds, search, export formats and audit logs for these actions. Operational check: test placing a hold, running a search and exporting results with metadata and an audit trail.