ISO 27001 Cloud Security Certification - Preparing AWS, Azure, and GCP for Audit

“We need ISO 27001” - it comes up in almost every enterprise procurement conversation. Whether you’re responding to a G-Cloud call-off, onboarding a financial services client, or preparing for Cyber Essentials Plus alongside broader compliance, ISO 27001 is often the baseline expectation.

The problem: most ISO 27001 guidance still describes on-premises environments - server rooms, physical access controls, local Active Directory policies. If your infrastructure lives in the cloud, you need to reinterpret the standard’s requirements for a fundamentally different operating model.

AWS, Azure, and GCP each hold their own ISO 27001 certificates - but those cover their infrastructure, not yours. The Shared Responsibility Model means the provider handles “security of the cloud” (physical data centres, hypervisor, network fabric), while you handle “security in the cloud” (configuration, access, data, applications).

This article provides a practical map: from ISO 27001:2022 requirements through concrete technical controls on AWS, Azure, and GCP, to automated evidence collection that makes annual surveillance audits straightforward.

What Is ISO 27001 and Why UK Cloud-Native Companies Need It

ISO/IEC 27001:2022 defines requirements for an Information Security Management System (ISMS). It is not a technical checklist - it is a management framework requiring:

1. Organisational context - understanding what information you protect and for whom
2. Risk assessment - identifying threats and vulnerabilities specific to your environment
3. Controls (Annex A) - implementing appropriate security measures
4. Continual improvement - monitoring, reviews, internal audits, corrective actions

The 2022 Update

ISO 27001:2022 replaced the 2013 version. Key changes:

• Annex A reduced from 114 to 93 controls (grouped into 4 categories instead of 14)
• New cloud-specific controls: A.5.23 (cloud service security), A.8.11 (data masking), A.8.23 (web content filtering)
• Greater emphasis on threat intelligence (A.5.7) and ICT supply chain security (A.5.21)
• Control attributes (preventive, detective, corrective) - easier to map to cloud-native tooling

When ISO 27001 Is Required in the UK

UK-Specific Compliance Landscape

ISO 27001 does not exist in isolation in the UK. It intersects with:

• Cyber Essentials / Cyber Essentials Plus - mandatory for government contracts; ISO 27001 Annex A covers all CE requirements and more
• UK GDPR & Data Protection Act 2018 - ISO 27001 demonstrates “appropriate technical and organisational measures” (Article 32)
• NIS Regulations 2018 (UK’s NIS2 equivalent) - applies to operators of essential services and relevant digital service providers
• FCA operational resilience - ISO 27001 supports SS1/21 and PS6/21 requirements for important business services
• DSPT (Data Security and Protection Toolkit) - NHS requirement, substantially aligned with ISO 27001

Shared Responsibility Model and ISO 27001

Before implementing controls, you must define the boundary of responsibility between you and your cloud provider. An ISO 27001 auditor will ask: “What controls have you implemented?” - you need to know which controls the provider handles (and have evidence of it) and which you own.

What the Provider Covers

All three major providers (AWS, Azure, GCP) hold ISO 27001 certificates for their infrastructure. This means the following Annex A controls are covered by the provider:

• A.7 (Physical controls) - physical security of data centres, environmental threat protection
• A.8.12 (Data leakage prevention) - at hypervisor level and tenant separation
• A.8.14 (Redundancy) - hardware redundancy, power, cooling

What You Must Handle

Controls that remain your responsibility (configuration, policies, processes):

• A.5 (Organisational controls) - security policies, roles, responsibilities
• A.6 (People controls) - training, vetting, employment conditions
• A.8.1–A.8.11, A.8.13, A.8.15–A.8.34 - most technology controls: IAM, encryption, logging, backup, monitoring

Evidence of Provider Coverage

During audit, you must demonstrate that your provider covers their controls. Each provider offers:

• AWS: AWS Artifact - portal with ISO 27001, SOC 2, PCI DSS reports (available in the AWS Console)
• Azure: Service Trust Portal (servicetrust.microsoft.com) - certificates and audit reports
• GCP: Compliance Reports Manager in Google Cloud Console + compliance.google.com

Download your provider’s ISO 27001 certificate and include it in your ISMS documentation as evidence of physical control coverage.

Annex A in the Cloud - Mapping Controls to AWS, Azure, and GCP

Below is a mapping of the most critical Annex A controls (ISO 27001:2022) to specific services and configurations across three providers. Focus is on technology controls (A.8), as these require the most work in cloud environments.

A.8.2 - Privileged Access Rights

Requirement: restrict and control the allocation of privileged access.

A.8.5 - Secure Authentication

Requirement: authentication mechanisms proportionate to information classification.

Recommended authentication architecture (multi-cloud):

┌─────────────────────────────────────────────────┐
│  Identity Provider (IdP)                        │
│  (Entra ID / Okta / Google Workspace)           │
│                                                 │
│  - SSO (SAML 2.0 / OIDC)                        │
│  - MFA (hardware key + biometrics)              │
│  - Conditional Access (location, device)        │
│  - Session timeout: 8h (regular), 1h (admin)    │
└─────────────┬───────────────────────────────────┘
              │ Federation
              ├──────────────── AWS IAM Identity Center
              ├──────────────── Azure (native Entra ID)
              └──────────────── GCP Workforce Identity Federation

Key principles:

• Single IdP as source of truth - do not create local users in cloud consoles
• MFA mandatory for all users (not just admins) - ISO 27001:2022 A.8.5 does not distinguish tiers
• Session timeout: max 8 hours for regular users, max 1 hour for administrative accounts
• Monitor failed logins and lock after 5 attempts

A.8.9 - Configuration Management

Requirement: configurations of systems shall be established, documented, implemented, monitored, and reviewed.

In the cloud, this control is realised through Infrastructure as Code (IaC). The auditor expects:

• A documented baseline configuration
• Drift detection mechanisms
• A change approval process

Example: AWS Config Rule ensuring all S3 buckets have server-side encryption:

{
  "ConfigRuleName": "s3-bucket-server-side-encryption-enabled",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "S3_BUCKET_SERVER_SIDE_ENCRYPTION_ENABLED"
  },
  "Scope": {
    "ComplianceResourceTypes": ["AWS::S3::Bucket"]
  }
}

Azure equivalent - Policy Definition enforcing TLS 1.2:

{
  "if": {
    "allOf": [
      { "field": "type", "equals": "Microsoft.Storage/storageAccounts" },
      { "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion", "notEquals": "TLS1_2" }
    ]
  },
  "then": { "effect": "deny" }
}

A.8.15 - Logging

Requirement: logs recording activities, exceptions, faults, and other relevant events shall be produced, stored, protected, and analysed.

This is a critical audit control. The auditor will ask for evidence that logging was active for the past 12 months and that logs were not tampered with.

Configuring tamper-proof log storage on AWS:

# Create bucket with Object Lock for CloudTrail logs
aws s3api create-bucket \
  --bucket company-audit-logs-2026 \
  --region eu-west-2 \
  --create-bucket-configuration LocationConstraint=eu-west-2 \
  --object-lock-enabled-for-bucket

# Set default retention to 365 days (COMPLIANCE mode - cannot be shortened)
aws s3api put-object-lock-configuration \
  --bucket company-audit-logs-2026 \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {
      "DefaultRetention": {
        "Mode": "COMPLIANCE",
        "Days": 365
      }
    }
  }'

Note the use of eu-west-2 (London) - for UK organisations, keeping audit logs within UK jurisdiction simplifies data residency questions during audit.

A.8.24 - Use of Cryptography

Requirement: rules for the use of cryptography, including key management, shall be defined and implemented.

Cloud providers encrypt data at rest by default. But ISO 27001 requires more: a documented cryptography policy, key management practices, and a conscious decision about encryption types.

For ISO 27001, the minimum requirement is:

• Documented cryptography policy (what encryption type, for which data classes)
• CMEK for sensitive data (personal data, financial data, secrets)
• Automatic key rotation (the auditor will check that rotation actually occurs)
• Key access logs (who used a key to decrypt, and when)

A.8.25 - Secure Development Lifecycle

Requirement: rules for the secure development of software shall be established and applied.

In cloud context, this control is realised through CI/CD pipelines with built-in security gates:

Developer → Commit → CI/CD Pipeline
                         │
                         ├── SAST (static application security testing)
                         ├── SCA (software composition analysis)
                         ├── Container scan (image vulnerabilities)
                         ├── IaC scan (Terraform/CloudFormation misconfigurations)
                         ├── Unit and integration tests
                         ├── Code Review (minimum 1 approver required)
                         │
                         └── Deploy → Production
                                      │
                                      └── DAST (dynamic testing post-deploy)

Tools by provider:

• AWS: CodeGuru Reviewer (SAST), ECR Image Scanning, Inspector (runtime)
• Azure: Microsoft Defender for DevOps, GitHub Advanced Security (GHAS), Container Registry scanning
• GCP: Artifact Analysis, Binary Authorization, Cloud Build + Snyk/SonarQube integration

A.5.23 - Cloud Service Security (New in 2022)

This control was added specifically in the 2022 revision. It requires:

1. Defining security requirements for cloud services
2. Criteria for cloud provider selection
3. Monitoring provider compliance
4. Managing changes in cloud services (deprecations, region changes)

What the Auditor Expects

• Cloud usage policy - document describing: which providers you use, what data you process in the cloud, what security requirements you place on the provider
• Provider assessment - evidence that you verified the provider’s certifications (ISO 27001, SOC 2) before selection
• Agreement / DPA - Data Processing Agreement with provider (AWS/Azure/GCP all have standard DPAs; for UK, ensure UK GDPR addendum is in place)
• SLA monitoring - how you monitor whether the provider meets its commitments

Practical Implementation

Create a “Cloud Security Policy” document containing:

1. Approved providers: AWS, Azure, GCP (with justification for selection)
2. Approved regions: eu-west-2 (London), eu-west-1 (Ireland) for UK data residency
3. Data classification in cloud:
   - Public → any service, any region
   - Internal → managed services with encryption, UK/EU region
   - Confidential → CMEK, VPC/VNet isolation, UK/EU region, audit logging
   - Restricted → HSM, dedicated VPC, zero-trust access, UK region only
4. Provider requirements: ISO 27001, SOC 2 Type II, DPA with UK GDPR addendum
5. Annual review: verify currency of provider certifications

For UK organisations, data residency is a frequent audit discussion point. While UK GDPR does not strictly require data to remain in the UK, demonstrating that sensitive data resides in eu-west-2 (London) simplifies adequacy arguments and satisfies risk-averse clients.

Building an ISMS - A Pragmatic Approach for Cloud-Native Companies

ISO 27001 requires an Information Security Management System (ISMS). It sounds bureaucratic, but for a 20–100 person company operating in the cloud, the ISMS can be lightweight and heavily automated.

Minimum ISMS Documentation

Cloud-Specific Risk Register

Typical risks that an auditor expects to see in a cloud-native company’s register:

1. Unauthorised access to cloud console - likelihood: medium, impact: high → control: MFA + SSO + session timeout
2. Data exposure from misconfigured storage - likelihood: medium, impact: high → control: Block Public Access (default) + AWS Config/Azure Policy
3. Vendor lock-in / provider unavailability - likelihood: low, impact: high → control: multi-region, off-cloud backup, IaC
4. Privilege escalation via overly broad IAM roles - likelihood: medium, impact: medium → control: least privilege + IAM Access Analyzer
5. Data loss (missing or corrupted backup) - likelihood: low, impact: critical → control: automated backup + regular restore testing
6. UK data residency breach - likelihood: low, impact: high → control: region constraints (Organisation Policy / SCP), monitoring via Config/Policy

Automating Evidence Collection

The biggest ongoing cost of ISO 27001 is not implementing controls - it is continuously collecting evidence that controls are operating. The surveillance auditor (annually) will request evidence from the past 12 months. Manual screenshotting of consoles is a waste of engineering time. Automation is essential.

AWS - Compliance Toolset

AWS Audit Manager
├── Framework: ISO 27001:2022 (built-in, ready to use)
├── Automated evidence collection:
│   ├── CloudTrail events → A.8.15 (Logging)
│   ├── Config compliance → A.8.9 (Configuration management)
│   ├── Security Hub findings → A.8.8 (Vulnerability management)
│   └── IAM Access Analyzer → A.8.2 (Privileged access)
└── Per-control report generation

AWS Audit Manager automatically maps AWS services to ISO 27001 controls. Enable the assessment, export monthly reports. Cost: $1.25/assessment/month (per framework).

Azure - Microsoft Defender for Cloud + Compliance Manager

Azure offers two tools:

1. Defender for Cloud - continuous compliance monitoring with built-in ISO 27001 benchmark
2. Microsoft Purview Compliance Manager - evidence management, remediation actions, compliance scoring

Configuration in Defender for Cloud:

# Assign ISO 27001:2022 initiative to subscription
az policy assignment create \
  --name 'ISO27001-2022' \
  --display-name 'ISO 27001:2022 Compliance' \
  --scope "/subscriptions/${SUBSCRIPTION_ID}" \
  --policy-set-definition '/providers/Microsoft.Authorization/policySetDefinitions/ISO27001-2022'

Once assigned, Defender for Cloud generates a compliance score and a list of non-compliant resources mapped to Annex A controls.

GCP - Security Command Center + Assured Workloads

GCP approach:

1. Security Command Center Premium - compliance dashboard with CIS Benchmarks (mappable to ISO 27001)
2. Assured Workloads - enforcing compliance controls at folder/project level
3. Cloud Asset Inventory - resource configuration history (evidence for A.8.9)

# Export compliance findings from SCC to BigQuery (monthly automated report)
gcloud scc findings list organizations/${ORG_ID} \
  --filter="category=\"COMPLIANCE_VIOLATION\"" \
  --format=json > monthly-compliance-report.json

Evidence Collection Schedule

Certification Process - Stages and Timeline

Stage 1: Gap Analysis (2–4 weeks)

Assessment of current security posture against ISO 27001:2022 requirements. Output: list of gaps to close.

What you check:

• Do basic policies exist (access control, cryptography, incident management)?
• Is logging enabled with logs retained for minimum 1 year?
• Is IAM configured according to least privilege?
• Does backup exist and is it tested?
• Does the CI/CD pipeline have security gates?

Stage 2: ISMS Implementation (6–12 weeks)

Closing gaps identified in the analysis:

• Drafting missing policies and procedures
• Configuring technical controls (IAM hardening, CMEK encryption, logging)
• Deploying compliance tools (Audit Manager / Defender / SCC)
• Staff training (security awareness)
• Conducting risk assessment

Stage 3: ISMS Operating Period (minimum 3 months)

The certification auditor requires evidence that the ISMS is operating. Minimum 3 months of operation before the certification audit. During this time:

• Collect evidence (automatically)
• Conduct at least 1 internal audit
• Conduct a management review
• Respond to incidents per your procedure (if any occur)
• Review and update the risk register

Stage 4: Certification Audit (Stage 1 + Stage 2)

• Stage 1 (1–2 days) - auditor reviews ISMS documentation, policies, risk register, SoA. Identifies any gaps before Stage 2.
• Stage 2 (2–5 days, depending on company size) - auditor verifies controls are actually operating. Staff interviews, evidence review, configuration testing.

Timeline for a 30–50 Person UK Company Operating in the Cloud

Week 1–4:     Gap analysis + remediation plan
Week 5–16:    ISMS implementation (policies + technical controls)
Week 17–28:   ISMS operating period (evidence collection)
Week 20:      Internal audit
Week 24:      Management review
Week 29:      Stage 1 certification audit
Week 31–32:   Stage 2 certification audit
Week 33:      Certification decision

Realistic timeline: 8–9 months from decision to certificate. Can be shortened to 6 months if the company already has mature security processes (e.g., existing SOC 2 or Cyber Essentials Plus).

Certification Costs

One-Off Costs (Preparation + Audit)

Annual Costs (Maintaining Certification)

Optimising Costs: Native Tools vs GRC Platforms

Two approaches for evidence collection:

1. GRC platforms (Vanta, Drata, Secureframe) - cross-cloud automation, ready-made mappings, compliance dashboard. Cost: £7,000–£18,000/year. Advantage: faster implementation, less manual work.

2. Native cloud tools (Audit Manager, Defender, SCC) - cheaper (£1,000–£4,000/year) but require more configuration and integration. Advantage: no additional vendor, data stays in your cloud.

For single-provider environments: native tools are sufficient. For multi-cloud: a GRC platform saves time.

Common Mistakes When Certifying Cloud Infrastructure

1. Copying Template Policies Without Cloud Adaptation

The auditor will immediately notice that your access control policy mentions “badge access to the server room” when your company has no server room. Policies must reflect reality - describe IAM Roles, SSO, Conditional Access, not physical locks.

2. No Evidence That Controls Are Monitored

Having CloudTrail enabled is not enough. The auditor will ask: “Show me that you analyse these logs.” You need:

• Alerts on suspicious activities (evidence of monitoring)
• Response processes for alerts (evidence of incident response)
• History of closed incidents (evidence the procedure works)

3. Scope Too Broad

You do not need to certify the entire company. The scope can cover, for example, “Service X delivered to clients, including supporting cloud infrastructure on AWS and the development team.” The narrower the scope, the fewer controls to implement, less evidence to collect, and lower audit cost.

4. Ignoring People Controls (A.6)

ISO 27001 is not just technology. A.6 (People controls) requires:

• Pre-employment vetting (DBS checks where appropriate, reference verification)
• Security awareness training
• Confidentiality obligations (NDA or contract clause)
• Leaver process (deprovisioning access)

In a cloud-native company, deprovisioning must include: removal from IdP (which automatically cuts access to AWS/Azure/GCP), revocation of repository access, rotation of secrets the person had access to.

5. No Backup Restore Testing

Control A.8.13 (Information backup) requires not just having backups - but evidence that they work. The auditor will ask: “When did you last test a restore from backup? What was the result?” Plan restore tests quarterly and document the outcomes.

Summary - Preparation Checklist

Phase 1: Organisational Foundation (weeks 1–4)

• Define ISMS scope (which systems, data, team)
• Appoint Information Security Officer
• Draft Information Security Policy
• Conduct gap analysis

Phase 2: Technical Controls (weeks 5–12)

• IAM hardening (SSO, MFA, least privilege, access reviews)
• Logging and monitoring (CloudTrail/Activity Log/Audit Logs + centralisation + WORM)
• Encryption (CMEK for sensitive data, key rotation)
• Backup + restore testing
• CI/CD pipeline with security gates (SAST, SCA, container scan)
• Network security (security groups / NSG, WAF, VPC isolation)

Phase 3: Documentation and Processes (weeks 8–16)

• Risk assessment (risk register + treatment plan)
• Statement of Applicability (SoA)
• Incident management procedure
• Business continuity plan (BCP/DR)
• Cryptography policy
• Cloud services policy (A.5.23)

Phase 4: ISMS Operation (weeks 17–28)

• Automated evidence collection (Audit Manager / Defender / SCC)
• Staff training
• Internal audit
• Management review
• Respond to findings and implement corrective actions

How We Can Help

At Devopsity, we help UK technology companies prepare their cloud infrastructure for ISO 27001 certification. Typical engagement:

• Gap analysis (3–5 days) - assessment of current security posture against ISO 27001:2022, report with gaps and recommendations
• Technical control implementation (4–8 weeks) - IAM hardening, log centralisation, CMEK encryption, CI/CD security gates, compliance automation
• Audit support (2–3 weeks) - documentation preparation, evidence collection tooling configuration, support during Stage 1 and Stage 2
• Ongoing maintenance - quarterly security reviews, ISMS updates, surveillance audit support

Planning ISO 27001 certification?

Book a free consultation. We'll assess how much time and effort your specific situation requires.

Book a call

Frequently Asked Questions

Does my cloud provider’s ISO 27001 certificate cover me?

No. Your provider’s certificate confirms the security of their infrastructure (data centres, network, hypervisor). Your application, IAM configuration, data, and processes require separate certification. The Shared Responsibility Model means the provider covers physical controls (A.7), but organisational (A.5), people (A.6), and most technology controls (A.8) are your responsibility.

How much does ISO 27001 certification cost for a 30–50 person UK company?

With cloud infrastructure and mature DevOps processes: £18,000–£40,000 one-off (consultant + audit + tooling). Annual maintenance: £5,000–£12,000 (surveillance audit + tooling + team time). Companies without existing security policies can expect higher implementation costs.

Can I achieve ISO 27001 without a consultant?

Technically yes, but it is risky. The standard is interpretive - auditors expect a specific approach to documentation and evidence. Companies that go through the process without experienced support typically spend more time (and money on repeated audits) than those that invest in a consultant from the start.

ISO 27001 vs SOC 2 - which should I choose?

Depends on your market. ISO 27001 is preferred in Europe, UK public sector, and regulated industries. SOC 2 is the standard in the US and among SaaS companies. If you serve clients on both sides of the Atlantic, you may need both. Good news: approximately 70% of controls overlap, so holding one significantly eases achieving the other.

How long is the ISO 27001 certificate valid?

The certificate is valid for 3 years, but requires annual surveillance audits (on the anniversary of certification). If a surveillance audit reveals major non-conformities that are not resolved within the prescribed timeframe, the certificate can be suspended. After 3 years, recertification (full audit) is required.

Does ISO 27001 help with UK NIS Regulations compliance?

Yes. The UK NIS Regulations 2018 (the UK’s implementation of the original NIS Directive, with updates planned to align with NIS2 principles) require operators of essential services and relevant digital service providers to implement appropriate security measures. ISO 27001 covers the majority of NIS requirements (risk management, incident handling, business continuity, supply chain security). The certificate does not guarantee NIS compliance (the regulations have additional incident reporting requirements via the NCSC), but it substantially supports demonstrating conformity.

How does ISO 27001 relate to Cyber Essentials?

Cyber Essentials and Cyber Essentials Plus focus on five technical controls (firewalls, secure configuration, user access control, malware protection, security update management). ISO 27001 Annex A covers all of these and significantly more. If you already hold ISO 27001, achieving Cyber Essentials Plus is straightforward. Many UK companies pursue both: Cyber Essentials Plus for government contract eligibility and ISO 27001 for broader enterprise assurance.