Incident handling strategy is one key strategy to mitigate risks to the confidentiality,
integrity and availability (CIA) of organisation assets, as well as minimising loss (e.g.
financial, reputational and legal) particularly as organisations move to the cloud. In this
paper, we surveyed existing incident handling and digital forensic literature with the aims
of contributing to the knowledge gap(s) in handling incidents in the cloud environment.
139 English language publications between January 2009 and May 2014 were located by
searching various sources including the websites of standard bodies (e.g. National Institute
of Standards and Technology) and academic databases (e.g. Google Scholar, IEEEXplore,
ACM Digital Library, Springer and ScienceDirect). We then propose a conceptual cloud
incident handling model that brings together incident handling, digital forensic and the
Capability Maturity Model for Services to more effectively handle incidents for organisations
using the cloud. A discussion of open research issues concludes this survey.