Control 5.23 asks you to set security requirements for cloud services, then select, use, manage and end those services in line with them. It is new in ISO 27001:2022. Cover the whole lifecycle, including how you will leave a provider, and keep evidence that you follow your own rules.
The lifecycle
The guidance splits the control into stages:
- Selection: define security requirements and the criteria for choosing a provider.
- Use: define acceptable use of cloud services and manage the service accordingly.
- Management: apply the defined requirements throughout use.
- Exit: define security requirements for cancelling a service.
Exit is the stage most teams forget. Before you sign, know how you would get your data out and have it deleted at the provider.
A selection checklist
Your requirements will depend on your risk assessment, but these are typical headings:
- Identity and access management, including multi factor authentication.
- Encryption of data at rest and in transit.
- Logging and monitoring you can access.
- Where data is stored and who can reach it.
- How incidents are reported to you.
- Export and deletion on exit.
The security features providers usually offer, such as identity and access management, multi factor authentication, encryption, and logging and monitoring, are the technical side of the control. Your job is to turn them on and configure them.
Process and people
Set up processes for requirements, provider selection, acceptable use and cancellation. Make employees aware of cloud risks and train them to use the cloud security features. A shared responsibility mistake is rarely a provider failure. It is usually a setting nobody owned.
Documents
Documents are recommended, not mandatory. Smaller companies can use a supplier security policy. Mid sized and larger companies may write a cloud security policy. Control 5.23 sits next to the control on supplier agreements for cloud services, so read them together.
What the auditor looks for
Evidence that security requirements for cloud services are defined, and evidence that the services are managed according to them. Useful artefacts:
- The written requirements and the selection record for each main provider.
- An inventory of cloud services in use.
- Screenshots or exports of configuration, such as MFA enforcement.
- The exit notes for each critical service.
Safeguard asset discovery can help build the inventory of what is actually running, which is a good place to find cloud services nobody wrote down.
Quick check
Does this apply if we only use SaaS tools?
Yes. Any cloud service you use is in play. Your requirements and management effort can be lighter for low risk tools, as long as your risk assessment supports that.
Do we need an exit plan for every service?
The control asks for exit requirements. Focus the detailed plans on services that hold important data or that you cannot easily replace.
Sources
Last reviewed: 19 October 2026.
