Requirement
Cybersecurity requirements related to the use of hosting and cloud computing services must be defined, documented and approved.
Control Implementation Guidelines
- Develop and document cybersecurity policy for cloud computing and hosting services in the organization, including the following:
- Cloud computing and hosting services providers contract requirements.
- Requirements for the location of hosting and storing the organization's systems and data.
- Requirements for data removal and retrieval.
- Classification of data prior to hosting/storing on cloud computing or hosting services.
- Inclusion of Service Level Agreement "SLA".
- Inclusion of Non-disclosure Clauses.
- Support the organization's policy by the Executive Management. This must be done through the approval of the organization head or his/her deputy.
Relevant Cybersecurity Tools
- Cloud Computing and Hosting Cybersecurity Policy Template
Expected Deliverables
- Cybersecurity policy that covers the requirements of the use of cloud computing and hosting services (e.g., electronic copy or official hard copy).
- Formal approval by the head of the organization or his/her deputy on the policy (e.g., via the organization's official e-mail, paper or electronic signature).
