Information Security for Use of Cloud Services
Description
Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organisation's information security requirements.
⚠️ Risk Impact
Cloud services have different risk profiles depending on shared-responsibility model. Treating IaaS the same as SaaS produces controls that miss the actual risks of each.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as high-severity findings with remediation guidance.
🔧 Remediation
Document cloud shared-responsibility per service (IaaS / PaaS / SaaS). Align controls to CIS benchmarks per provider. Document exit plan per critical service (data extraction, alternate provider).
💀 Real-World Attack Scenario
A SaaS company built customer-facing analytics on a vendor's BI service. The vendor was acquired; pricing tripled; customer migration disrupted analytics for 6 weeks. No exit plan existed because 'we have a 3-year contract'. The lock-in cost: 6 weeks of degraded service + $400K rebuilding analytics elsewhere.
💰 Cost of Non-Compliance
Cloud-service lock-in incidents: 12% of enterprises experienced material disruption in 2024 (Gartner Cloud Lock-in 2024). Avg disruption cost: $1.2M per service.
📋 Audit Questions
- 1.Show the cloud shared-responsibility matrix per service.
- 2.What is the exit plan for your top-3 cloud services?
- 3.How are cloud configurations baselined against CIS?
- 4.Has any cloud service exit been executed in the last 2 years?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Treating SaaS the same as IaaS — controls misaligned to actual risk
- ⛔No exit plan documented — locked in by inertia
- ⛔Cloud configurations drift from CIS baseline without detection
📈 Business Value
Cloud-service maturity reduces lock-in risk + ensures controls match each service's actual responsibility split.
⏱️ Effort Estimate
20-40 hours per service for responsibility matrix + exit plan
EchelonGraph evaluates cloud configurations against CIS benchmarks per provider
🔗 Cross-Framework References
Automate ISO 27001 A.5.23 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →