A short cloud computing policy template: authorised services only, terms reviewed, no shared log-ins, decisions on what goes in the cloud, and no personal cloud accounts.

Effective Policy Templates

This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Policy number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on cloud services:

• Cloud Computing Risks and Exit Strategies
• Supplier and Third-Party Information Security
• Access Control, Passwords and User Authentication
• Information Security knowledge base

Logo Update Service

Download this policy template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription.

Need Help Implementing?

If you'd like this policy prepared for your organisation along with the rest of your company policies, or help with your information security risk assessment and treatment plan, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Cloud Computing Policy Template

A cloud computing policy template covering all external cloud-based services used for work, such as cloud email, document storage and externally managed software, for everyone working for or on behalf of the organisation.

The policy has Approved By and Date Approved fields and carries a Public information classification, so it can be shared with workers, clients and other interested parties.

What the Cloud Computing Policy Covers

• Scope - all external cloud-based services, with a prompt to check before using any service that may be in scope
• Authorisation - cloud services used for work formally authorised, with security, privacy and IT requirements confirmed
• Terms of service - reviewed and approved before being agreed
• Log-in credentials - never shared, with a confidential record of accounts kept for continuity but no passwords written in it
• Legal requirements - use complying with the law on personal data, financial data and other organisation data
• What goes in the cloud - decided by the person responsible for IT
• Personal accounts - not used for company data
• Responsibility - shared by management and workers, with breaches treated as potential misconduct

Checked Against Cyber Essentials

The IT policies in the range have been checked against the Cyber Essentials requirements, so their rules on passwords, devices, access and updates do not contradict what a Cyber Essentials assessment asks for.

Using the Policy

Add your company name and logo, check each commitment matches what your organisation does and edit any that do not, then approve and date the policy and share it with workers and anyone else who needs to see it.

Who Needs a Cloud Computing Policy?

Any organisation that uses cloud email, cloud storage or software as a service, including those preparing for Cyber Essentials or ISO 27001.

Works with the Cloud Computing Register

The PP-8-09 Cloud Computing Policy Procedure sets out the procedure, cloud services can be listed on the F-IMS39 Cloud Computing Register, the RA-BR7 Cloud Computing risk assessment covers cloud risks, and the F-Q108 Cloud Emergency Exit Strategy Planning form covers exit planning. The PP-8-100 Information Security Policy Procedure also includes a Cloud Computing Policy section covering the same ground.

Document Control

The footer carries the policy number and title, information classification, version and page numbers, and the approval fields record who approved the policy and when, so it can be controlled with the rest of your management system documents and listed on a document register such as the F-IMS20 Document Register.

Related Policies

• P-101 Shared Data Responsibility Model Policy - shared data responsibility
• P-102 Data Ownership Policy - data ownership
• P-37 Supplier Security Policy - supplier security