A.5.23
Information security for use of cloud services
Organizational controlsCheckpoints 5Evidence 6Cases 5
Control objective
This control requires the organization to establish processes, in line with its information security requirements, across the full lifecycle of cloud services: acquisition, use, management, and exit (including migration). Because cloud operates under a shared responsibility model that splits control points between the provider and the customer, the essential task is to carry out every security responsibility that falls to the customer through contracts, configuration, and monitoring. The aim is to govern unapproved cloud use and to securely recover or destroy data on exit or migration, so that cloud risk stays within the organization's management scope.
Key checkpoints
- Are security requirements and usage criteria defined and subject to an approval process before adopting a cloud service?
- Is the boundary of security responsibility between provider and customer documented per service type (IaaS/PaaS/SaaS) under the shared responsibility model?
- Are security baselines for cloud accounts and configuration (privileges, network, encryption, logging) established and their compliance reviewed?
- Is the provider's security level (certifications, SLA, incident notification, data storage location) assessed before contracting and reflected in the agreement?
- Are procedures for data recovery/destruction and account/privilege revocation in place for service termination or migration?
Implementation guidance
- Establish a cloud adoption/use policy and operate a process to identify and block unapproved cloud (shadow IT) use.
- Produce a shared responsibility matrix per service type that clarifies customer-owned items such as account management, data encryption, network controls, and log collection.
- Define cloud configuration baselines and check for unauthorized exposure of non-public data, excessive privileges, and missing required encryption. For intentionally public material, verify publication approval and separately controlled write access.
- Specify data storage location/cross-border transfer, incident notification deadlines, audit rights, and data return/destruction on termination in the contract and SLA.
- Apply multi-factor authentication and least privilege to cloud administrator accounts, and log and monitor administrative actions.
- Prepare an exit plan in advance to manage data portability and vendor lock-in risk.
Evidence
- Cloud adoption/use policy and adoption approval records
- Shared responsibility matrix per service type
- Cloud contract/SLA (including data storage location, incident notification, exit clauses)
- Cloud configuration review reports and remediation records for risky configurations
- Cloud administrator account privilege/MFA settings and access logs
- Data return/destruction confirmation on service termination or migration
Nonconformity examples
- A team adopts a SaaS to store customer data without approval, and it is omitted from the organization's management scope.
- Misunderstanding the shared responsibility model, the customer assumes the provider performs data encryption/access control that are in fact the customer's responsibility.
- Cloud storage holding non-public information is exposed to the internet without approval.
- The contract lacks clauses on data storage location and destruction on termination, leaving no clear basis for transfer or disposal.
- The cloud management console account has no MFA applied and no access logs are collected for administrative actions.