Computer security incident response plans include physical server access, and the ability to scan logs and pull data from forensic devices. When in the cloud, there is no physical access or forensic devices in place. However cloud providers can provide the data and expertise you need. This session will offer a blueprint of capabilities your cloud provider should have to conduct computer forensics.