"Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization’s information security requirements."[1]

Define criteria for cloud services that the organization will use. For example requiring that the service is FEDRAMP moderate or has an ISO 27001 certification. Manage the service in accordance with the organization's information security policies and procedures. Cloud services generally need additional security settings to meet ISO 27001 requirements. The CIS Benchmark for Microsoft 365 and Google Workspace helps organization's to securely configured these common cloud services. When terminating/exiting a cloud service ensure that a process exists to remove all organization data and migrate to a new service.