This domain seeks to identify those gaps pertinent to IR that are created by the unique characteristics of cloud computing. this can be used this as a reference when developing response plans and conducting other activities during the preparation phase of the IR lifecycle.

This domain is organized in accord with the commonly accepted Incident Response Lifecycle as described in the National Institute of Standards and Technology Computer Security Incident Handling Guide (NIST 800-61rev2 08/2012)