Relying on a cloud provider is fine until you need to leave one - or it leaves you. This planner rates the provider, maps the data and applications you depend on, and works through a migration and exit plan with a risk assessment, so a change of cloud service is planned rather than scrambled.

Effective Form Templates

This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Form number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary fields. Simple and usable form templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on cloud security and exit strategies:

• Cloud Computing Risks and Exit Strategies
• Managing Information Security Risks
• Backup, Business Continuity and ICT Recovery

Logo Update Service

Download this form template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This form is also included in the ISO 27001 Toolkit and every alphaZ ISO toolkit that covers information security, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help planning a cloud exit or migration, or your wider information security management system, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Cloud Emergency and Exit Strategy Planning Template

A planning template for assessing a cloud service and preparing to move away from it - whether by choice or because the provider fails. It rates the provider, records the data and applications held with them, and works through a migration and exit plan covering data transfer, testing, contract termination and access control, with a cloud exit risk assessment.

ISO 27001 and good information security practice expect reliance on third-party and cloud services to be assessed, and continuity and exit arrangements to be planned. This template gives you a practical way to document that planning and evidence it.

Built for ISO 27001 and Cloud Resilience

The template covers what a cloud exit and continuity plan needs:

• An assessment of the cloud provider, service levels, security and a provider rating
• An inventory of the data and applications held with the provider and their importance
• A migration plan covering data transfer, technical and legal considerations and exit terms
• A cloud exit risk assessment with inherent and residual risk ratings and controls

What's Included in this Cloud Emergency / Exit Strategy Plan

The template is set out so a provider can be assessed and an exit planned in one document:

• Provider overview and rating - the provider, location, services, SLAs and security, with a likelihood, reliability, cost, security and overall rating
• Data and applications - the data and applications held, their type, importance and dependencies, and current backup arrangements
• Migration plan - the transfer process and security in transit, technical and rollback considerations, legal and data-ownership points and exit terms
• Transition and closedown - the new provider, pre-transfer testing, consultation, data and systems to transfer, data return or deletion, contract termination and access controls
• Cloud exit risk assessment - an appendix rating the inherent and residual risk of each cloud data or processing activity with control measures

Who Needs a Cloud Exit Strategy Plan?

Any organisation that depends on cloud services - hosted software, storage, infrastructure - and needs to show it could move or recover if a provider failed or a contract ended. It suits smaller businesses that need a clear, defensible plan without a dedicated IT function, and anyone maintaining an information security management system aligned with ISO 27001.

Included in the ISO 27001 Toolkit

This form is part of the ISO 27001 Toolkit - the manuals, registers, forms, policies and procedures for running an information security management system in one download - and is included in every alphaZ ISO toolkit that covers information security.

Pairs with the Disaster Recovery Plan

Cloud exit planning is one part of wider resilience, so it pairs with the F-Q95 Disaster Recovery Plan, which sets out how premises, infrastructure and business-critical functions are restored after a disruptive incident.