Cloud Security Policy Template

12

sections the document needs

4

wordings people reliably get wrong

7

things an auditor asks to see

a day

to write it yourself

Get this as an editable Word document - your first document is free Card required; no charge today.

1. 1

   Purpose

   What it must contain

   Why the policy exists: the business runs on cloud services, and this document makes adopting them safe and repeatable rather than forbidden.

   What the auditor checks

   Whether the policy is written to be used. A policy that reads as a prohibition gets routed around, and the register that follows it will be empty while the expense report is not.

2. 2

   Scope

   What it must contain

   Every service model - SaaS, PaaS and IaaS - every environment, and everyone who buys, builds on, connects or administers a cloud service, contractors included. Free tiers and trials are in scope.

   What the auditor checks

   The free-tier sentence, specifically. It is the single line that closes the most common gap, because the services nobody paid for are the ones nobody recorded.

3. 3

   Roles and the shared responsibility model

   What it must contain

   Who is responsible for what between you and the provider, stated plainly enough that nobody has to interpret a diagram during an incident.

   What the auditor checks

   This is the clause people get wrong most, and an auditor tests it by asking who secures a specific setting in a specific service. A policy that says 'the provider handles security' fails on the first question.

   [Organization] uses cloud services under a shared responsibility model. The provider is responsible for the security of the service itself; [Organization] remains responsible for everything it configures and puts into the service, including user accounts and access, security settings, integrations, and the data stored or processed there. Accountability for [Organization]'s information cannot be transferred to a provider, whatever the contract says.

   It splits the responsibility by what each party controls rather than by product name, so it stays true when you add a service the policy has never heard of.

4. 4

   Approved services and the cloud service register

   What it must contain

   The register that makes the policy enforceable: service, business owner, data classification held, storage region, approval date - and a named owner for the register itself.

   What the auditor checks

   They will read the register against reality: the expense report, the SSO logs, the browser extensions. A register nobody owns is the first thing that breaks, because nothing adds to it after the week it was created.

5. 5

   Approving a new cloud service

   What it must contain

   Who approves, what is checked before approval - security certifications, data location, terms, sub-processors - and how long it takes.

   What the auditor checks

   Evidence of the check, not just the outcome. An approval that exists only as a thumbs-up in a chat thread is an approval nobody can reconstruct a year later.

   Staff must not sign up for, connect or pay for a new cloud service on behalf of [Organization] without approval from [role]. This includes free tiers, trials and AI tools, and it includes connecting a new app to an approved service. Approved services are recorded in the cloud service register; anything not in the register is not approved. If a service you need is missing, request it; approval normally takes [n] business days.

   It names the three cases people assume are exempt, then gives a route and a timeframe - which is what stops the rule being bypassed rather than merely broken.

6. 6

   Accounts, access and administrators

   What it must contain

   Single sign-on wherever the service supports it, multi-factor authentication on everything, least privilege, named administrators, no shared accounts, and leaver access removed the same day.

   What the auditor checks

   Named administrators for the two or three most critical services, and what happened to the last leaver's access. The staff-facing versions of these rules belong in the acceptable use policy; this is the service-side counterpart.

7. 7

   Data protection and residency

   What it must contain

   Which class of information may go into which class of service, encryption in transit and at rest, who holds the keys, and where data is allowed to live.

   What the auditor checks

   Whether residency was decided or defaulted. Most providers offer a region choice once, at setup, and never mention it again.

   [Organization]'s data may only be stored or processed in the regions recorded in the cloud service register for that service. Where a provider offers a choice of region, [role] selects it before the service goes live and records it. Services that cannot commit to a storage location may not hold [confidential or restricted] information.

   It ties residency to the register rather than to a list that will go stale, and it gives a clear answer for providers that cannot commit - which is the case the generic templates leave out.

8. 8

   Secure configuration and change

   What it must contain

   A baseline for each major platform, who may change security settings, and a periodic check for drift.

   What the auditor checks

   The baseline and the reviewer, by name. Most cloud findings are configuration findings, so this section is where the policy either becomes testable or stays decorative.

9. 9

   Logging and monitoring

   What it must contain

   What is logged for each critical service, who reviews the alerts, how long logs are kept, and that administrator actions are in scope.

   What the auditor checks

   Who read the last alert. Retention and coverage are easy to state and easy to check; the reviewer is the part that is usually missing.

10. 10

    Backup, resilience and exit

    What it must contain

    Backups where the shared responsibility split puts them on you, what you assume during an outage, and an exit note for each critical service.

    What the auditor checks

    The exit note, which almost nobody writes. The provider's durability is not your backup, and 'we would export it' is not a plan until someone has checked the export exists.

    Before a cloud service holds production data, [role] records how [Organization] would leave it: how data is exported and in what format, how quickly, what the provider deletes after termination and when, and what would replace the service. For each critical service this exit note is reviewed [annually].

    It makes exit a thing recorded before adoption rather than discovered during a dispute, and it names the four facts that actually matter when you have to move.

11. 11

    Contracts and incident notification

    What it must contain

    Security terms in supplier agreements, the provider's duty to notify you of a breach and the clock that starts, and who at your end receives that notice.

    What the auditor checks

    One critical provider's agreement, read for those three things. A critical service on click-through consumer terms is a finding on its own.

12. 12

    Exceptions, breaches and review

    What it must contain

    Who may grant an exception, in writing, with an expiry; what happens when the policy is breached; and an annual review plus triggers - a new critical service, an incident, a provider change.

    What the auditor checks

    Whether the review actually happened, and whether any exception outlived its expiry. An exception with no end date is a policy change nobody approved.

Get this as an editable Word document - your first document is free Card required; no charge today.

Nobody is asked to demonstrate that they take cloud security seriously. You are asked for a register, an approval record and an exit note. These 7 requests cover most of what a cloud section of an audit consists of.

? Show me your cloud service register.

Satisfies A current register naming each service, its business owner, what data it holds and where that data lives - and it matches what the company actually uses.

Fails Three SaaS subscriptions on the corporate card that appear in no register.

? Walk me through how this recently adopted service was approved.

Satisfies A record of what was checked before approval - certifications, data location, terms, sub-processors - and who approved it.

Fails An approval recorded as a chat thumbs-up, with nothing about data location or terms.

? Show me multi-factor authentication and administrator accounts for your most critical services.

Satisfies MFA enforced, administrators named individually, and access tied to people who still work here.

Fails A shared admin login for the billing portal, with the password in a spreadsheet.

? What is your baseline configuration, and who reviews changes to it?

Satisfies A documented baseline per major platform and a named reviewer, with evidence of a recent check.

Fails A storage bucket set public two years ago that nobody has looked at since.

? Show me the supplier agreement for one critical provider.

Satisfies Security terms, a breach-notification obligation with a timeframe, and exit provisions.

Fails A critical provider on click-through consumer terms with no notification clause.

? How would you get your data out of this service?

Satisfies The exit note: export format, how long it takes, what the provider deletes and when, and what would replace the service.

Fails No answer beyond hoping the export button works.

? When were the policy and the register last reviewed?

Satisfies Dated review records for both, plus changes made after a new critical service or an incident.

Fails A policy dated three years ago naming a platform the business no longer uses.

None of these are about the cloud. They are about a document written for a business other than yours, and a register nobody kept.

• ! The policy bans what the business already runs on

  Written against an imagined estate rather than the real one. The finding writes itself the moment the register shows forty services and the policy allows five. Start from what is in use, decide what to keep, and write the rule that gets you from here to there.

• ! A register nobody owns

  The register is the policy's enforcement mechanism, so an unowned one takes the policy down with it. Name an owner, and name the discovery triggers that feed it: supplier onboarding, expense reports, single sign-on logs. Without triggers it records only the services someone remembered to mention.

• ! "The provider is certified, so we are covered"

  Their certificate covers their side of the shared responsibility model. Your accounts, your settings, your integrations and your data are still yours, and customer-side misconfiguration is where cloud incidents come from - not provider compromise. A certificate is due diligence evidence, not a control you implemented.

• ! An enterprise policy in a ten-person company

  Cloud centres of excellence, tooling mandates and quarterly architecture boards, copied out of a template built for a company with a platform team. An unenforceable clause costs you the enforceable ones, because an auditor who finds one rule nobody follows starts testing the rest.

Same structure as the guide, with none of the decisions left to you: your service models named, your register owner and discovery triggers set, residency and retention written for the regions you actually use, and an exit note per critical service. It cites A.5.23, carries your branding, and exports to Word, PDF or Excel. The cover in the hero and the body page below are exactly that output, generated for an example company.

Both routes end with the same 12 sections. What differs is how many of the decisions inside them you make alone, and who checks the result before an auditor does.

Scroll the table sideways to compare both routes.