The Converged Infrastructure Forensics Model (CIFM) — Version 1.0RC

Modern cyber incidents increasingly occur across interconnected ecosystems spanning cloud platforms, telecommunications networks, edge systems, IoT/IIoT devices, and operational technology. Traditional host-centric forensic methodologies are insufficient for reconstructing adversary activity in these distributed, identity-driven environments. CIFM is an investigative framework for reconstructing adversary activity across converged infrastructure ecosystems using identity-centric analysis, distributed telemetry, and human-validated reasoning.