Policy Register
Every policy type · Suppliers and third parties

Cloud vendor management policy

How cloud providers in particular are chosen, contracted, monitored and left, with the exit plan and the data return written down.

How the register reads it

Also calledcloud provider management, cloud exit
FamilySuppliers and third parties
Document typePolicy. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted.
Folds intoThe regimes accept it folded into the cloud security policy; when neither is listed, the gap is counted once, under the parent.
Expected ownerProcurement or the vendor manager, with the information security lead.
Review cadenceAnnual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period).
On the gap list whennever on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, cloud security policy, is).
TemplateCloud vendor management policy.

Which standards require it, and what each expects it to contain

2 requiring clauses, 2 regimes

Shown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.

ISO/IEC 27001:2022

ISO 27001 5.23 Information security for use of cloud services

Govern acquisition, use, management and exit of cloud services against your security requirements.

What the ISO 27002 guidance expects the document to say: Requires processes for the acquisition, use, management and exit of cloud services to be established in line with the organisation's own information security requirements. Supporting material frames the aim as preserving confidentiality, integrity and availability of information assets held in cloud services.

Evidence an auditor accepts: The process covering cloud acquisition, use, management and exit, including who may acquire a cloud service; the register of cloud services in use, with data classification, owner and criticality per service; the shared responsibility position documented per service, showing which controls the provider operates and which the organisation must
Common gap: Relying solely on provider's security assurances
Source: ISO/IEC 27001:2022; guidance ISO/IEC 27002:2022

DORA (Regulation (EU) 2022/2554)

DORA Art. 28 ICT third-party risk: general principles

Financial entities shall manage ICT third-party risk as an integral component of ICT risk, maintain a Register of Information on all contractual arrangements for the use of ICT services, report it to competent authorities, assess risk before entering arrangements (including concentration and subcontracting), and adopt an ICT third-party risk strategy.

Evidence an auditor accepts: A Register of Information of ICT third-party arrangements reported to the competent authority; pre-contract risk assessment records
Common gap: No Register of Information
Source: DORA (Regulation (EU) 2022/2554)

Do this for every document on your list

Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.

Build a register

Zero trust architecture standard · Outsourcing policy