Cloud Policies & Standards (CLD-001-R003) - CLD-001

Requirement Details & Guidance

CLD-001-R003 · CLD-001

Why This Requirement Exists

This requirement reduces risk in cloud security governance by ensuring cloud policies & standards is defined, consistently implemented and demonstrably effective across cloud environments. It supports the organization's need to secure cloud-based assets, data and services while managing cloud-specific risk.

Implementation Guidance

Create approved cloud policies and technical standards covering IAM, data protection, network security, secure configuration and incident response. Version-control them and map requirements to applicable services and environments.

Practical Application & Audit Readiness

CLD-001-R003 · Field Guidance

Business Examples

Common Audit Findings

Common Mistakes

Best Practices & Ownership

CLD-001 · Recommended Approach

Recommended Practices

Typical Owner

Cross-Mapped Regulatory Frameworks

Harmonized Control Mappings

FRAMEWORK CODE	FRAMEWORK NAME & DETAILS	FAMILY / CATEGORY	VERSION	ACTION
CIS-V8	CIS Controls CIS Controls are a prioritized set of cybersecurit... Clause: Control 04 – Secure Configuration of Enterprise Assets and Software: 4.2 – Establish and Maintain a Secure Configuration Process for Network Infrastructure	CIS Best Practice	vv8	View →
COBIT2019	COBIT COBIT is an enterprise governance and management f... Clause: 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.02 – Manage network and connectivity security. 4.4 – Deliver, Service and Support (DSS) > DSS05 – Managed Security Services > DSS05.03 – Manage endpoint security.	COBIT Governance Framework	v2019	View →
DORA	Digital Operational Resilience Act The EU Digital Operational Resilience Act establis... Clause: Article 28(1) – General principles for ICT third-party risk management Article 28(2) – ICT third-party risk strategy and review Article 30(1) – Written allocation of rights/obligations and service level agreements	EU Regulation	vCurrent	View →
GDPR	General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin... Clause: Article 28(1) – Processor requirements; Article 32(1) – Security of processing; Article 25(1) – Data protection by design and by default; Article 24(1) – Responsibility of the controller	EU Regulation	vCurrent	View →
IRDAI	IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements... Clause: §2.19-3.4 – Cloud security lifecycle	India Guideline	vLatest	View →
ISO27001	ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 5.2 – Policy	ISO Standard	v2022	View →
ISO27002	ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.23 – Information security for use of cloud services; 8.9 – Configuration management; 8.20 – Networks security	ISO Standard	v2022	View →
ISO27701	ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: 6.6.2.1; 6.6.2.2; A.7.4.2; 6.6.2.1 – User access management (privacy); 6.6.2.2 – User access provisioning (privacy); A.7.4.2 – Limit processing	ISO Privacy Standard	v2019	View →
NIS2	NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri... Clause: Article 21(2)(e) – Security in network and information systems acquisition, development and maintenance, including vulnerability handling and disclosure	EU Directive	vCurrent	View →
NIST-CSF	NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: GV.PO – Policy \| GV.PO-01 – Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced	NIST Framework	v2	View →
NIST80053	NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.13 – PROGRAM MANAGEMENT; PM-1 – INFORMATION SECURITY PROGRAM PLAN	NIST Control Catalog	vRev. 5	View →
SEBI-CSCRF	SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.1 PR.AA: Identity Management, Authentication, and Access Control	India Regulation	vLatest	View →
SOC2	SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: CC1.3 – Control Environment – COSO Principle 3: Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives. CC9.2 – Risk Mitigation – The entity assesses and manages risks associated with vendors and business partners. CC5.3 – Control Activities – COSO Principle 12: The entity deploys control activities through policies that establish what is expected and in procedures that put policies into action.	AICPA Audit Framework	vLatest	View →

Parent Domain Context

Governance Domain Baseline

Domain Name:

Cloud Security (CLD)

Purpose:

To secure the organization's cloud environments and manage cloud-specific risks.

Scope:

Enterprise

View

Parent Control Context

Control Baseline

Control Name:

Cloud Security Governance (CLD-001)

Summary:

Establishes cloud security governance including framework, strategy, policies, standards, roles, risk governance, monitoring, reporting, and continuous improvement for cloud environments.

Business Description:

Establish and maintain an enterprise cloud security governance framework, strategy, policies, standards, and oversight processes to manage cloud security risks across public, private, and hybrid cloud environments.

View