ASD ISM 1529 Limit cloud services to community or private for SECRETS
What it says
Only community or private clouds are used for outsourced SECRET and TOP SECRET cloud services.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishFor SECRET or TOP SECRET services, only community or private clouds should be used to ensure security.
When dealing with SECRET or TOP SECRET information, it's crucial to use cloud services that are either exclusively public or private. This helps protect extremely sensitive data from being exposed or accessed by unauthorised parties. If these precautions aren't taken, confidential secrets might get leaked, which could severely harm your organisation's reputation and security.
Free. Save your status, tasks and notes.
Why it matters
Using public clouds for SECRET info risks data leaks, potentially compromising national security and damaging organisational trust.
How to implement
Managers should conduct an initial assessment of their current cloud service providers to determine if the services are classified as community or private.
Review the service provider's documentation or consult directly with their representatives to verify their cloud classification.
IT teams need to ensure that all outsourced cloud services handling SECRET and TOP SECRET data are limited to community or private clouds.
This can be done by reviewing the cloud service contract and confirming the infrastructure meets these criteria.
Procurement officers should include provisions in contracts that specifically require the use of community or private cloud services for sensitive data.
They can achieve this by stating these requirements explicitly in all requests for proposals and ensuring they're reflected in the final agreement.
System owners must regularly review the organisation's cloud usage to ensure ongoing compliance.
Schedule quarterly checks to confirm that no new non-compliant cloud services have been introduced.
Security officers should train staff on the importance of using the appropriate cloud types for sensitive information.
Develop a training module that explains the risks of public clouds for SECRET data and how to choose compliant solutions.
Keep it running
Confirm outsourced SECRET/TOP SECRET workloads run only in community or private clouds; periodically validate the service's cloud model and contract terms.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
The current list of cloud service providers.
Look at
The classification of each cloud service to verify they are community or private.
Good evidence
Is an updated list showing each provider and its respective classification as community or private.
- Check 2 of 5What an auditor asks for
Good evidence
Is contracts with clear terms indicating compliance and protective measures.
- Check 3 of 5What an auditor asks for
Good evidence
Includes up-to-date training material and completion records.
- Check 4 of 5What an auditor asks for
Ask for
The documentation on quarterly reviews of cloud usage. Review the results and follow-up actions taken for any non-compliance identified.
Good evidence
Includes reports with actions and resolutions for any issues found.
- Check 5 of 5What an auditor asks for
Good evidence
Is a policy document with clear stipulations and adherence evidence.
Mappings
Closest match in ISO/IEC 27001: A.5.23, Cloud service security management, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.23.
ISM-1529 requires that outsourced SECRET and TOP SECRET cloud services are only delivered using community or private cloud deployment models. Annex A 5.23 requires the organisation to establish processes for acquisition, use, management and exit from cloud services in accordance with information security requirements, which is where an organisation would define and enforce cloud selection criteria (including any permitted deployment models). However, Annex A 5.23 does not itself mandate classification-based deployment restrictions (e.g. banning public cloud for SECRET/TOP SECRET), so it only partially covers the governance mechanism that could implement ISM-1529's stricter requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.