What it asks for. This control expects processes for acquiring, using, managing and exiting from cloud services to be established in line with the organisation's information security requirements. It was new in the 2022 edition.
In practice. Good practice means a cloud policy that defines how cloud services are selected and approved, how responsibilities are shared with providers, which security settings are required and how the organisation exits a service. Provider assurance, such as certifications or audit reports, is reviewed. Auditors look for an inventory of cloud services, assessments, configuration standards and exit plans.
Common gaps. Typical gaps are shadow SaaS outside the inventory, misunderstanding of shared responsibility and no exit strategy for critical providers. Provider assurance reports are also collected but seldom read.