ISO 27001 Cloud Migration: Security Considerations
Migrating to the cloud while maintaining ISO 27001 certification is one of the most complex challenges organisations face today. The standard does not change when you move to the cloud – but the way you implement its controls must adapt to shared responsibility models, virtualised infrastructure, and third-party dependencies. This guide covers the essential security considerations for planning and executing an ISO 27001-compliant cloud migration.
Cloud Migration Security Requirements Under ISO 27001
ISO 27001 provides a framework for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). When migrating to the cloud, the ISMS scope must be updated to include cloud-hosted assets, cloud service providers (CSPs), and the interfaces between on-premises and cloud environments.
Clause 4.4 of ISO 27001 requires organisations to establish, implement, maintain, and continually improve the ISMS. During cloud migration, this clause demands that the ISMS explicitly covers:
- Cloud infrastructure and platform components
- Data in transit and at rest within cloud environments
- Virtual network boundaries and security groups
- Identity and access management for cloud resources
- Third-party dependencies on CSP services and sub-processors
Annex A Controls for Cloud Environments
Annex A of ISO 27001:2022 contains 93 controls organised across 4 themes. The following controls require particular attention during cloud migration:
| Control | Annex A Reference | Cloud Migration Consideration |
|---|---|---|
| Information security policy | A.5.1 | Policies must address cloud-specific risks, CSP governance, and multi-tenancy |
| Asset management | A.5.9 | Asset inventory must include cloud resources (virtual machines, storage, databases, serverless functions) |
| Access control | A.5.15–A.5.18 | IAM for cloud must enforce least privilege, MFA, and just-in-time access |
| Cryptography | A.5.20–A.5.21 | Key management for cloud CMKs, BYOK, and HSM integration must be documented |
| Physical security | A.7.1 | Delegated to CSP but must be evidenced via SOC 2, ISO 27017, or equivalent |
| Supplier relationships | A.5.19–A.5.22 | CSP contracts must include SLA guarantees, audit rights, and sub-processor controls |
| Incident management | A.5.24–A.5.27 | Incident response must cover cloud-specific scenarios (compromised API keys, misconfigured buckets) |
| Business continuity | A.5.29–A.5.30 | Cloud failover, multi-region resilience, and CSP outage procedures must be tested |
Risk Assessment for Cloud Migration
ISO 27001 requires a documented risk assessment process (Clause 6.1). Cloud migration introduces new risk categories that must be formally assessed and treated:
- Shared responsibility confusion – Misunderstanding which security controls are managed by the CSP versus the customer remains the leading cause of cloud security incidents.
- Data residency and jurisdiction – Cloud data may be stored or processed in jurisdictions with different legal frameworks, potentially conflicting with ISO 27001’s legal and regulatory compliance requirements.
- Multi-tenancy risks – Co-location with other customers on shared infrastructure introduces risks that must be assessed and accepted or mitigated.
- API and integration risks – Cloud APIs represent an expanded attack surface that requires specific risk treatment plans.
- Vendor lock-in – Dependency on proprietary CSP services may create migration and exit barriers that require contractual remedies.
Risk treatment plans must include acceptance criteria for cloud-specific risks, and residual risk levels must be approved by the ISMS management review.
Data Classification for Cloud Migration
ISO 27001 requires a data classification scheme (Control A.5.12). Cloud migration demands that classification inform data placement decisions:
| Classification Level | Cloud Deployment Options | Minimum Controls |
|---|---|---|
| Public | Any cloud model (IaaS, PaaS, SaaS) | Basic access controls, standard encryption |
| Internal | Any cloud model with encryption | IAM with MFA, encryption at rest and in transit |
| Confidential | Private cloud or dedicated tenancy preferred; public cloud with compensating controls | CMK / BYOK, dedicated HSM, network segmentation, data loss prevention |
| Restricted | Private cloud or air-gapped; public cloud only with explicit risk acceptance | HSM integration, strict access logging, real-time monitoring, contractual data handling provisions |
Cloud Service Provider (CSP) Selection
Selecting a CSP that supports ISO 27001 compliance is critical. All major CSPs – AWS, Microsoft Azure, and Google Cloud Platform (GCP) – maintain ISO 27001 certifications for their infrastructure. However, certification scope varies, and organisations must verify that the specific services they intend to use fall within the certified scope.
Key evaluation criteria include:
- Certification scope – Verify the CSP’s ISO 27001 certificate covers the specific regions, services, and data centres you plan to use.
- Shared responsibility matrix – The CSP should provide a documented responsibility matrix clearly delineating security obligations.
- Third-party audits – Review SOC 2 Type II reports, ISO 27017 (cloud security) and ISO 27018 (cloud privacy) certifications.
- Sub-processor controls – Understand the CSP’s sub-processor chain and contractual controls over downstream providers.
- Data residency commitments – Confirm contractual guarantees on data storage location and restrictions on cross-border transfer.
Contract Security Clauses
ISO 27001 Annex A controls A.5.19 (Information security in supplier relationships) and A.5.20 (Addressing security within supplier agreements) require that cloud service contracts include specific provisions:
- Service level agreements (SLAs) covering availability, incident response times, and data restoration
- Unrestricted audit rights or, alternatively, acceptance of third-party audit reports (SOC 2, ISO 27001)
- Data processing terms compliant with applicable data protection legislation
- Incident notification obligations with defined timelines and escalation procedures
- Exit and data portability provisions, including format specifications and transition assistance
- Liability allocation, including caps exclusions, and indemnification for security breaches
- Sub-processor change notification and objection rights
Migration Testing and Validation
ISO 27001 requires that changes to information processing facilities are subject to formal change management (Control A.5.36). Cloud migration must follow a structured testing and validation process:
- Pre-migration testing – Conduct security testing of the target cloud environment, including network segmentation validation, IAM policy reviews, and encryption configuration verification.
- Pilot migration – Migrate a non-critical workload first and conduct a full security assessment before expanding scope.
- Post-migration validation – Verify that all Annex A controls are operating effectively in the cloud environment through automated compliance checks and manual testing.
- Continuous monitoring – Implement cloud-native monitoring tools (e.g., AWS CloudTrail, Azure Monitor, GCP Cloud Audit Logs) to maintain ongoing compliance evidence.
All migration activities must be documented and retained as evidence for internal and external ISMS audits.
FAQ
Does ISO 27001 certification cover cloud environments automatically?
No. Your ISO 27001 certification covers the scope defined in your Statement of Applicability (SoA). If your SoA does not include cloud-hosted assets, those are not covered. You must formally extend the ISMS scope and update the SoA to include cloud environments.
Is my organisation still ISO 27001 compliant if the CSP is not certified?
It is possible but requires compensating controls and explicit risk acceptance. Most certification bodies require CSP certification as evidence of effective controls. Using a non-certified CSP typically results in non-conformities during external audits.
What is the shared responsibility model and how does it affect my ISMS?
The shared responsibility model defines which security controls are managed by the CSP and which remain your responsibility. Your ISMS must clearly document these boundaries and include controls for your side of the responsibility model. Common customer responsibilities include access management, data classification, encryption configuration, and application security.
Do I need separate risk assessments for each cloud service I use?
Yes. Each cloud service introduces a different risk profile. A risk assessment should be conducted for each service, considering the specific data, configurations, and dependencies involved. Service-specific assessments can be documented as part of the overarching cloud migration risk assessment.
How do I handle data residency requirements in a multi-region cloud deployment?
Data residency must be addressed through a combination of contractual commitments, cloud provider configuration (e.g., AWS Regions, Azure Geographies, GCP Regions), and technical controls such as data classification tags and data loss prevention policies. Your ISMS must document where data is stored and the controls that enforce residency requirements.
How often should cloud security controls be tested for ISO 27001 compliance?
Internal audits must be conducted at planned intervals (typically annually). However, cloud environments change rapidly. Continuous automated compliance scanning (e.g., using AWS Config, Azure Policy, GCP Forseti) is strongly recommended to maintain ongoing compliance between formal audit cycles.
Ready to Achieve ISO 27001 Compliance in the Cloud?
Our ISO 27001 consultants specialise in cloud migration compliance. We help organisations extend their ISMS scope, update risk assessments, select appropriate CSPs, and pass certification audits. Whether you are migrating to AWS, Azure, or GCP, we provide end-to-end support.
Contact our cloud security team to schedule an ISO 27001 cloud readiness assessment.
