Cloud Services Policy
Secure use and management of cloud and SaaS services
Purpose
Establish guidelines for the secure use of cloud services, ensuring the protection and management of sensitive information in line with the organization's information security program.
Scope
Applies to all employees, contractors and third parties who use cloud services (IaaS, PaaS, SaaS) within the organization's environment.
Objectives
- Ensure the secure use of cloud services.
- Comply with the information security management program.
- Guide employees on appropriate use.
- Protect the confidentiality, integrity and availability of data in the cloud.
Standards
Approval and Contracts
- Every cloud service must be approved by IT, Information Security and management.
- Review and approve contracts before use, including security and confidentiality clauses.
Encryption and Key Management
- All data in the cloud must be encrypted with approved algorithms.
- Manage cryptographic keys securely and restrict access to authorized staff.
Patches and Updates
- Keep all cloud services up to date and regularly patched.
Access Control
- Restrict access to authorized staff only.
- Use multi-factor authentication (MFA) whenever possible.
Incident Management
- Immediately report incidents or breaches to IT and Information Security.
- Follow incident response plans.
Data Retention and Deletion
- Delete sensitive data when it's no longer needed, following internal policies and applicable regulations.
- Document evidence of deletion; require confirmation from external providers where applicable.
Capacity Management
- Monitor and test the capacity of cloud services to ensure availability and performance.
- Consider future projections and avoid dependence on key resources.
Monitoring and Review
Policy Review
IT and Information Security will periodically review and update this policy to keep it current and aligned with the organization's needs.