Information security for use of cloud services

What the control asks

Processes for buying, using, managing and leaving cloud services are to be set up so that they satisfy what the organization requires for information security. Purpose: specify and manage the security of the organization's cloud service use. Guidance: publish a topic-specific cloud policy to relevant parties and state how cloud risks will be managed, possibly as part of the wider approach to external services (5.21, 5.22). Cloud use usually means shared responsibility, so the provider's and customer's duties must be defined and carried out. The organization defines its security requirements for cloud use; selection criteria and scope of use; roles and responsibilities; which controls the provider runs and which it runs itself; how to obtain and use provider security capabilities; how to gain assurance over provider controls; how controls, interfaces and service changes are handled when several services or providers are in use; incident procedures for cloud-related incidents; how ongoing use is monitored, reviewed and evaluated; and how to change or stop using a service, including exit strategies. Cloud agreements are often fixed, but each should be reviewed and should address confidentiality, integrity, availability and handling needs with suitable quantitative and qualitative service objectives; risk assessments should be done and residual risk explicitly accepted by the right managers. Agreements should provide for: architecture and infrastructure built on accepted industry standards; access control meeting the organization's needs; malware monitoring and protection; processing and storing sensitive information in approved countries, regions or jurisdictions; dedicated support during incidents in the cloud environment; the organization's requirements holding if the provider subcontracts, or a ban on subcontracting; help with gathering digital evidence across jurisdictions; support and availability for a suitable period during exit; backup of data and configuration with secure handling of backups as the provider's capabilities allow; and return of configuration files, source code and data the organization owns, on request or at termination. Consider requiring advance notice of substantive changes such as infrastructure relocation or reconfiguration, processing in a new geography or jurisdiction, and use of new or changed peer providers or subcontractors. Keep close contact with providers so both sides can exchange security information, monitor service characteristics and report missed commitments. Other information: this is the customer's view; ISO/IEC 17788, 17789, 22123-1, 19941 (portability), 27017, 27018, 27036-4 and the 19086 series (19086-4 for security and privacy) give more.

Purpose in the standard’s terms, in our words: Specifies and manages information security for the organization's use of cloud services.

Attribute values in one line: Preventive; Confidentiality, Integrity, Availability; Protect; Supplier relationships security; Governance and ecosystem, Protection.

The five attribute values

These are the published values for this control, from ISO/IEC 27002:2022 clause 4.2 and Annex A Table A.1. Where your own value differs, record the difference and the reason in the same row rather than replacing the published value.

Evidence an auditor asks for

The attribute is a claim about how the control behaves. The evidence is what proves it operates. Keep both, and keep them together.

• The topic-specific cloud services policy with selection criteria and scope of permitted use
• A shared responsibility matrix per cloud service showing which controls the provider operates and which the organization operates
• Cloud risk assessments with documented management acceptance of residual risk
• Reviewed cloud service agreements covering data location, incident support, subcontracting, evidence gathering, backup and return of data
• Provider assurance evidence such as certifications or attestation reports, and records of their review
• Documented exit strategies per critical cloud service, including data and configuration retrieval

Where audits commonly find gaps

• Cloud services are adopted by business units without passing through the policy or selection criteria
• Customer-side responsibilities such as identity and configuration are assumed to belong to the provider
• No exit strategy exists, so data retrieval on termination is untested
• Data location and subcontractor changes by the provider go unnoticed

What ISO/IEC 27028 changes for this control

It carries a single control type, preventive, which sets what the evidence has to prove. It contributes no detect function, so a control set built from this row alone would not show detection. It is one of the eleven controls added in the 2022 edition, so a register carried over from the previous edition may have no row for it. It serves more than one security domain, which is why a domain count taken by row understates the view.

The guidance expands how the five values are used; it does not change the control or add a requirement. A register that carries the values and the evidence can answer the attribute question for this control without a new document. A register that does not can add the columns at the next SoA version, with an owner and a review date.

Controls that share its values

• 5.10 Acceptable use of information and other associated assets
• 5.19 Information security in supplier relationships
• 5.20 Addressing information security within supplier agreements

Read the five attributes All 93 controls