A.5.23ISO 27001Last reviewed 19 February 2026

ISO 27001 A.5.23: Information security for use of cloud services

Nearly every organisation runs on cloud services now, and the 2022 revision of ISO 27001 added this control to reflect that reality. Cloud introduces security challenges that do not fit neatly into traditional supplier management - the shared responsibility model being the biggest one.

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start my free ISO 27001 assessmentNo account · No credit card · Save when useful

Requirement summary

Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization's information security requirements.

Check the source wording and scope in ISO/IEC 27001:2022. The guidance below explains how to approach a review.

In Plain Language

The control covers the full cloud lifecycle: evaluating and selecting providers, configuring services securely, understanding who is responsible for what, monitoring your cloud security posture, and having a plan for when you need to move off a provider.

The shared responsibility model is the critical concept here. Your cloud provider secures the infrastructure. You secure everything you put on it - your data, your access controls, your application configurations. The exact split depends on whether you are using IaaS, PaaS, or SaaS, and getting this wrong is one of the most common sources of cloud breaches.

How to Implement

Write a cloud security policy covering: which cloud service models and deployment types are approved, security criteria for selecting providers, data classification restrictions for cloud environments, shared responsibility requirements, and exit strategy expectations.

Set up a proper provider evaluation process. Assess against: certifications (SOC 2 Type II, ISO 27001, CSA STAR), data protection capabilities (encryption, key management, data residency), IAM features, logging and monitoring, incident response and breach notification, and data portability support.

Implement your side of the shared responsibility model thoroughly. For each cloud service, document who owns what. Harden configurations using CIS benchmarks or equivalent baselines. Set up strong IAM with MFA, RBAC, and just-in-time access for admin functions. Do not rely on default settings.

Deploy cloud security monitoring. Use cloud-native tools (AWS Security Hub, Azure Security Center, GCP Security Command Center) and consider CSPM tools if you are running multi-cloud. Watch for misconfigurations, overly broad permissions, unencrypted data, and publicly exposed resources. Add workload protection for compute resources.

Plan your exit strategy from day one. Understand data export options, formats, and migration paths before you are locked in. Include exit clauses in agreements covering data return, deletion confirmation, and transition support. Test data export and recovery periodically. Avoid deep vendor lock-in by using portable standards and abstraction layers where practical.

Evidence to review

Cloud security policy defining requirements for cloud service usage
Cloud provider security assessments and selection records
Shared responsibility documentation for each major cloud service
Cloud security configuration baselines and compliance monitoring results
Cloud exit strategy documentation and data portability testing records

Common Mistakes

No formal cloud security policy or cloud provider assessment process
Shared responsibility model is not understood or documented for each service
Cloud services are misconfigured with default settings that expose data publicly
No cloud security posture management or monitoring for misconfigurations
No exit strategy resulting in vendor lock-in without data portability options

Related Controls Across Frameworks

Framework	Control ID	Relationship
SOC 2	SOC 2 CC6.1: Logical and Physical Access - Security Software, Infrastructure, and Architectures	Partial overlap
SOC 2	SOC 2 CC9.2: Risk Mitigation - Vendor and Business Partner Risk Management	Related
GDPR	GDPR Art.28: Processor	Related
GDPR	GDPR Art.32: Security of Processing	Related
NIS2	NIS2 Art.21(2)(e): Security in Network and Information Systems Acquisition, Development and Maintenance	Related

Frequently Asked Questions

Is this control new in ISO 27001:2022?

Yes, it is one of the 11 new controls added in the 2022 revision. ISO recognised that cloud adoption had become so widespread that it needed its own dedicated control rather than being covered indirectly through general supplier management. If you are transitioning from the 2013 version, this is one you need to build from scratch.

What is the shared responsibility model?

It defines the security split between the cloud provider and you. With IaaS, you manage everything from the operating system up - the provider handles the physical infrastructure and virtualisation layer. With PaaS, the provider also handles the OS and runtime; you manage applications and data. With SaaS, the provider handles most of the stack; you manage access control, data classification, and user behaviour. The boundaries shift with each model, so you need to map this out for every cloud service you use. Most cloud security incidents happen because someone assumed the provider was handling something they were not.

Track ISO 27001 compliance in one place

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start Free Assessment

Start without an account · Sign up only to save

Start my free ISO 27001 assessment