This policy procedure sets out how cloud services are authorised and controlled, with the IT Manager approving services, terms of service and what data goes into the cloud.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on cloud computing:

• Cloud Computing Risks and Exit Strategies
• ISO 27001 Annex A 5.23 - Information Security for Use of Cloud Services
• Backup, Business Continuity and ICT Recovery
• Information Security knowledge base

Logo Update Service

Download this policy with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like hands-on help deciding which cloud services and data your business allows, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Cloud Computing Policy Procedure Template

The Cloud Computing Policy Procedure is a Word template that sets out the process for using cloud computing services in a business and the controls in place. It covers cloud risk assessment, IT Manager authorisation of services and terms of service, sharing of login credentials, handling of personal and financial data, decisions on what data may be stored and personal cloud accounts.

Use of cloud services must also follow the business's existing acceptable usage policy. The file has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.

What the Policy Covers

• Amendment record, summary, scope and applicability - the purpose of controlling cloud computing, the activities and staff covered, and disciplinary action for breaches
• Management of cloud computing risks - periodic risk assessments of the risks associated with cloud computing, with findings actioned and the policy kept in line with current controls
• Authorisation of cloud services - IT Manager authorisation of any cloud service used for work, with the IT Manager confirming the vendor meets security and privacy requirements
• Terms of service and acceptable use - IT Manager review and approval of terms of service agreements, and use of cloud services in line with the acceptable usage policy
• Credentials and data handling - no shared login credentials, a confidential account record kept by IT for continuity, and lawful handling of personal and financial data
• Data storage and personal accounts - the IT Manager deciding what data may be stored in the cloud, and no personal cloud accounts for company data

Built for Authorised Cloud Use

• Every cloud service used for work formally authorised by the IT Manager
• Terms of service agreements reviewed and approved by the IT Manager
• Account information held by the IT department in a confidential document for business continuity
• Personal cloud accounts barred from storing or exchanging company data or communications

Who Needs a Cloud Computing Policy Procedure?

Businesses whose staff use cloud computing services for work, and that want one named role deciding which services are used and what data goes into them.

Using the Policy

Change the IT Manager role to whoever approves cloud services in your business and edit the controls to match your own, then name the person in the Controlled By field. Give it top level approval and brief staff on using only authorised services.

Related Documents

P-100 Cloud Computing Policy can be issued alongside this procedure, and F-IMS39 Cloud Computing Register gives a place to record the cloud services in use.

Keeping Company Data Out of Personal Accounts

Staff must not share login credentials with co-workers, and the IT department keeps a confidential document containing account information for business continuity purposes. Personal cloud service accounts may not be used to store, manipulate or exchange company related communications or company owned data.