NIST SP 800-215 Guide to a Secure Enterprise Network Landscape 3.1: Broker cloud access to find shadow IT and enforce data, threat and configuration policy in the clouds used

What does 3.1 require?

An enterprise subscribing to several clouds places a cloud access security broker between its users and the providers so that it sees every cloud resource users reach (ending or limiting unauthorised software as a service use), extends its on-premises security and governance policies to cloud applications, protects data at rest in provider servers and in flow (data loss prevention), tracks account hijacking and anomalous access behaviour to stop insider and advanced attacks, and detects misconfigurations in its infrastructure subscriptions and corrects them against recognised benchmarks.