Control A.5.23Information security for use of cloud services
Processes for acquisition, use, management and exit from cloud services must be established in accordance with the organisation’s information security requirements.
New in the 2022 edition, and it exists because cloud services do not fit the supplier model cleanly: they are acquired quickly, often without procurement, and the security responsibilities are shared in ways that differ by service and by tier.
The control covers the whole life: what is required before a service is adopted, how responsibilities are allocated and understood, how the service is configured and managed, and — the part most often deferred — exit. An exit plan written when the service is adopted is a design constraint; one written when the relationship ends is a discovery exercise.
The shared responsibility model is where most incidents in cloud environments originate, and not because the provider failed. Misconfiguration on the customer’s side of the line is the common cause, which makes A.8.9 configuration management the control that does the work here.
How to put this in place
Cloud services put part of your security in someone else's hands, and misconfiguration is a common cause of exposure. The ISMS needs to know which tasks are yours and which are the provider's.
- Keep a list of cloud services in use, with an owner for each, including ones bought outside procurement, and add them to the asset inventory.
- Before accepting a provider's terms, check what they say on data location, incident support, notice of changes and return of your data.
- For each important service, record which security tasks are yours and which are the provider's, and review the provider's assurance reports.
- Configure the service to your baseline and review settings regularly.
- Write an exit plan for services the business depends on; see also A.5.19 to A.5.22.
Evidence an auditor usually looks for: the cloud service list, the review of provider terms, shared-responsibility notes for key services, configuration reviews, provider assurance reports, and exit plans.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.
Stage 1 and Stage 2 Audit Preparation GuideWord
Listed among the commonly sampled controls, with what an auditor is likely to sample and the likely challenge.