N.1.19 Keeping information secure when using cloud services
Control Overview
This control mandates that the organization defines and implements structured processes to govern the entire lifecycle of Cloud Service Providers (CSPs)—from initial procurement and onboarding through to termination and exit. To prevent cloud environments from introducing security vulnerabilities or compliance failures, the organization must verify that each CSP's technical and legal guarantees align with its own internal cybersecurity policies. This requires a clear definition of the Shared Responsibility Model, continuous verification of data residency and regulatory compliance, and a viable exit strategy that guarantees business continuity and secure data recovery or deletion.
Applicability Note: This control is fully applicable to the anDREa platform, directly governing our cloud-native infrastructure, PaaS components, and secondary SaaS integrations.
Compliance & Strategic Approach
Our approach satisfying this NIS 2 requirement is seamlessly embedded within our ISO/IEC 27001-based ISMS, treating cloud governance as an essential architectural layer rather than an ad-hoc outsourcing exercise.
Because anDREa operates natively in the cloud, our cloud security policy covers the complete lifecycle. Before procuring any cloud capability, we evaluate the provider's security and privacy credentials (including ISO 27001, SOC 2 Type II, and GDPR compliance). Operationally, we enforce strict boundary controls, such as mandatory Multi-Factor Authentication (MFA), classification-based encryption, and continuous logging. Furthermore, we mitigate vendor lock-in risk by maintaining a defined cloud exit and data migration strategy, ensuring compliance with strict European data residency mandates and legal deletion requirements upon service termination.
Control Mappings & Evidence
| Framework / Document Reference | Element & Identifier | Description / Relationship to NIS 2 |
|---|---|---|
| ISO/IEC 27001 | A.05.23 - Information security for use of cloud services | Mandates the establishment of processes for acquisition, use, management, and exit of cloud services. |
| Operational Governance | Cloud Services Lifecycle Policy | The authoritative text defining pre-acquisition risk assessments, approved data residency boundaries, and mandatory security baselines. |
| Architectural Strategy | Cloud Exit Strategy & Transition Plan | Documented technical protocols detailing how data is securely extracted, verified, and decommissioned when terminating a CSP agreement. (Offboarding and Exit Strategy) |
| Technical Controls | IAM & Cryptographic Configurations | Core environment settings enforcing mandatory MFA, conditional access policies, and data-at-rest/in-transit encryption keys. (Logon policy, Data Handling Policy) |
| Vendor Compliance Dossiers | CSPs Independent Audit Reports | Compiled and reviewed ISO 27001 certifications, SOC 2 Type II reports, and GDPR-compliant DPAs from core upstream cloud providers. (Supplier List, SOC 2 type II) |
Audit Summary
- Compliance Status: Fully Compliant
- Gaps Identified: None. Cloud pre-acquisition gating, configuration baselines, data residency compliance, and formal exit strategies are fully operationalized. Continuous Improvement: To maximize audit resilience, ensure that cloud-specific scenario playbooks (e.g., cloud account compromise or CSP outage) are explicitly tested and documented during annual Disaster Recovery (DR) and business continuity exercises.