Back to all 93 controls
Annex A 5.23
Organizational
A.5.23 Information security for use of cloud services
Cloud services are used securely.
What good looks like
Cloud-use policy, shared-responsibility documented, secure configuration baselines.
Evidence an auditor will ask for
Cloud policy, CSP responsibility matrix, baseline configs (CIS).
Document template for this control
The Cloud Security Policy template gives you auditor-ready wording that fulfils Annex A 5.23. Preview the full document before you download the editable version.