ISO 27001:2022 · Organizational controls
ISO 27001:2022 5.23: Information security for use of cloud services
ISO 27001:2022 5.23 covers Information security for use of cloud services. The held text names 5 evidence records for it, the first being Statement of Applicability entry for control A.5.23, showing inclusion or justified exclusion, implementation status and the risks it.... The common gap an assessor flags is Cloud services are adopted by business units without passing through the policy or selection....
Processes for buying, using, managing and leaving cloud services are to be set up so that they satisfy what the organization requires for information security. Purpose (stated in ISO/IEC 27002:2022): specifies and manages information security for the organization's use of cloud services. As an Annex A reference control, it is compared with the controls determined in risk treatment (6.1.3 c) and recorded in the Statement of Applicability as included or excluded, with the justification and implementation status (6.1.3 d); implementation guidance is ISO/IEC 27002:2022 5.23.
What evidence supports 5.23?
- Annex A organizational controlStatement of Applicability entry for control A.5.23, showing inclusion or justified exclusion, implementation status and the risks it treats
- Annex A organizational controlThe topic-specific cloud services policy with selection criteria and scope of permitted use
- Annex A organizational controlA shared responsibility matrix per cloud service showing which controls the provider operates and which the organization operates
- Annex A organizational controlCloud risk assessments with documented management acceptance of residual risk
- Annex A organizational controlReviewed cloud service agreements covering data location, incident support, subcontracting, evidence gathering, backup and return of data
Where this requirement comes from
This is our own statement of ISO 27001:2022 5.23, read from the copy we hold (licensed complete copy) and stated in our words, not the standard verbatim. The framework as we hold it.
Common gaps an assessor flags
- Cloud services are adopted by business units without passing through the policy or selection criteria
- Customer-side responsibilities such as identity and configuration are assumed to belong to the provider
- No exit strategy exists, so data retrieval on termination is untested
- Data location and subcontractor changes by the provider go unnoticed
How it maps to SOC 2
No reviewed link is held for this control.
A link is a topical overlap with a confidence and a reason. It does not establish that meeting one requirement satisfies the other, and it is not certification.