How do we use our cloud providers' certificates and reports in our ISMS scope and Statement of Applicability?

Start

Our services run on cloud providers that hold certificates

A provider's certificate is useful evidence about the provider. It is not evidence about you. Decide how it feeds your scope and your Statement of Applicability before you quote it to an auditor or a customer.

• Then: List the cloud services in use, with an owner for each

Step

List the cloud services in use, with an owner for each

Include services bought on a card outside procurement and the SaaS tools teams adopted. The control guidance names services bought outside procurement as a common gap. Add them to the asset inventory.

• Then: Does an in-scope service depend on this provider?

Decision

Does an in-scope service depend on this provider?

Take the providers one at a time. If an in-scope service cannot run without it, answer yes. If you are not sure, answer yes. Providers that do not support an in-scope service are ordinary suppliers.

• Yes, or not known: Name the platform as an interface in the scope statement
• No: Treat it as an ordinary supplier

Step

Treat it as an ordinary supplier

It stays in your supplier tiers and reviews, but it does not need a place in the scope statement or the shared-responsibility split. Move to the next provider.

• Then: Is there another provider to cover?

Step

Name the platform as an interface in the scope statement

The pack lists treating the cloud provider's platform as out of scope, rather than as an interface, as a common mistake. Name it, say where responsibility changes hands, and show it is controlled under your supplier controls.

• Then: Do you hold the provider's current certificate or report?

Decision

Do you hold the provider's current certificate or report?

Providers publish them in a portal or on request. If you do not hold the current one, or are not sure it is current, answer no.

• Yes: Does it cover the services and regions you use?
• No, or not known: Ask for the certificate and a summary of its scope

Step

Ask for the certificate and a summary of its scope

Ask for the certificate with its list of in-scope services and sites, any statement of applicability or summary the provider shares, and its audit report with the opinion and exceptions. Agree in the contract that the provider will supply records for your auditor to sample.

• Then: Does it cover the services and regions you use?

Decision

Does it cover the services and regions you use?

Certificates name a scope of services and sites. A certificate for the provider's corporate system does not cover the service you buy, and a report may leave some components out. If you cannot match your services to the scope, answer no. A SOC 2 report may carve out a subservice organisation, such as the data centre operator; read what it leaves out.

• Yes: Is it in date and issued to the company you contract with?
• No, or not known: Treat the uncovered part as unassured

Decision

Is it in date and issued to the company you contract with?

Check the period and the issuing entity. An expired certificate or one for a group company you do not contract with does not support your records. For a SOC 2 report, check it is a Type 2, which covers a period, not one date. For a certificate under renewal, ask the provider to confirm the renewal in writing.

• Yes: Split the controls: what the provider runs, what you configure
• No, or not known: Treat the uncovered part as unassured

Step

Treat the uncovered part as unassured

Until covered, you cannot lean on the certificate for that part. Assess the service yourself, ask the provider for other evidence, or change the service. Record the gap with an owner and a date.

• Then: Split the controls: what the provider runs, what you configure

Step

Split the controls: what the provider runs, what you configure

Physical and environmental controls are inherited from the provider. Your data, access, encryption choices and keys, configuration and logging settings stay with you, and which side holds a control depends on the service model. Use the provider's shared-responsibility documentation and record the split per key service.

• Then: Does the provider carry out the whole control for you?

Decision

Does the provider carry out the whole control for you?

Ask this per control. A control the provider runs entirely, such as data centre power, is delivered by the supplier. If you configure, monitor or operate any part, answer no. If this part sits in a service you marked unassured, answer no and assess it yourself.

• Yes: Keep it applicable, delivered by the supplier, citing its evidence
• No, or not known: Mark it as shared and name your configuration owner

Step

Keep it applicable, delivered by the supplier, citing its evidence

In the Statement of Applicability a control carried out by a supplier is applicable and marked as delivered by the supplier. It is not an exclusion. Say how it is implemented: the contract and the provider's certificate or report, reviewed on renewal. Do this only where the provider's evidence covers your service; otherwise treat the control as shared.

• Then: Is there another control to place?

Step

Mark it as shared and name your configuration owner

Mark it as delivered by you and a supplier. Name the person who owns your side and the setting, baseline or review that proves it.

• Then: Is there another control to place?

Decision

Is there another control to place?

Go through the controls the provider touches, such as physical security, supplier management, backup, access and logging. Repeat the question for each until every one is placed.

• Yes: Does the provider carry out the whole control for you? (back to an earlier step)
• No: Take on the customer-side duties the provider's report lists

Step

Take on the customer-side duties the provider's report lists

Some assurance reports state controls the provider assumes each customer runs. If you do not run them, the report's assurance does not fully apply to you. Add each to your controls with an owner.

• Then: Keep your own evidence for your side

Step

Keep your own evidence for your side

The certification body tests the controls you run: access reviews, configuration, logging, backups. The pack says score a control for what you can evidence, not for what the provider says it does. Keep your own records for the whole operating period.

• Then: Review the provider's evidence on renewal and on change

Step

Review the provider's evidence on renewal and on change

Re-read the certificate or report when it renews: scope, period, exceptions. Treat a major change or incident at the provider as a trigger for an early review. For a platform the business runs on, keep an exit plan.

• Then: Is there another provider to cover?

Decision

Is there another provider to cover?

Go round again for each remaining provider that supports an in-scope service.

• Yes: Does an in-scope service depend on this provider? (back to an earlier step)
• No: Providers placed in the scope, with the split recorded

Outcome

Providers placed in the scope, with the split recorded

Your scope names the platform, your Statement of Applicability shows who runs each control, and you hold evidence for your side. Do not say that a provider's certificate certifies you or covers your systems, and do not use its logo as if it did.