Relevant information security requirements shall be established and agreed with each supplier based on the type of supplier relationship (ISO 27001 Annex A 5.20).

Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization’s information security requirements.(ISO 27001 Annex A 5.23)