Control 5.23 treats a cloud service as something you enter, run and eventually leave.

1. 5.23
   Information security for use of cloud servicesSet the rules for acquiring, using, managing and exiting cloud services, matched to your security needs.

A cloud provider is a supplier, so the supplier controls (5.19 to 5.22) still apply. Control 5.23 adds what is particular to cloud: the provider runs part of the stack, the customer runs the rest, and the line between them changes with every service model. The control wants that line written down and the customer's half actually done.

It covers every cloud service in scope, not only the main hosting platform. A single SaaS tool that holds customer records is in scope too.

1. 01

   Select

   Decide what the service will hold and check the provider can protect it.

   What happens

   • Classify the data the service will hold
   • Review the provider's assurance and data locations
   • Compare against your cloud policy requirements

   You get

   • A short selection record with the decision and its owner

   Good practice

   • Assurance scope checked against the exact service

   Watch for

   • Buying on a card before anyone asks what data goes in

2. 02

   Agree

   Fix the terms and the split of duties.

   What happens

   • Read the provider's shared-responsibility statement
   • Map each duty to provider, you or both
   • Note gaps in standard terms

   You get

   • A responsibility map
   • Signed terms or a recorded risk decision

   Good practice

   • Every customer duty has a named owner

   Watch for

   • Assuming the provider handles backups or logging by default

3. 03

   Onboard

   Set up the service securely before real data arrives.

   What happens

   • Apply single sign-on and multi-factor sign-in
   • Apply the configuration baseline
   • Turn on logging and alerts

   You get

   • A configured tenant that matches the baseline

   Good practice

   • Admin accounts kept separate and few

   Watch for

   • Production data loaded during a trial on default settings

4. 04

   Operate

   Keep the configuration where you set it.

   What happens

   • Check for drift from the baseline
   • Review admin access
   • Track provider notices and changes

   You get

   • Drift reports, access reviews, change notices handled

   Good practice

   • Automated checks where the platform offers them

   Watch for

   • One-off hardening never checked again

5. 05

   Exit

   Be able to leave without losing data or leaving copies behind.

   What happens

   • Know the export format and method
   • Plan the move to an alternative
   • Get deletion confirmed

   You get

   • An exit plan, and on exit a deletion record

   Good practice

   • Export tested once, not just read about

   Watch for

   • Discovering the export limits during a dispute

This is a general pattern. Each provider publishes its own split, and the details vary by service. Use theirs as the source and keep your map beside it.

A configuration baseline is the set of settings a service must keep: who can be an administrator, how sign-in works, whether storage is private by default, which logs are on and where they go, how long they are kept. Public benchmarks for the major platforms are a sound starting point. Adjust them to your risk and record why.

• Identity. Single sign-on, multi-factor sign-in for every human, a small set of break-glass accounts kept apart.
• Storage. Private by default, encryption on, public sharing an exception with an approval.
• Logging. Administrative activity logged to a place the service's own admins cannot erase.
• Network. Management interfaces not open to the internet without a reason that is recorded.
• Keys and secrets. Who controls encryption keys, and where secrets are stored.

• The cloud policy or the section of the supplier policy that covers cloud
• A list of cloud services in scope, each with an owner and the data it holds
• The responsibility map for a sampled service
• The baseline and a recent drift or posture report, with fixes traced
• The exit plan for a critical service

• Only the main platform listed. SaaS tools holding customer data sit inside 5.23 too, and auditors find them in the expense records.
• Provider report treated as cover. The provider's assurance covers its half. Your half needs its own evidence.
• Exit plan as a sentence. "We would migrate" is not a plan. Name the format, method and destination.
• Baseline with no check. A written standard that no report ever compares against is an intention, not a control.

Sources: ISO/IEC 27001:2022 Annex A control name 5.23 and its supplier neighbours 5.19 to 5.22; ISO/IEC 27002:2022 as background (not quoted); ISO/IEC 27017 on information security controls for cloud services; the major cloud providers' published shared-responsibility statements for the general pattern. The table and phases are our own illustration.