ISO 27001 A.5.23: cloud services, explained for startups

A.5.23 Information security for use of cloud services

You know which cloud services you use and manage their security. What proves it: a list of the cloud services you use, each with an owner and a security review.

A certification auditor samples cloud service inventory with security review. A file that usually does the job: a list of cloud services with an owner, the data each holds and the date its security was reviewed.

How to put it in place

Each step leaves a record, and the record is what the auditor samples rather than the step itself. Inside Polara, the control card for A.5.23 walks you through it in this order.

1. List every cloud service that stores or processes company data.
2. Name an owner for each and review its security before use and once a year.
3. Note how you would leave each service if you had to.

The free ISO 27001 readiness assessment asks one question that evidences it:

• How do you manage the suppliers and cloud services that handle your data?

Policies, connectors and the SOC 2 overlap

In the ISO 27001 policy pack, the Supplier and Cloud Service Security Policy covers A.5.23. An auditor reads the policy for the rule, then samples the records to see the rule was followed.

The same evidence counts toward SOC 2. The Trust Services criterion that cover this ground: CC9.2, vendor risk.

Organizational controls

A.5.23 is one of the 37 organizational controls in Annex A. How the company runs security: policies, roles, suppliers, incidents, continuity and legal duties. Most of these are written decisions and the records that show you follow them.

Nearby controls in the same theme:

• A.5.20, security in supplier contracts
• A.5.21, technology supply chain
• A.5.22, watching your suppliers
• A.5.24, incident readiness
• A.5.25, triaging security events
• A.5.26, responding to incidents

Before it: A.5.22, watching your suppliers. After it: A.5.24, incident readiness. Every control, by theme, is on the Annex A controls page.