ISO 27002:2022 – Control 5.23 – Information Security for Use of Cloud Services

Purpose of Control 5.23

5.23 is a new control that outlines the processes that are required for the acquisition, use, management of and exit from cloud services, in relation to the organisation’s unique information security requirements.

Control 5.23 allows organisations to first specify then subsequently manage and administer information security concepts as related to cloud services, in their capacity as a “cloud services customer”.

5.23 is a preventative control that maintains risk by specifying policies and procedures that govern information security, within the sphere of commercial cloud services.

Attributes of Control 5.23

Ownership of Control 5.23

Such is the proliferation of cloud services over the past decade, Control 5.23 contains a host of procedures that encompass many distinct elements of an organisation’s operation.

Given that not all cloud services are ICT specific – although it could reasonably be asserted that most are – ownership of Control 5.22 should be distributed between an organisation’s CTO or COO, depending upon the prevailing operational circumstances.

Guidance on Control 5.23 – Organisational Obligations

Compliance with Control 5.23 involves adhering to what’s known as a ‘topic-specific’ approach to cloud services and information security.

Given the variety of cloud services on offer, topic-specific approaches encourage organisations to create cloud services policies that are tailored towards individual business functions, rather than adhering to a blanket policy that applies to information security and cloud services across the board.

It should be noted that ISO considers adherence to Control 5.23 as a collaborative effort between the organisation and their cloud service partner. Control 5.23 should also be closely aligned with Controls 5.21 and 5.22, which deal with information management in the supply chain and the management of supplier services respectively.

However an organisation chooses to operate, Control 5.23 should not be taken in isolation and should complement existing efforts to manage supplier relationships.

With information security at the forefront, the organisation should define:

1. Any relevant security requirements or concerns involved in the use of a cloud platform.
2. The criteria involved in selecting a cloud services provider, and how their services are to be used.
3. Granular description of roles and relevant responsibilities that govern how cloud services areto be used across the organisation.
4. Precisely which information security areas are controlled by the cloud service provider, and those that fall under the remit of the organisation themselves.
5. The best ways in which to first collate then utilise any information security-related service components provided by the cloud service platform.
6. How to obtain categorical assurances on any information security-related controls enacted by the cloud service provider.
7. The steps that need to be taken in order to manage changes, communication and controls across multiple distinct cloud platforms, and not always from the same supplier.
8. Incident Management procedures that are solely concerned with the provision of cloud services.
9. How the organisation expects to manage its ongoing use and/or wholesale adoption of cloud platforms, in-line with their broader information security obligations.
10. A strategy for the cessation or amendment of cloud services, either on a supplier-by-supplier basis, or through the process of cloud to on-premise migration.

Guidance on Control 5.23 – Cloud Services Agreements

Control 5.23 acknowledges that, unlike other supplier relationships, cloud service agreements are rigid documents that aren’t amendable in the vast majority of cases.

With that in mind, organisations should scrutinise cloud service agreements and ensure that four main operational requirements are met:

1. Confidentiality
2. Security/data integrity
3. Service availability
4. Information handling

As with other supplier contracts, prior to acceptance, cloud service agreements should undergo a thorough risk assessment that highlights potential problems at source.

At a bare minimum, the organisation should enter into a cloud services agreement only when they are satisfied that the following 10 provisions have been met:

1. Cloud services are provisioned and implemented based on the organisation’s unique requirements relating to their area of operation, including industry accepted standards and practices for cloud-based architecture and hosted infrastructure.
2. Access to any cloud platforms meet the border information security requirements of the organisation.
3. Adequate consideration is given to antimalware and antivirus services, including proactive monitoring and threat protection.
4. The cloud provider adheres to a predefined set of data storage and processing stipulations, relating to one or more distinct global regions and regulatory environments.
5. Proactive support is provided to the organisation, should the cloud platform suffer a catastrophic failure or information security-related incident.
6. If the need arises to sub-contract or otherwise outsource any element of the cloud platform, the supplier’s information security requirements remain a constant consideration.
7. Should the organisation require any assistance in collating digital information for any relevant purpose (law enforcement, regulatory alignment, commercial purposes), the cloud services provider will support the organisation as far as is possible.
8. At the end of the relationship, the cloud service provider should provide reasonable support and appropriate availability during the transition or decommissioning period.
9. The cloud service provider should operate with a robust BUDR plan that is focused on carrying out adequate backups of the organisation’s data.
10. The transfer of all relevant supplementary data from the cloud services provider to the organisation, including config information and code that the organisation has a claim to.

Supplementary Information on Control 5.23

In addition to the above guidance, Control 5.23 suggests that organisations form a close working relationship with cloud service providers, in accordance with the important service they provide not only in information security terms, but across an organisation’s entire commercial operation.

Organisations, where possible, should seek out the following stipulations from cloud service providers to improve operational resilience, and enjoy enhanced levels of information security:

1. All infrastructure amendments should be communicated in advance, to inform the organisation’s own set of information security standards.
2. The organisation needs to be kept informed of any changes to data storage procedures that involve migrating data to a different jurisdiction or global region.
3. Any intention on the part of the cloud service provider to utilise “peer cloud” providers, or outsource areas of their operation to subcontractors that may have information security implications for the organisation.

Supporting Controls

• 5.21
• 5.22

Changes from ISO 27002:2013

Control 5.23 is a new control that doesn’t feature in ISO 27002:2013 in any capacity.

New ISO 27002 Controls

How ISMS.online Helps

ISMS.online streamlines the ISO 27002 implementation process by providing a sophisticated cloud-based framework for documenting information security management system procedures and checklists to assure compliance with recognised standards.

When you use ISMS.online, you will be able to:

• Create an ISMS that is compatible with ISO 27001 standards.
• Perform tasks and submit proof to indicate that they have met the requirements of the standard.
• Allocate tasks and track progress toward compliance with the law.
• Get access to a specialised team of advisors that will assist you throughout your path towards compliance.

Get in touch and book a demo.