Information security for use of cloud services
Purpose
Establish processes for acquiring, using, managing and exiting cloud services in line with your security requirements.
How to meet this control
In short: Establish processes for acquisition, use, management and exit of cloud services.
- Step 01Publish a cloud services policy and define selection criteria and a shared-responsibility understanding per provider
- Step 02Document the split of controls between provider and customer for each major cloud service
- Step 03Review cloud agreements for confidentiality, integrity, availability, data location and breach notification terms
- Step 04Configure tenancy security baselines (MFA, logging, encryption, least privilege) and verify them with cloud posture tooling
- Step 05Document a cloud exit plan covering data return, backups and secure decommissioning for each critical service
Tip: Document a cloud exit plan and shared-responsibility understanding per provider.
What ISO 27002 says to cover
Reference points from the ISO/IEC 27002:2022 guidance for this control. Use them to check the steps above cover everything relevant to you.
- ›Publish a topic-specific policy on cloud service use and share it with relevant parties
- ›Define your security requirements and the criteria and scope for selecting cloud services
- ›Clearly split which controls the provider manages versus which you manage as the customer
- ›Decide how to gain assurance over the provider controls and how to use the security capabilities they offer
- ›Plan how to handle security incidents that involve the cloud service
- ›Review cloud agreements for confidentiality, integrity, availability and data-handling terms, including data location
- ›Require advance notice of substantive provider changes such as infrastructure moves or new jurisdictions
- ›Define exit strategies covering data return, backups and ending the service securely
Audit evidence to keep
- - Cloud services policy and provider selection criteria
- - Shared-responsibility matrix per major cloud provider
- - Documented cloud exit plans for critical services
- - Evidence of cloud security configuration review (CSPM reports or baselines)
Common mistakes
- - Treating all suppliers as equal risk
- - Collecting vendor reports but not reviewing exceptions
- - Forgetting exit, deletion, sub-processor, and change-notice terms
Owner, cadence, and proof
Assign one accountable owner for A.5.23. Review this control at least annually, after related incidents, and whenever the underlying process, supplier, system, office, or legal obligation changes. The control is audit-ready when the owner can show the policy or procedure, the latest operating evidence, the latest review, and any open exceptions with due dates.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.