Information security policy for cloud computing and documented information management
Domain 2 tests whether you can build and govern cloud security policy and documented information, not just write an acceptable-use paragraph. The exam looks for management approval, scope, review, communication and control of records.
Core rules and concepts
- Policy hierarchy: information security policy, cloud-specific policy and standards, procedures, then records. A policy states purpose, scope, principles, mandatory requirements, roles, exceptions and review cycle; it is not a service catalogue.
- ISO/IEC 27001 clause 7.5 requires documented information to be created and updated, identified, formatted, reviewed and approved, available, protected, retained and disposed.
- Cloud policy should define approved service categories, data classification and residency, shared responsibility, acquisition and exit, supplier security, access, encryption and key management, logging, incident notification, acceptable use, shadow IT and exceptions.
- Policies must align with contracts and provider terms; exceptions need risk acceptance, owner and expiry.
- Evidence includes approval minutes, version history, communication records, training attestations and exception register. Records must remain legible and retrievable for the required period.
Worked example
Marketing requests an unsanctioned SaaS tool. Policy says only assessed services may hold customer data. Security evaluates data type, provider controls, contract, residency and exit; it approves limited use with SSO, DLP and a review date. Approval and exception are recorded. The review date is tracked, and a provider subprocessor change reopens the approval.
Traps
Copying provider marketing as policy; no owner or management approval; uncontrolled documents; policies not communicated; retaining obsolete versions without marking them; no link between policy, contract and actual configuration.