Information security for use of cloud services is about keeping your information safe when you use cloud services. It means you must make sure that the company you hire to store your data in the cloud has good security measures in place. This includes setting up rules and agreements with them to protect your data. It also means you need to decide what level of security you need for different types of information.
It is a new control in ISO 27001.
Examples
- A small business uses a cloud service to store its customer list. The business owner checks the service’s security certifications to make sure they are trustworthy. They also sign an agreement that says the cloud company will keep the customer data private and safe.
- A doctor’s office uses a cloud service for patient records. The office has to follow strict laws about patient privacy. So, they make sure their contract with the cloud provider includes a part that says the provider will also follow those same privacy laws.
Context
Cloud services have become very popular for businesses of all sizes. They let companies save money by not having to buy and maintain their own computer servers. However, using these services means you’re giving your data to another company. This is why it’s so important to have a plan to make sure your data is secure. The ISO 27001 control helps you make that plan so you don’t forget any important steps. It ensures you have a good understanding of what your cloud provider is doing to protect your data and what you need to do yourself.
Relevant ISO 27001 Controls
| Related ISO 27001 Control | Relationship Description |
|---|---|
| ISO 27001 Annex A 5.23: Information Security for Use of Cloud Services | Core Requirement: The primary control that mandates organizations define and implement a specific security process for the acquisition, use, management, and exit from cloud services. |
| ISO 27001 Annex A 5.19: Information Security in Supplier Relationships | Governance Overlap: Since cloud providers are essentially third-party suppliers, this control ensures that security requirements are documented and agreed upon in the contract. |
| ISO 27001 Annex A 5.20: Supplier Agreements | Contractual Security: Focuses on the specific security clauses and Service Level Agreements (SLAs) required when using a cloud service provider. |
| ISO 27001 Annex A 5.22: Monitoring of Supplier Services | Ongoing Oversight: Requires regular monitoring and auditing of the cloud provider’s security performance to ensure they continue to meet the organization’s requirements. |
| ISO 27001 Annex A 5.12: Classification of Information | Decision Driver: Information classification determines the level of security and the specific cloud deployment model (public vs. private) required for different data types. |
| Glossary: Confidentiality | Primary Goal: A major focus of cloud security is ensuring that the provider’s multi-tenant environment does not lead to unauthorized disclosure of sensitive data. |
| Glossary: Integrity | Core Objective: Organizations must ensure that the cloud provider has measures (like hashing or access logs) to prevent unauthorized modification of stored information. |
| ISO 27001 Glossary of Terms (Main Index) | Parent Directory: The central index where Information Security for Cloud Services is listed as an essential modern security management term. |
About the author
