If you are running your apps in AWS, can you please advise on who in your AWS / Cloud team is accountable to documenting AWS Account Isolation Process in case of a Cyber Ransomware attack?  Is it your Information Security team, Network team or come other team?

I agree with the above comment in that the cybersecurity team has policies, standards etc. that teams such as the AWS/Cloud team/COE need to ensure are part of the implemented solution.  In case of ransomware, I am guessing that such event would mean activation of the cyber incident response team and if the request comes to isolate, AWS team and any other team that is asked to isolate, needs to have a procedure on how to do that.  This procedure would be created by the AWS/Clout team/COE and kept up to date with cybersecurity team and potentially internal audit as well as cyber assessments reviewing it and providing feedback.

Mike

Your cloud security team should have a policy in place for all aspects of Cloud Security and Resiliency before moving anything to the cloud.  Policy first, standards second, and procedures next.  When developing your overall strategic plan for moving to the cloud remember that high availability does not equal recoverability. Make sure there are standards in place for all aspects of cloud security and resiliency including backing up cloud hosted data and code repositories.