Skip to content
Networking
ASD ISMISM-1437

ASD ISM 1437 Utilising cloud providers for hosting online services

What it says

Cloud service providers are used for hosting online services.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Online services are hosted using cloud service providers for improved service continuity.

Using cloud service providers to host your online services helps ensure that your business can keep running smoothly, even if something goes wrong with your local IT setup. This matters because if your services are only hosted on-site and your office loses power or internet, your customers won't be able to access what they need, which could hurt your business reputation and bottom line.

Why it matters

If cloud hosting isn't used, outages in local IT systems may disrupt services, damaging reputation and incurring financial losses.

How to implement

  1. System owners should collaborate with the IT team to choose a suitable cloud provider for hosting services.

    Start by listing out necessary features like storage, scalability, and security standards, ensuring that the provider meets the service requirements.

  2. IT teams should set up regular backups for services hosted in the cloud.

    This can be done by configuring automated backup processes within the cloud platform to ensure data is not lost or disrupted during service outages.

  3. Managers should conduct training sessions for staff on how to manage services in the cloud.

    This can involve simple workshops that show everyday operations and basic troubleshooting without needing to be an IT expert.

  4. Procurement teams should negotiate a service level agreement (SLA) with the cloud provider.

    Ensure it covers uptime guarantees, data recovery processes, and support services that meet your organisation's needs.

  5. Security teams should work with the cloud provider to establish clear security controls.

    This can be achieved by identifying necessary security measures and confirming they align with your organisation's requirements and best practices advised by the Australian Cyber Security Centre.

Keep it running

Review cloud SLAs, hosting locations and resilience (multi-AZ/region, backups) to meet availability and security needs.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The list of cloud providers your organisation uses.

    Look at

    Each provider's service level agreement (SLA), particularly focusing on uptime guarantees and support terms.

    Good evidence

    Includes SLAs that commit to high availability and prompt support response times.

  2. Check 2 of 5What an auditor asks for

    Good evidence

    Shows backups being done automatically and stored in a secure off-site location.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Training materials or a training schedule related to cloud service management.

    Look at

    Evidence of regular sessions and participation by relevant staff.

    Good evidence

    Includes recent training records with attendee lists and material covered.

  4. Check 4 of 5What an auditor asks for

    Look at

    The details on uptime, data recovery, and support aspects.

    Good evidence

    Includes comprehensive SLAs that match your organisation's needs.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Documentation on security controls and risk assessments for cloud services.

    Look at

    Clear descriptions of how data is protected and access is managed.

    Good evidence

    Has documented policies aligned with best practices like those from the Australian Cyber Security Centre.

Mappings

Closest match in ISO/IEC 27001: A.5.23, Cloud service security management, which this control partially meets.

ISO 27001

ISO/IEC 27001: 1 mapping

  • A.5.23Cloud service security managementPartially meets

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.