ASD ISM 1637 Maintain an outsourced cloud service register
What it says
An outsourced cloud service register is developed, implemented, maintained and regularly verified.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeep an up-to-date register of cloud services used, and regularly check it.
This control is about keeping a detailed list of all cloud services your organisation uses and checking it regularly. It's important because if you don't know which services you're using, you risk losing track of sensitive data or facing unexpected security issues.
Free. Save your status, tasks and notes.
Why it matters
Without this control, your organisation might lose control over cloud services, risking data security issues or financial inefficiencies.
How to implement
The office manager or IT lead should create an initial list of all current cloud services being used by your organisation.
Start by checking invoices, subscriptions, and current software contracts to identify these services.
Procurement officers and finance team members should help track new cloud services by noting all new purchases.
They can do this by ensuring purchase processes include a step to document any new cloud service in the register.
The IT team should set a regular schedule to review the cloud service register.
They can do this by setting reminders in the company calendar to revisit the list every quarter, making sure to confirm that the list is up to date.
Department heads should communicate any use of new cloud tools or services to the IT lead.
This can be done through a monthly check-in meeting or an internal newsletter update to ensure services are not missed.
The organisation's executive team should periodically review the cloud service register during board meetings.
Regular board discussions on IT systems can increase accountability and ensure resources remain aligned with the organisation's risk profile.
Keep it running
Ensure regular reviews and updates of the cloud service register remain a routine part of the team's tasks to prevent oversight.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the cloud service register: Request the most recent version of the document listing all cloud services the organisation uses.
Look at
a comprehensive list with cloud service names and purpose.
Good evidence
is a complete list updated within the past three months.
- Check 2 of 5What an auditor asks for
Ask for
to see purchase records for cloud services: Request invoices or contracts related to cloud services.
Look at
the dates and ensure they align with the service register entries.
Good evidence
is if each recent purchase has an entry in the register.
- Check 3 of 5What an auditor asks for
Ask for
logs of any quarterly review meetings for the service register: Request meeting minutes or notes.
Look at
evidence of discussion around changes or updates.
Good evidence
shows the register was reviewed as scheduled, with actions noted.
- Check 4 of 5What an auditor asks for
Ask for
communication records regarding new cloud service use: Request emails or memos sent to team leads.
Look at
clear communications about updates or changes to the register.
Good evidence
will show proactive steps in maintaining current records.
- Check 5 of 5What an auditor asks for
Ask for
IT policy documents regarding cloud services: Request the policy guiding cloud service management.
Look at
sections explicitly covering service tracking and updates to the register.
Good evidence
includes specific guidelines on maintaining the register.
Mappings
Closest match in ISO/IEC 27001: A.5.19, Managing information security in supplier relationships, which this control partially meets.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.19.
ISM-1637 requires an organisation to maintain and regularly verify a register of outsourced cloud services. This supports ISO/IEC 27001:2022 Annex A 5.19 because managing information security risks in supplier relationships is more effective when the organisation has an authoritative list of all cloud suppliers/services and can identify where data and processing occur. Annex A 5.19 is broader (risk treatment, governance, and controls across supplier relationships), while ISM-1637 is a foundational inventory requirement specific to cloud outsourcing.
This control partially overlaps A.5.9.
Annex A 5.9 requires an organisation-wide inventory of information and associated assets with ownership. ISM-1637 (Maintain a Cloud Service Register for Outsourcing) overlaps by requiring a register for outsourced cloud services that is maintained and regularly verified, which is a type of asset inventory. However, ISM-1637 is limited to outsourced cloud services.
This control depends on A.5.22.
Annex A 5.22 requires monitoring and review of supplier services and security practices, including managing changes. ISM-1637 supports this by maintaining and verifying an outsourced cloud service register, improving visibility of suppliers and services monitored under Annex A 5.22.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.