An outsourced cloud service register is developed, implemented, maintained and verified on a regular basis.
Topic
Outsourced cloud services
Applicable to
Non Classified, Official, Protected, Secret, Top Secret
History
Dec 2022
An outsourced cloud service register is developed, implemented, maintained and verified on a regular basis.
Existing controls relating to the maintenance of registers were amended to ensure registers are developed and implemented in the first instance.
Mar 2022
An outsourced cloud service register is maintained and verified on a regular basis.
Due to the confusing use of audit terminology, references to ‘audited’ have been changed to ‘verified’. For example, an ICT equipment register is verified (rather than audited) on a regular basis. This will allow security personnel, or other suitable parties, to conduct such activities rather than having to rely on the use of an organisation’s internal auditors.
Jan 2021
An outsourced cloud services register is maintained and regularly audited.
Two new security controls have been added to capture the identification and recording of outsourced cloud services.