Cloud use and outsourcing audit program.
How to audit whether cloud services are selected under a defined strategy, secured by contract, configured securely and monitored, and whether an exit remains possible.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation governs its use of cloud services: from the decision and risk assessment through contract design and the division of tasks with the provider to secure configuration, ongoing monitoring and an orderly exit. It also assesses whether the additional requirements for financial entities are taken into account where they apply.
Scope
- Software, platform and infrastructure services used by the organisation, including shadow IT that comes to light
- Decision, contract and operating processes for cloud services
- Configuration and access of the organisation’s tenants at the provider
- Out of scope: internal security of the provider’s data centres, unless considered separately through certificates or reports
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A cloud strategy or policy defines for which data and processes cloud services may be used and by which criteria providers are selected. | ISO/IEC 27001:2022 Annex A 5.23; BSI OPS.2.2 | Read the strategy and policy, check approval and compare them with the services actually used. | Cloud policy with approval, list of cloud services in use |
| 2 | Before use, the protection requirement of the data concerned is established and the risk is assessed, including whether the function is critical or important. | ISO/IEC 27001:2022 Annex A 5.23; DORA Art. 28(4) | For three cloud services, review the risk assessment made before introduction and trace the classification of the function. | Risk assessments, protection requirement determinations, decision papers |
| 3 | Tasks between organisation and provider are delimited in writing, so that it is clear who is responsible for configuration, access, backup and logs. | ISO/IEC 27001:2022 Annex A 5.23; BSI OPS.2.2 | Read the responsibility matrix and contract documents and check for two services whether the tasks are actually performed. | Responsibility matrix, contracts and service descriptions |
| 4 | Contracts contain provisions on information security, location of data, subcontractors, incident reporting, audit rights and termination. | DORA Art. 30(2); ISO/IEC 27001:2022 Annex A 5.20 | Review contracts of the essential cloud providers against a checklist covering these points. | Contracts, annexes on security and data processing, completed checklist |
| 5 | A register records all outsourced services with contract data and classification and is kept current. | DORA Art. 28(3) | Compare the register with procurement records and invoices to find services that are not recorded. | Register of outsourcing, invoice analysis, list of procurements |
| 6 | Access to cloud consoles is limited to authorised people and protected by multi-factor authentication; privileged roles are reviewed regularly. | ISO/IEC 27001:2022 Annex A 8.2; § 30(2) no. 10 BSIG | Read administrator roles in two tenants and trace authentication and the last review. | Role and user extracts, authentication policy, review record |
| 7 | Cloud resources are configured according to defined standards; deviations are detected and corrected. | ISO/IEC 27001:2022 Annex A 5.23 and 8.9; BSI OPS.2.2 | Compare configuration standards with the settings of one tenant, in particular public exposure and encryption. | Configuration standards, results of configuration checks, extract of settings |
| 8 | Data is protected at rest and in transit; keys are managed under control. | ISO/IEC 27001:2022 Annex A 5.23 | Check encryption settings and key management for two services. | Configuration extracts, key management concept |
| 9 | Performance, availability and security incidents of providers are monitored; reports and certificates are evaluated. | ISO/IEC 27001:2022 Annex A 5.22; DORA Art. 30(3)(a) and (b) | Review reports of the last twelve months and check whether deviations were followed up. | Performance reports, certificates and audit reports, meeting minutes |
| 10 | Concentration risks, for example from depending on one provider for several essential services, are identified and assessed. | DORA Art. 28(4); DORA Art. 29 | Analyse the distribution of essential services across providers and review the assessment of concentration risk. | Analysis by provider, risk assessment, management decisions |
| 11 | For critical services there are documented and tested exit and repatriation plans. | DORA Art. 28(8); ISO/IEC 27001:2022 Annex A 5.23 | Read exit plans and trace whether data export and alternatives have been checked or tried. | Exit plans, test records, evidence of data export |
| 12 | Continuity and recovery plans take the failure of a cloud provider into account. | ISO/IEC 27001:2022 Annex A 5.30 | Check continuity plans for the cloud services covered and review the results of the last exercise. | Continuity plans, exercise records, recovery times |
Documents to request
- Cloud strategy or policy on the use of cloud services
- Register of services in use and outsourced, with classification
- Contracts, service descriptions and annexes on data processing
- Risk assessments and decision papers for the services in the sample
- Responsibility matrix between organisation and provider
- Role and configuration extracts from the tenants
- Reports, certificates and audit reports of the providers
- Exit and continuity plans
Typical findings
- Business units procure cloud services without involving information security, and they are not in the register.
- Responsibility for backup and logs is not clarified between organisation and provider.
- Contracts contain no audit rights and no provision on subcontractors.
- Public exposure or weak configurations are not detected by ongoing checks.
- Administrator access to the cloud console is not protected by multi-factor authentication.
- An exit plan is missing or has never been tried; data export is unclear.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing