Information security for use of cloud services

What the requirement asks

Processes for buying, using, managing and leaving cloud services are to be set up so that they satisfy what the organization requires for information security. Purpose: specify and manage the security of the organization's cloud service use. Guidance: publish a topic-specific cloud policy to relevant parties and state how cloud risks will be managed, possibly as part of the wider approach to external services (5.21, 5.22). Cloud use usually means shared responsibility, so the provider's and customer's duties must be defined and carried out. The organization defines its security requirements for cloud use; selection criteria and scope of use; roles and responsibilities; which controls the provider runs and which it runs itself; how to obtain and use provider security capabilities; how to gain assurance over provider controls; how controls, interfaces and service changes are handled when several services or providers are in use; incident procedures for cloud-related incidents; how ongoing use is monitored, reviewed and evaluated; and how to change or stop using a service, including exit strategies. Cloud agreements are often fixed, but each should be reviewed and should address confidentiality, integrity, availability and handling needs with suitable quantitative and qualitative service objectives; risk assessments should be done and residual risk explicitly accepted by the right managers. Agreements should provide for: architecture and infrastructure built on accepted industry standards; access control meeting the organization's needs; malware monitoring and protection; processing and storing sensitive information in approved countries, regions or jurisdictions; dedicated support during incidents in the cloud environment; the organization's requirements holding if the provider subcontracts, or a ban on subcontracting; help with gathering digital evidence across jurisdictions; support and availability for a suitable period during exit; backup of data and configuration with secure handling of backups as the provider's capabilities allow; and return of configuration files, source code and data the organization owns, on request or at termination. Consider requiring advance notice of substantive changes such as infrastructure relocation or reconfiguration, processing in a new geography or jurisdiction, and use of new or changed peer providers or subcontractors. Keep close contact with providers so both sides can exchange security information, monitor service characteristics and report missed commitments. Other information: this is the customer's view; ISO/IEC 17788, 17789, 22123-1, 19941 (portability), 27017, 27018, 27036-4 and the 19086 series (19086-4 for security and privacy) give more. In the ISMS the control is compared with the controls determined in risk treatment and recorded in the Statement of Applicability as included or excluded, with the reason and the implementation status.

What the guidance adds

Cloud services need a documented acquisition and exit position. The guidance asks for the service inventory, the data position, the shared responsibility split, the assurance and the exit plan.

What good looks like

Put the control in the Statement of Applicability with an owner, a status and the risk it treats. Then keep the topic-specific cloud services policy with selection criteria and scope of permitted use and one live sample together.

Evidence an assessor asks for

• Cloud governanceThe topic-specific cloud services policy with selection criteria and scope of permitted use
• Cloud governanceA shared responsibility matrix per cloud service showing which controls the provider operates and which the organization operates
• Cloud governanceCloud risk assessments with documented management acceptance of residual risk
• Cloud governanceReviewed cloud service agreements covering data location, incident support, subcontracting, evidence gathering, backup and return of data
• Cloud governanceProvider assurance evidence such as certifications or attestation reports, and records of their review
• Cloud governanceDocumented exit strategies per critical cloud service, including data and configuration retrieval

The question an assessor will ask

An assessor will ask for the topic-specific cloud services policy with selection criteria and scope of permitted use, then trace it to the system it protects. For A.5.23 the test is whether that record ties to a live sample, not whether the control is named in a policy.

Common gaps

• Cloud services are adopted by business units without passing through the policy or selection criteria
• Customer-side responsibilities such as identity and configuration are assumed to belong to the provider
• No exit strategy exists, so data retrieval on termination is untested
• Data location and subcontractor changes by the provider go unnoticed

Before the next audit

Before the next audit, check one live sample for this gap: cloud services are adopted by business units without passing through the policy or selection criteria.