Cloud Security
What is Cloud Security?
The set of policies, controls, procedures, and technologies that protect cloud-based systems, data, and infrastructure. Governed by the shared responsibility model between cloud provider and customer.
Terms that appear alongside cloud security
Each of these is named in at least one of the same controls as cloud security. The number is how many controls name both.
- nist 19 shared controls
- audit 18 shared controls
- governance 18 shared controls
- compliance 14 shared controls
- policy 14 shared controls
- soc 2 13 shared controls
- vulnerability 12 shared controls
- iso 27001 12 shared controls
Frameworks that govern cloud security
What the standards actually require on cloud security
Requirements naming cloud security across 6 standards, quoted from the control text.
ISMAP Cloud Governance establishes the management framework for Cloud Service Providers operating under ISMAP. (1) Information Security Management System (ISMS): based on ISO/IEC 27001:2022 + JIS Q 27001 (Japanese Industrial Standard equivalent) + ISMS-AC Info...
ISMAP-CloudGovernance-ISMS-RiskAssessment-SharedResponsibility-Policy-RegulatoryCompliance-RolesResponsibilities · ISMAP Cloud Governance - ISMS per ISO 27001/JIS Q 27001 + Risk Assessment + Shared Responsibility Model + Cloud Security Policy + Regulatory Compliance + Roles and Responsibilities →Cloud security policy and strategy. Control from NIST SP 800-190 framework, domain: NIST SP 800-190: Cloud Governance.
NIST190-02 · Cloud security policy and strategy →Software Environment. Cloud security controls are implemented so cloud-hosted applications inherit a secure configuration baseline.
SE1.3 · Implement cloud security controls →Apply NIST SP 800-146 Section 9.4 (Security Recommendations) and Section 9.5 (Privacy Recommendations) across the cloud portfolio. Security recommendations must address (a) shared responsibility model documented per service-model, (b) identity and access manag...
NISTSP146-6 · Cloud Security and Privacy Recommendations →Responsibilities with the cloud service provider are defined and written into the contract or SLA; risks are assessed by service type (SaaS, PaaS, IaaS) and a control policy sets secure configuration baselines, change approval, secure connection methods and a...
south-korea-isms-p::2.10.2 · Cloud security →Apply Section 7.5 cloud workload protection covering CWPP (Cloud Workload Protection Platform) + image and template hardening (golden image builds + AMI/VHD hardening + scanning) + container security (image scanning + admission control + runtime monitoring for...
NISTSP144-7 · Cloud Workload Protection, Containers, Serverless, and Configuration →Questions people ask about cloud security
What is Cloud Security?
Why is Cloud Security important for compliance?
Which compliance frameworks address Cloud Security?
Where can I learn more about Cloud Security?
See how Cloud Security applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.