Suppose that in the ISMS scope I have the management of services provided by some cloud provider, i.e the provider provides me a virtual server for performing certain critical operations.
I would like to ask what I need to get as evidence of security compliance for the following scenarios:
a) Cloud provider is ISO27001 certified. I guess I only need to show that the relevant services are in the scope of its certificate that is public.
b) Cloud provider is following ISO27001 but is NOT certified: Do I need to have an SLA for providing me the internal audit results or allow me to do a pentest on their site?
c) Does not follow ISO27001 best practices (or at least does not claim): Do I need to have an SLA and their authorization to perform a pentest?
In case the cloud provider does not accept do I only say it is an acceptable risk?