[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-23":3},{"item":4,"lessons":16,"controls":22,"related":35},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-23","Annex A 5.23","ISO\u002FIEC 27001:2022 Annex A 5.23: Information security for use of cloud services",1,"International Organization for Standardization (ISO) and IEC","**What it asks for.** This control expects processes for acquiring, using, managing and exiting from cloud services to be established in line with the organisation's information security requirements. It was new in the 2022 edition.\n\n**In practice.** Good practice means a cloud policy that defines how cloud services are selected and approved, how responsibilities are shared with providers, which security settings are required and how the organisation exits a service. Provider assurance, such as certifications or audit reports, is reviewed. Auditors look for an inventory of cloud services, assessments, configuration standards and exit plans.\n\n**Common gaps.** Typical gaps are shadow SaaS outside the inventory, misunderstanding of shared responsibility and no exit strategy for critical providers. Provider assurance reports are also collected but seldom read.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":9,"list":17},[18],{"slug":19,"title":20,"published_at":21},"third-party-access-exploited-to-breach-denmarks-entire-population-registry","Third-Party Access Exploited to Breach Denmark's Entire Population Registry","2026-10-05T16:20:37.656+00:00",[23,27,31],{"slug":24,"name":25,"problem":26,"stories":9},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",{"slug":28,"name":29,"problem":30,"stories":9},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":32,"name":33,"problem":34,"stories":9},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[36,41,45,49,54,58,62,65],{"family":37,"item":38,"code":39,"title":40,"together":9},"cis","13","Control 13","Network Monitoring and Defense",{"family":37,"item":42,"code":43,"title":44,"together":9},"5","Control 5","Account Management",{"family":37,"item":46,"code":47,"title":48,"together":9},"6","Control 6","Access Control Management",{"family":50,"item":51,"code":52,"title":53,"together":9},"gdpr","25","Article 25","Data protection by design and by default",{"family":50,"item":55,"code":56,"title":57,"together":9},"28","Article 28","Processor",{"family":50,"item":59,"code":60,"title":61,"together":9},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":50,"item":42,"code":63,"title":64,"together":9},"Article 5(1)(f)","Principles relating to processing of personal data",{"family":5,"item":66,"code":67,"title":68,"together":9},"a-8-3","Annex A 8.3","ISO\u002FIEC 27001:2022 Annex A 8.3: Information access restriction"]