Table 5 Expert reviews of the organizational factors

Management support

B

“Lack of management support causes a delay in or a failure to achieve the readiness”.

D

“There needs to be a good understanding and buy-in by the whole management team and organization”.

C

“Organizations cannot move to or adopt new technologies without support from the business”.

K

“It is very hard to have a well-qualified armed forensics team without endless support from the superiors and decision makers in the organization”.

H

“The readiness needs investment (money) and support (decision) from the top management”.

I

“Management is mostly business oriented, delivering investigators’ points of view (and, in particular, readiness). Convincing stakeholders might require a great deal of effort”.

E

“This is very important because if an organization does not have buy-in from management, there will not be a sufficient budget (if any) assigned for CFR, and then, CFR will be non-existent”.

Readiness strategy

D

“We need a clear plan about what the problem is, how we aim to achieve this, and the outcomes should be clearly defined”.

E

“Since strategy is a very proactive paradigm, it ties in directly with the paradigm of cloud forensic readiness, and that is to be proactive”.

J

“Without a strategy, implementation would be in jeopardy”.

H

“Success in the strategy resulted in success in forensics investigations and verse versa”.

Governance

D

“We need a clear and well-defined governance structure, which should be simple, whilst covering all of the policies and procedures so as to ensure the integrity of the digital evidence obtained”.

F

“Every identified role must be carefully assigned, while specific duties should be introduced”.

K

“Governance is important in forensic readiness because it makes the forensics investigation team very systematic during their tasks and procedures, which can assure us that we are forensically ready”.

Culture

I

“The changing mindset of CEOs, management and employees is a challenge that needs to be considered. On the other hand, the forensic investigators and analysts might show resistance in adopting the readiness framework”.

D

“There needs to be a good culture in policing attitudes regarding the correct ways to obtain, process and store digital evidence”.

E

“It is important to bring culture in since that automatically raises more awareness amongst the participants in the organization”.

Training

K

“Training your staff is the first step towards being ready and armed against any cyberattack”.

J

“Training is a very important aspect of forensics. Each individual must know why the process is needed in an organization”.

D

“The correct training needs to be identified at the provided level within the organization, from the first responder through to the digital analyst”.

E

“I think training is less important to the organization as a whole but quite important in terms of digital forensic examiners. In addition, non-forensic teams need to be provided with awareness programmes on how to respond in the case of cyberattacks. This can help forensics teams to reduce the risk of evidence loss”

I

“The fear of adopting new approaches, procedures and strategies can be considered the main obstacle. Training might be extremely helpful for families and shareholders with the new procedures or tools, and hence, it is very important”.

Procedure

B

“Policies are very important for forensic readiness, as we can make sure that everything goes in the same direction and avoid self-interpretation”.

D

“You cannot operate in the digital forensics world at an evidentiary standard without good policy and procedures, both quality standards and technical standards. They go together”.

L

“I believe forensics policies are a set of rules that can guide people on what to do and what not to do before, during and after digital investigations, and this must be done by the senior management”.

I

“Forensics policies are important, as the current trend shows that, at both the national and international levels, efforts have been initiated towards a cloud, big data, and other evolving technology procedures”.