Purpose of Control 5.23
5.23 is a new control that outlines the processes that are required for the acquisition, use, management of and exit from cloud services, in relation to the organisation’s unique information security requirements.
Control 5.23 allows organisations to first specify then subsequently manage and administer information security concepts as related to cloud services, in their capacity as a “cloud services customer”.
5.23 is a preventative control that maintains risk by specifying policies and procedures that govern information security, within the sphere of commercial cloud services.
Attributes of Control 5.23
| Control Type | Information Security Properties | Cybersecurity Concepts | Operational Capabilities | Security Domains |
|---|---|---|---|---|
| #Preventative | #Confidentiality | #Protect | #Supplier Relationships Security | #Governance and Ecosystem |
| #Integrity | #Protection | |||
| #Availability |
Ownership of Control 5.23
Such is the proliferation of cloud services over the past decade, Control 5.23 contains a host of procedures that encompass many distinct elements of an organisation’s operation.
Given that not all cloud services are ICT specific – although it could reasonably be asserted that most are – ownership of Control 5.22 should be distributed between an organisation’s CTO or COO, depending upon the prevailing operational circumstances.
ISO 27001 made easy
An 81% Headstart from day one
We’ve done the hard work for you, giving you an 81% Headstart from the moment you log on. All you have to do is fill in the blanks.
Guidance on Control 5.23 – Organisational Obligations
Compliance with Control 5.23 involves adhering to what’s known as a ‘topic-specific’ approach to cloud services and information security.
Given the variety of cloud services on offer, topic-specific approaches encourage organisations to create cloud services policies that are tailored towards individual business functions, rather than adhering to a blanket policy that applies to information security and cloud services across the board.
It should be noted that ISO considers adherence to Control 5.23 as a collaborative effort between the organisation and their cloud service partner. Control 5.23 should also be closely aligned with Controls 5.21 and 5.22, which deal with information management in the supply chain and the management of supplier services respectively.
However an organisation chooses to operate, Control 5.23 should not be taken in isolation and should complement existing efforts to manage supplier relationships.
With information security at the forefront, the organisation should define:
- Any relevant security requirements or concerns involved in the use of a cloud platform.
- The criteria involved in selecting a cloud services provider, and how their services are to be used.
- Granular description of roles and relevant responsibilities that govern how cloud services areto be used across the organisation.
- Precisely which information security areas are controlled by the cloud service provider, and those that fall under the remit of the organisation themselves.
- The best ways in which to first collate then utilise any information security-related service components provided by the cloud service platform.
- How to obtain categorical assurances on any information security-related controls enacted by the cloud service provider.
- The steps that need to be taken in order to manage changes, communication and controls across multiple distinct cloud platforms, and not always from the same supplier.
- Incident Management procedures that are solely concerned with the provision of cloud services.
- How the organisation expects to manage its ongoing use and/or wholesale adoption of cloud platforms, in-line with their broader information security obligations.
- A strategy for the cessation or amendment of cloud services, either on a supplier-by-supplier basis, or through the process of cloud to on-premise migration.
Free yourself from a mountain of spreadsheets
Embed, expand and scale your compliance, without the mess. IO gives you the resilience and confidence to grow securely.
Guidance on Control 5.23 – Cloud Services Agreements
Control 5.23 acknowledges that, unlike other supplier relationships, cloud service agreements are rigid documents that aren’t amendable in the vast majority of cases.
With that in mind, organisations should scrutinise cloud service agreements and ensure that four main operational requirements are met:
- Confidentiality
- Security/data integrity
- Service availability
- Information handling
As with other supplier contracts, prior to acceptance, cloud service agreements should undergo a thorough risk assessment that highlights potential problems at source.
At a bare minimum, the organisation should enter into a cloud services agreement only when they are satisfied that the following 10 provisions have been met:
- Cloud services are provisioned and implemented based on the organisation’s unique requirements relating to their area of operation, including industry accepted standards and practices for cloud-based architecture and hosted infrastructure.
- Access to any cloud platforms meet the border information security requirements of the organisation.
- Adequate consideration is given to antimalware and antivirus services, including proactive monitoring and threat protection.
- The cloud provider adheres to a predefined set of data storage and processing stipulations, relating to one or more distinct global regions and regulatory environments.
- Proactive support is provided to the organisation, should the cloud platform suffer a catastrophic failure or information security-related incident.
- If the need arises to sub-contract or otherwise outsource any element of the cloud platform, the supplier’s information security requirements remain a constant consideration.
- Should the organisation require any assistance in collating digital information for any relevant purpose (law enforcement, regulatory alignment, commercial purposes), the cloud services provider will support the organisation as far as is possible.
- At the end of the relationship, the cloud service provider should provide reasonable support and appropriate availability during the transition or decommissioning period.
- The cloud service provider should operate with a robust BUDR plan that is focused on carrying out adequate backups of the organisation’s data.
- The transfer of all relevant supplementary data from the cloud services provider to the organisation, including config information and code that the organisation has a claim to.
Supplementary Information on Control 5.23
In addition to the above guidance, Control 5.23 suggests that organisations form a close working relationship with cloud service providers, in accordance with the important service they provide not only in information security terms, but across an organisation’s entire commercial operation.
Organisations, where possible, should seek out the following stipulations from cloud service providers to improve operational resilience, and enjoy enhanced levels of information security:
- All infrastructure amendments should be communicated in advance, to inform the organisation’s own set of information security standards.
- The organisation needs to be kept informed of any changes to data storage procedures that involve migrating data to a different jurisdiction or global region.
- Any intention on the part of the cloud service provider to utilise “peer cloud” providers, or outsource areas of their operation to subcontractors that may have information security implications for the organisation.
Supporting Controls
- 5.21
- 5.22
Manage all your compliance, all in one place
ISMS.online supports over 100 standards and regulations, giving you a single platform for all your compliance needs.
Changes from ISO 27002:2013
Control 5.23 is a new control that doesn’t feature in ISO 27002:2013 in any capacity.
New ISO 27002 Controls
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 5.7 | NEW | Threat intelligence |
| 5.23 | NEW | Information security for use of cloud services |
| 5.30 | NEW | ICT readiness for business continuity |
| 7.4 | NEW | Physical security monitoring |
| 8.9 | NEW | Configuration management |
| 8.10 | NEW | Information deletion |
| 8.11 | NEW | Data masking |
| 8.12 | NEW | Data leakage prevention |
| 8.16 | NEW | Monitoring activities |
| 8.23 | NEW | Web filtering |
| 8.28 | NEW | Secure coding |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 6.1 | 07.1.1 | Screening |
| 6.2 | 07.1.2 | Terms and conditions of employment |
| 6.3 | 07.2.2 | Information security awareness, education and training |
| 6.4 | 07.2.3 | Disciplinary process |
| 6.5 | 07.3.1 | Responsibilities after termination or change of employment |
| 6.6 | 13.2.4 | Confidentiality or non-disclosure agreements |
| 6.7 | 06.2.2 | Remote working |
| 6.8 | 16.1.2, 16.1.3 | Information security event reporting |
| ISO/IEC 27002:2022 Control Identifier | ISO/IEC 27002:2013 Control Identifier | Control Name |
|---|---|---|
| 7.1 | 11.1.1 | Physical security perimeters |
| 7.2 | 11.1.2, 11.1.6 | Physical entry |
| 7.3 | 11.1.3 | Securing offices, rooms and facilities |
| 7.4 | NEW | Physical security monitoring |
| 7.5 | 11.1.4 | Protecting against physical and environmental threats |
| 7.6 | 11.1.5 | Working in secure areas |
| 7.7 | 11.2.9 | Clear desk and clear screen |
| 7.8 | 11.2.1 | Equipment siting and protection |
| 7.9 | 11.2.6 | Security of assets off-premises |
| 7.10 | 08.3.1, 08.3.2, 08.3.3, 11.2.5 | Storage media |
| 7.11 | 11.2.2 | Supporting utilities |
| 7.12 | 11.2.3 | Cabling security |
| 7.13 | 11.2.4 | Equipment maintenance |
| 7.14 | 11.2.7 | Secure disposal or re-use of equipment |
How ISMS.online Helps
ISMS.online streamlines the ISO 27002 implementation process by providing a sophisticated cloud-based framework for documenting information security management system procedures and checklists to assure compliance with recognised standards.
When you use ISMS.online, you will be able to:
- Create an ISMS that is compatible with ISO 27001 standards.
- Perform tasks and submit proof to indicate that they have met the requirements of the standard.
- Allocate tasks and track progress toward compliance with the law.
- Get access to a specialised team of advisors that will assist you throughout your path towards compliance.
Get in touch and book a demo.
