July 2026. Cloud shared responsibility models shift tasks between provider and customer — but auditors hold you accountable for what is in your scope. Copy-paste vendor marketing in the SoA fails in samples.
Document per platform
- identity & access (MFA, roles, keys);
- logging & monitoring (cloud audit logs enabled?);
- encryption & key management;
- backup/restore and configuration hardening;
- contract + DPA/subprocessors.
SoA and evidence
Per control: provider covers / we monitor / we implement. Evidence = tenant config screenshots, policy exports, review tickets — not only vendor ISO certificate.
More: ISO 27001 SaaS, ISMS. On scope change (new region, new SaaS) update SoA within change process.
SME tip: start with top three cloud apps; full matrix for entire landscape can grow iteratively if risks and plan are in management review.
Tenant hardening as evidence
Export quarterly security baseline (CIS, vendor benchmark) for cloud tenant — diff since last quarter. Auditors value trend over one-off screenshot.
Identity federation: document trust relationships, conditional access policies and break-glass. Sample admin role assignment in cloud console.
Multi-cloud: one SoA section per platform, shared identity where possible — avoid three incompatible silos without governance.
Next steps in your ISMS
Turn this article into one concrete action in your risk register or improvement plan: owner, deadline, expected evidence. Discuss progress in the next management review — auditors and chain partners want decisions, not policy intent alone. Link where possible to existing ISO 27001, NIS2 or GDPR documentation so you do not maintain parallel folders.
Questions on scope, certification or chain requirements? Use our readiness overview and knowledge base for deeper guidance. This article does not replace legal or audit advice for your situation.
Share relevant findings briefly with line management and procurement — compliance becomes workable when the whole organisation recognises the same priorities. Repeat the chosen action quarterly in team meetings and update evidence locations in your SoA or control plan so surveillance samples are easy to answer.