Policy Register
Every policy type · Operations and technology

Cloud security policy

How cloud services are selected, configured, used and left: the shared responsibility, the data location, the exit, the accounts.

How the register reads it

Also calleduse of cloud services, SaaS policy
FamilyOperations and technology
Document typePolicy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Expected ownerThe information security lead (CISO or ISMS manager).
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whenISO 27001 is ticked and no line resolves to it (DORA requires it too, inside a parent document, so it does not list it separately).
TemplateCloud security policy.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.23 Information security for use of cloud services

Govern acquisition, use, management and exit of cloud services against your security requirements.

What the ISO 27002 guidance expects the document to say: Requires processes for the acquisition, use, management and exit of cloud services to be established in line with the organisation's own information security requirements. Supporting material frames the aim as preserving confidentiality, integrity and availability of information assets held in cloud services.

Evidence an auditor accepts: The process covering cloud acquisition, use, management and exit, including who may acquire a cloud service; the register of cloud services in use, with data classification, owner and criticality per service; the shared responsibility position documented per service, showing which controls the provider operates and which the organisation must
Common gap: Relying solely on provider's security assurances
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

DORA (Regulation (EU) 2022/2554)

DORA Art. 28 ICT third-party risk: general principles

Financial entities shall manage ICT third-party risk as an integral component of ICT risk, maintain a Register of Information on all contractual arrangements for the use of ICT services, report it to competent authorities, assess risk before entering arrangements (including concentration and subcontracting), and adopt an ICT third-party risk strategy.

Evidence an auditor accepts: A Register of Information of ICT third-party arrangements reported to the competent authority; pre-contract risk assessment records
Common gap: No Register of Information
Source: DORA (Regulation (EU) 2022/2554)

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Change management procedure · Configuration management policy