ISO 27001 A.5.23 - Information Security for Use of Cloud Services

Requirement

“Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization’s information security requirements.”

Plain-language meaning

Cloud services must be governed from selection to exit. The organization needs defined processes for buying, configuring, using, monitoring, changing, and leaving cloud services in line with its security requirements.

Cloud is not just another supplier category. It has supplier risk, but also shared responsibility, fluid data locations, standard provider terms, configurable security features, identity integration, support access, resilience assumptions, and exit risk.

Why this matters

Cloud services can improve resilience and speed, but they also create risk when the organization does not understand what the provider secures and what the customer must secure.

Examples:

• customer data stored or supported from unexpected jurisdictions;
• encryption or logging available but not enabled because it costs extra;
• provider standard terms that do not match the organization’s risk appetite;
• unclear responsibility for identity, backup, incident notification, or configuration;
• no exit plan if the provider changes terms, fails, or is replaced;
• incident notices hidden in a portal instead of proactively communicated.

Implementation guidance

1. Define a cloud acquisition process

Before adopting a cloud service, assess:

2. Maintain a cloud service register

The organization should know which cloud services are approved, who owns them, what information they hold, and how they are reviewed.

Minimum useful fields:

• cloud service name;
• business owner;
• supplier/provider;
• information classification;
• data location and residency constraint;
• support location or access model;
• shared responsibility summary;
• security features enabled;
• agreement reference;
• incident notification method;
• review frequency;
• exit strategy status.

3. Define shared responsibility clearly

Cloud control gaps often happen because both parties assume the other side is responsible.

Examples:

4. Manage data location and jurisdiction

Cloud data location can be difficult because major providers use distributed architecture. The organization should define where data may be stored, processed, backed up, and supported from.

If the provider can only answer “it depends,” the organization still needs a risk decision.

5. Plan exit from the beginning

Exit strategy is part of cloud security. Define:

• export format;
• migration dependencies;
• deletion and destruction evidence;
• retention and backup handling;
• identity/access removal;
• contract termination steps;
• business continuity during transition;
• validation that data is no longer accessible.

Audit guidance

Auditors should verify that cloud service acquisition, use, management, and exit are governed by defined processes and risk decisions.

Audit tests:

• request the cloud service register;
• sample cloud services by criticality and information sensitivity;
• review cloud risk assessments and approval records;
• compare provider terms with organizational security requirements;
• check shared responsibility documentation;
• verify data location, support location, and jurisdiction decisions;
• check whether required security features are enabled;
• review service review meetings, dashboards, or provider reports;
• verify proactive incident notification arrangements;
• check whether provider incident advice was reviewed and acted on;
• review exit plans for critical cloud services.

Auditors should expect some cloud provider terms to be standard and non-negotiable. The issue is not whether every term was negotiated; the issue is whether risks above tolerance were understood and accepted by the right management level.

Evidence examples

Strong evidence

• Cloud register includes owner, classification, location, support model, provider, and exit status.
• Risk assessment covers data residency, shared responsibility, provider terms, configuration, and exit.
• Security features such as encryption, logging, MFA, backup, and monitoring are explicitly enabled or risk-accepted.
• Provider incident notifications are proactive and internally reviewed.
• Exit plans exist for critical cloud services.
• Risks above tolerance are accepted by appropriate management.

Weak evidence

• Cloud services known only through finance/procurement spend.
• Provider certification accepted without checking the organization’s shared responsibilities.
• Data location and support location are unknown.
• Security features exist but are not enabled.
• Provider portal has incident notices but nobody checks or receives notifications.
• No exit plan because the provider is assumed to be permanent.

Common failures

Exam traps

• A.5.23 covers acquisition, use, management, and exit, not only cloud procurement.
• Cloud services are supplier relationships, but cloud has specific risks such as shared responsibility, data location, support location, and exit.
• Provider standard terms may still be acceptable if risk is understood and accepted at the right level.
• Provider certification does not prove the customer’s cloud configuration is secure.
• Exit strategy matters as much as onboarding.

Related controls and concepts

• A.5.19 Information Security in Supplier Relationships
• A.5.20 Addressing Information Security Within Supplier Agreements
• A.5.21 Managing Information Security in the ICT Supply Chain
• A.5.22 Monitoring, Review and Change Management of Supplier Services
• A.5.14 Information Transfer
• A.5.15 Access Control
• A.5.18 Access Rights
• Risk Assessment
• Statement of Applicability
• Internal Audit

KB-ready summary

A.5.23 requires defined processes for cloud service acquisition, use, management, and exit. Practical implementation includes a cloud register, cloud risk assessment, shared responsibility matrix, data location decisions, required security configuration, provider monitoring, incident notification, and exit planning.

Templates and checklists

• Cloud Service Register
• Cloud Security Requirements and Exit Checklist
• Supplier Security Register
• Supplier Security Responsibility Matrix
• A.5.23 Audit Checklist