Control A.5.23Information security for use of cloud services
What it means in practice
Processes for acquisition, use, management and exit from cloud services must be established in accordance with the organisation’s information security requirements.
New in the 2022 edition, and it exists because cloud services do not fit the supplier model cleanly: they are acquired quickly, often without procurement, and the security responsibilities are shared in ways that differ by service and by tier.
The control covers the whole life: what is required before a service is adopted, how responsibilities are allocated and understood, how the service is configured and managed, and — the part most often deferred — exit. An exit plan written when the service is adopted is a design constraint; one written when the relationship ends is a discovery exercise.
The shared responsibility model is where most incidents in cloud environments originate, and not because the provider failed. Misconfiguration on the customer’s side of the line is the common cause, which makes A.8.9 configuration management the control that does the work here.
How to put this in place
Cloud services put part of your security in someone else's hands, and misconfiguration is a common cause of exposure. The ISMS needs to know which tasks are yours and which are the provider's.
- Keep a list of cloud services in use, with an owner for each, including ones bought outside procurement, and add them to the asset inventory.
- Before accepting a provider's terms, check what they say on data location, incident support, notice of changes and return of your data.
- For each important service, record which security tasks are yours and which are the provider's, and review the provider's assurance reports.
- Configure the service to your baseline and review settings regularly.
- Write an exit plan for services the business depends on; see also A.5.19 to A.5.22.
Evidence an auditor usually looks for: the cloud service list, the review of provider terms, shared-responsibility notes for key services, configuration reviews, provider assurance reports, and exit plans.
What is in the packs for this
Each one helps with this requirement.
- Excel
Annex A Control Implementation Library
in ISO 27001 Implementation & Certification ReadinessIts row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies. - Excel
Statement of Applicability Template
in ISO 27001 Implementation & Certification ReadinessHas its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented. - Word
Stage 1 and Stage 2 Audit Preparation Guide
in ISO 27001 Implementation & Certification ReadinessListed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge. - Word
Supplier Contract Security Clause Library
in Third-Party Security Risk ManagementIts Framework References list this control. Supported by: CL-21 Cloud services; the note on standard cloud terms. - PowerPoint
Tabletop Scenario — Cloud Tenant Account Takeover
in Cyber Incident Exercises & Tabletop Scenario LibraryIts Framework References list this control. Supported by: Whole deck. - Excel
AI Vendor & Model Provider Security Questionnaire
in Generative AI SecurityIts Framework References list this control. Supported by: The workbook as a whole: information security in the supplier relationship and in the use of a cloud service.