A.5.23 Audit Checklist

When to use this

Use this during internal audits to verify that cloud services are acquired, used, managed, and exited according to information security requirements.

Checklist

• Cloud service register exists.
• Cloud service owners are assigned.
• Cloud risk assessments are performed.
• Data location and support location are reviewed.
• Shared responsibility is documented.
• Required security features are defined and enabled or risk-accepted.
• Cloud agreements address relevant security requirements.
• Provider assurance is reviewed.
• Service dashboards/reports are reviewed.
• Provider incident notification process is defined.
• Provider incidents are reviewed and acted on.
• Exit plans exist for critical cloud services.
• Risks above tolerance are accepted by appropriate management.

Related notes

• A.5.23 Information Security for Use of Cloud Services
• A.5.23 Audit Evidence Pack
• Cloud Service Register
• Cloud Security Requirements and Exit Checklist