Security Compliance for Cloud Services

Written by Ashwin Chaudhary, CEO, Accedere.

Cloud computing is a model for enabling on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Cloud security compliance is one of the most important compliance requirements.

How to comply

Organizations using cloud services can comply with information security requirements by implementing the following controls:

• Establish and communicate topic-specific policy on the use of cloud services to all relevant interested parties.
• Define and communicate the intent on how to manage information security risks related to the use of cloud services.
• As cloud services use a shared responsibility model, the responsibilities of both the cloud service provider (CSP) and the cloud service customer (CSC) are defined and implemented appropriately to ensure information security requirements.
• Establish roles and responsibilities related to the use and management of cloud services.
• Establish procedures for handling information security incidents that occur in relation to the use of cloud services.
• Establish procedures for monitoring, reviewing, and evaluating the ongoing use of cloud services to manage information security risks
• Establish change or exit procedures for cloud services.
• For all cloud services, the organization should review cloud service agreements with the cloud service providers.
• A cloud service agreement should address the confidentiality, integrity, availability, and information handling requirements of the organization, with appropriate cloud service level objectives and cloud service qualitative objectives.
• Any residual risks connected to the use of the cloud service should be clearly identified and accepted by the appropriate management of the organization.

Required High Level Documentation and Records

• Cloud Services Security Policy and Procedures
• Security Incident Response Playbook, Incident register with all relevant information
• Supplier Risk and Performance Evaluation

Standards that Address Cloud Security Requirements

Cloud security standards provide clear guidelines for organizations to secure cloud environments and mitigate the risk of cyberattacks. The standards facilitate organizations to assess cloud security posture. The widely accepted standards are listed below.

Standard	Description
ISO/IEC 27001:2022 A.5.23	Information security requirements need to be ensured for acquisition, use, management, and exit from cloud services.
CSA STAR Level 1 CAIQ	Consensus Assessments Initiative Questionnaire v4.0.2(Self-assessment).
CSA STAR Level 2 SOC2 Attestation	The CSA STAR Attestation is a collaboration between the CSA and the AICPA to provide guidelines for CPAs to conduct SOC 2 engagements using criteria from the AICPA (Trust Service Principles, AT 101) and the CSA Cloud Controls Matrix. The STAR Attestation provides for rigorous third-party independent assessments of cloud providers. Attestation listings will expire after one year unless updated.
CSA STAR Level 2 ISO 27001 Certification	The CSA STAR Certification is a rigorous third-party independent assessment of the security of a cloud service provider. This technology-neutral certification leverages the requirements of the ISO/IEC 27001 management system standard together with the CSA Cloud Controls Matrix. Certification certificates follow normal ISO/IEC 27001 protocol and expire after three years unless updated.
ISO/IEC 27017:2015	ISO/IEC 27017:2015 gives guidelines for information security controls applicable to the provision and use of cloud services by providing.
ISO/IEC 27018:2019	Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors.
NIST SP 500-292	The NIST Cloud Computing Reference Architecture is a special publication (NIST SP 500-292) that delineates a cloud security architecture to facilitate cloud security.

---

About the Author

Ashwin Chaudhary is the CEO of Accedere, a Data Security, Privacy Audit, and Training Firm. He is a CPA from Colorado, MBA, CITP, CISA, CISM, CGEIT, CRISC, CISSP, CDPSE, CCSK, PMP, ISO27001 LA, ITILv3 certified cybersecurity professional with about 20 years of cybersecurity/privacy and 40 years of industry experience. He has managed many cybersecurity projects covering SOC reporting, ISO audits, VAPT assessments, Privacy, IoT, Governance Risk, and Compliance.