This requirement reduces risk in cloud security governance by ensuring governance review is defined, consistently implemented and demonstrably effective across cloud environments. It supports the organization's need to secure cloud-based assets, data and services while managing cloud-specific risk.
Perform scheduled reviews of the cloud governance framework, policies, standards, metrics and decision structures. Record findings, actions, owners and due dates.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 9.3.1 – General |
ISO
Standard
|
v2022 | View → |
| IRDAI | IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.19-3.4 – Cloud security lifecycle |
India
Guideline
|
vLatest | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 1.6 GV.SC: Cybersecurity Supply Chain Risk Management; 1.1 GV.OC: Organizational Context |
India
Regulation
|
vLatest | View → |
| DORA | Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 28(1) – General principles for ICT third-party risk management Article 28(2) – ICT third-party risk strategy and review Article 30(1) – Written allocation of rights/obligations and service level agreements |
EU
Regulation
|
vCurrent | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.23 – Information security for use of cloud services |
ISO
Standard
|
v2022 | View → |
| NIS2 | NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure |
EU
Directive
|
vCurrent | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.OC – Organizational Context | GV.OC-05 – Outcomes, capabilities, and services that the organization depends on are understood and communicated GV.SC – Cybersecurity Supply Chain Risk Management | GV.SC-07 – The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship PR.PS – Platform Security | PR.PS-01 – Configuration management practices are established and applied |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.17 – SYSTEM AND SERVICES ACQUISITION, 3.13 – PROGRAM MANAGEMENT; SA-9 – EXTERNAL SYSTEM SERVICES, PM-1 – INFORMATION SECURITY PROGRAM PLAN |
NIST
Control Catalog
|
vRev. 5 | View → |
| GDPR | General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 24(1) – Responsibility of the controller; Article 32(1) – Security of processing |
EU
Regulation
|
vCurrent | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Governance Controls; Governance and Oversight Structure – Establishing clear policies |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC1.3 – Control Environment – COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. CC9.2 – Risk Mitigation – The entity assesses and manages risks associated with vendors and business partners. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. |
AICPA
Audit Framework
|
vLatest | View → |