Key takeaways
- Manage how you acquire, use, manage and exit cloud services securely.
- Cloud services are now core infrastructure.
- Start here: define how cloud services are selected, approved and recorded.
Purpose
Manage how you acquire, use, manage and exit cloud services securely.
Requirement
Requirement summaryProcesses for acquisition, use, management and exit from cloud services shall be established in accordance with the organization’s information security requirements.
Why it matters
Cloud services are now core infrastructure. You need a clear view of shared responsibility and exit options.
How to implement
- Define how cloud services are selected, approved and recorded.
- Document the shared responsibility split for each significant service.
- Configure security settings to your standards and review them.
- Plan how you would exit a service and retrieve your data.
What evidence you need to provide
Here is what you will typically need to provide for Annex A 5.23. It does not matter which system it lives in: a document, screenshot or export is fine.
Documents to have ready
- Your cloud services policy: how you choose, use, manage and leave cloud services.
- Your Statement of Applicability (SoA: the list of all 93 controls showing which you use and why) with A.5.23 marked as used or not used, a short reason, and its current status.
Records and examples to show
- A list of cloud services in use, each with an owner and approval.
- Notes on who is responsible for what security tasks (you or the provider) for key services.
- Your exit plan for key services: how you would get your data back.
Things you should be able to show or explain
- Be able to show the security settings of your most important cloud service.
How much to show: Three to five services, including the most important.
Common mistakes
- Cloud services used without approval.
- No exit plan for key services.
- Assuming the cloud provider handles all security.
- Staff signing up for cloud tools without approval.
- Tip: Understand the shared responsibility model for each provider.
Policies & documents to have
- Information Security Policy
FAQ
Is A.5.23 mandatory?
Annex A controls are not automatically mandatory. You must consider every control and record in your Statement of Applicability whether it applies and why. In practice, most organisations include this one.
What will I need to show for A.5.23?
Be ready to explain how the control works in your organisation and to provide things like: Your cloud services policy: how you choose, use, manage and leave cloud services…