Why it matters
Nearly every small business runs on cloud infrastructure now — this control exists because Annex A predates that being universal.
How a self-led small team implements it
Document your cloud provider's shared-responsibility model and what you've configured on your side (backups, access, encryption).
What auditors expect to see
Cloud configuration review, shared responsibility documentation.
Track A.5.23 in your own Statement of Applicability — mark it applicable, log your justification, and link it to the risk that drove it.
Start your ISMS