← ISO 27001 Annex A in plain English

A.5.23 A.5

Organizational / A.5.23

Security expectations for cloud services

Think of it likeReading what the storage company is actually responsible for before putting the heirlooms in.

In plain English

The family sets expectations for the services it rents rather than owns, because handing something to a provider does not hand over the responsibility for it.

Related CSF and CIS controls (unofficial mapping)