Personal cloud storage at a 45-person agency

Primary concern: confidentiality, with clear integrity and availability side effects.

• Confidentiality is directly exposed: 2.8 TB of client campaign material sits in a personal account outside the agency's control, 30 external people have been invited without contracts, and two passwords appear on a breach list. Reused passwords mean an attacker who obtained those credentials elsewhere may already have access. Because client contracts contain confidentiality clauses, this is also a contractual exposure, not only a technical one.
• Integrity is at risk because nobody can say which version of a file is authoritative. Thirty collaborators can overwrite or delete material, and the email-ZIP workaround creates multiple uncontrolled copies.
• Availability is affected in a practical sense: the 'ban' does not make the Friday deadline disappear. If the only sanctioned method is 400 MB email attachments, staff will find another shadow channel, and the agency may lose access to files held in the personal account if Dropbox suspends it.

The managing director's framing as 'discipline' is incomplete. The sales director's action was a symptom of a missing service: no approved way to share large files externally. Disciplining one person while leaving the need unmet will reproduce the same behaviour. The exam-style judgement is to treat this as a risk and control-design problem owned by management, not as an individual conduct case alone.

The ban is not a risk treatment; it is an unenforceable instruction.

Under ISO/IEC 27001 risk treatment thinking, the options are to modify, avoid, share or retain risk. A total ban attempts 'avoid' but does not avoid the underlying business need. It also drives activity further underground, removes visibility, and makes the agency unable to demonstrate control to clients or auditors. Disciplinary action may be appropriate for a deliberate policy breach, but only after an acceptable-use policy exists and has been communicated.

A proportionate alternative by Friday:

1. Contain the current exposure. Remove the personal account from operational use, retrieve or re-share the files into an agency-controlled location, and force password resets with MFA. If client data may have been exposed, escalate to the client contact and the incident process rather than waiting for the audit.
2. Provide a sanctioned sharing route. Use an agency cloud tenant with SSO and MFA, expiring external links, download limits and an audit log. If procurement cannot complete by Friday, use encrypted archives with out-of-band passwords as a documented interim measure, not as the permanent solution.
3. Classify before sharing. A simple three-level scheme (public, internal, confidential/client) is enough to decide which route is allowed. Label client material confidential and require an external-sharing agreement.
4. Set the rules in writing. An acceptable-use policy should state approved services, prohibition on personal accounts, external-party conditions and reporting duties. Publish it before disciplinary action is threatened.
5. Record the decision. Add the risk to the register with an owner, interim controls and a completion date. The treatment plan should be approved by management, not by IT alone.

This satisfies the business deadline while creating evidence of control, which is what the certification audit will test.

Clause-level requirements

• Clause 6.1.2/6.1.3 - the personal-cloud use should appear in the risk assessment and have a documented treatment decision, including who owns the residual risk.
• Clause 7.3 - awareness: staff did not know that personal accounts were prohibited because no policy existed.
• Clause 7.5 - documented information: policies, external-party register and classification scheme must be controlled.
• Clause 5.2 - the information security policy must set direction for acceptable use, not leave it to an operations manager's ad hoc ban.

Annex A controls that fit

• A.5.10 Acceptable use of information and other associated assets - approved sharing services and prohibited personal accounts.
• A.5.12 Classification of information and A.5.13 Labelling - client material needs a category before a sharing decision.
• A.5.14 Information transfer - rules for transferring information to external parties.
• A.5.15 Access control and A.5.17 Authentication information - MFA and no reused passwords.
• A.5.19/A.5.20 Supplier relationships and agreements - freelancers are external parties and need confidentiality terms.
• A.5.23 Information security for use of cloud services - this is directly on point.
• A.6.7 Remote working and A.8.1 User endpoint devices - freelancers work off-site on their own devices.

First two documents: an acceptable-use/external-sharing policy with a classified data-handling table, and an external-party register recording each freelancer, the data they may receive, the agreement in place and the review date. The policy changes behaviour; the register gives the auditor evidence that the 30 collaborators are known and governed.