What must the shared hosting provider have to enable timely forensic investigation under A.1.4?

• A. Written policies that provide for a timely forensics investigation
• B. A disaster recovery plan only
• C. No policy is required
• D. Only automated intrusion tools

Answer: (A)

The essential element is having written policies that provide for a timely forensics investigation. This ensures there are pre-defined, documented procedures for preserving evidence, accessing logs, and coordinating with customers and investigators when an incident occurs. In a shared hosting environment, where multiple tenants share resources, clear policies keep roles, responsibilities, data retention, and timelines explicit, enabling rapid and forensically sound investigations.

A disaster recovery plan helps with getting systems back up after a disruption but doesn’t specifically address forensic readiness or timely evidence handling. No policy would leave procedures undefined, leading to delays. Automated intrusion tools alone can aid detection, but without documented processes and authorities, forensic investigations can’t proceed quickly or effectively.