Security Compliance for Cloud Services

Written by Ashwin Chaudhary, CEO, Accedere.

Cloud computing is a model for enabling on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. Cloud security compliance is one of the most important compliance requirements.

How to comply

Organizations using cloud services can comply with information security requirements by implementing the following controls:

• Establish and communicate topic-specific policy on the use of cloud services to all relevant interested parties.
• Define and communicate the intent on how to manage information security risks related to the use of cloud services.
• As cloud services use a shared responsibility model, the responsibilities of both the cloud service provider (CSP) and the cloud service customer (CSC) are defined and implemented appropriately to ensure information security requirements.
• Establish roles and responsibilities related to the use and management of cloud services.
• Establish procedures for handling information security incidents that occur in relation to the use of cloud services.
• Establish procedures for monitoring, reviewing, and evaluating the ongoing use of cloud services to manage information security risks
• Establish change or exit procedures for cloud services.
• For all cloud services, the organization should review cloud service agreements with the cloud service providers.
• A cloud service agreement should address the confidentiality, integrity, availability, and information handling requirements of the organization, with appropriate cloud service level objectives and cloud service qualitative objectives.
• Any residual risks connected to the use of the cloud service should be clearly identified and accepted by the appropriate management of the organization.

Required High Level Documentation and Records

• Cloud Services Security Policy and Procedures
• Security Incident Response Playbook, Incident register with all relevant information
• Supplier Risk and Performance Evaluation

Standards that Address Cloud Security Requirements

Cloud security standards provide clear guidelines for organizations to secure cloud environments and mitigate the risk of cyberattacks. The standards facilitate organizations to assess cloud security posture. The widely accepted standards are listed below.

About the Author

Ashwin Chaudhary is the CEO of Accedere, a Data Security, Privacy Audit, and Training Firm. He is a CPA from Colorado, MBA, CITP, CISA, CISM, CGEIT, CRISC, CISSP, CDPSE, CCSK, PMP, ISO27001 LA, ITILv3 certified cybersecurity professional with about 20 years of cybersecurity/privacy and 40 years of industry experience. He has managed many cybersecurity projects covering SOC reporting, ISO audits, VAPT assessments, Privacy, IoT, Governance Risk, and Compliance.