Understanding which cloud assets are critical for the ISO 27001 audit and which are less important is a crucial aspect of maintaining robust information security management. In this guide, we aim to clarify which cloud assets are necessary for the audit, which ones are less critical, and how to effectively manage situations where an asset might not be readily identifiable in your inventory. Additionally, we will provide insights into how to assess a cloud asset to make better, more informed decisions regarding your ISMS.
Relevant cloud assets
Production Instances and Databases:
Cloud servers and databases actively used in production.
Contain customer data, PII, or other sensitive information critical to business operations.
Cloud-Based Applications and Services:
SaaS, PaaS, or IaaS services directly involved in primary business processes.
Includes CRM, ERP, or any cloud-based software processing sensitive data.
Cloud Storage Containing Sensitive Data:
Storage services (like AWS S3, Azure Blob Storage) holding critical data.
Important for evaluating data integrity, confidentiality, and availability.
Cloud Network Infrastructure:
Virtual networks, firewalls, load balancers, and other networking assets.
Essential for assessing network security and data protection in the cloud.
Less important cloud assets
Development and Staging Environments:
Cloud environments are used for development, testing, or staging.
Usually holds non-sensitive, dummy, or obfuscated data.
Redundant Instances and Backup Systems:
Secondary systems for failover or backup.
Important for redundancy but not actively used in primary business operations.
Identifying missing cloud assets
If you can't find an Asset Type that you think is relevant, consider these three Aspects:
Purpose: Assess the role of the asset in your cloud architecture.
Content: Determine if the asset handles sensitive, regulated, or business-critical data.
Relevance to Audit: Evaluate how the asset impacts your ISMS and ISO 27001 compliance.
To streamline inventory management and prevent clutter from noisy assets, we typically display the minimum requirements for cloud assets. We populate the main categories upfront and supplement additional assets based on the customer's specific use case. This approach ensures a focused and tailored inventory while accommodating any additional assets necessary for the customer's needs.
If you conclude you would need this Asset in your Inventory, consider these Steps:
Consultation with CSM: If you identify a critical cloud asset, discuss it with your Customer Success Manager.
Manual Import: If your cloud provider is not integrated with your asset management system, manually import assets that meet the above criteria.
Display in your Environment: In any case, you can always show the Auditor the Asset in your environment e.g. Terraform.
By focusing on critical assets that directly affect your ISMS and recognizing the lesser importance of others, you can streamline your audit preparation. Remember, assessing each asset's purpose, content, and relevance to the audit is key. Your CS Team is always there to answer any of your questions! 🤝