Compliance / ISO/IEC 27017
Cloud security controls, recognized internationally.
ISO/IEC 27017 gives guidance on information security controls for cloud services. It extends the controls in ISO/IEC 27002 with cloud-specific guidance and adds controls covering how security responsibilities are shared between cloud providers and their customers.
Cloud providers usually add it to the scope of an ISO/IEC 27001 certification so customers can see that cloud risks are handled explicitly. We help you map the controls, close gaps and prepare for the audit.
At a glance
- Current version
- ISO/IEC 27017:2015
- Builds on
- ISO/IEC 27001 and ISO/IEC 27002
- Adds
- Seven cloud controls, such as shared roles, virtual machine hardening and removal of customer assets
- Certification
- Usually assessed with ISO/IEC 27001 by an accredited certification body
ISO/IEC 27017
Why cloud providers add it
Customers often ask how a provider separates tenants, hardens virtual machines, removes customer data at the end of a contract and monitors administrator activity. ISO/IEC 27017 gives structured answers to those questions, and certification gives customers independent assurance.
One detail needs care: ISO/IEC 27017 is written against the 2013 control set of ISO/IEC 27002. Mapping its guidance onto the 2022 Annex A controls takes judgment, and that is where many programs need help.
How we help
Control mapping
Line the cloud guidance up with your current Annex A controls.
- Mapping of ISO/IEC 27017 guidance to ISO/IEC 27001:2022 Annex A
- Statement of Applicability updates
- Gap assessment against the seven cloud-specific controls
Technical controls
The controls auditors test in practice.
- Tenant isolation and segregation of virtual environments
- Virtual machine and container hardening
- Administrator access and activity logging
- Monitoring of cloud services
- Alignment of virtual and physical network security
Who issues the certificate
Certification against ISO/IEC 27017 is granted by accredited certification bodies, usually as part of an ISO/IEC 27001 audit. We prepare you for it and work alongside your certification body.
Services that support this work
FAQ
Frequently asked questions
Do we need ISO/IEC 27001 first?
In practice, yes. Certification bodies assess ISO/IEC 27017 as an extension of an ISO/IEC 27001 management system, so the management system has to exist first.
What about ISO/IEC 27018?
ISO/IEC 27018 covers the protection of personal data in public clouds. Many providers pursue it alongside ISO/IEC 27017, and we can scope both together.
Find out where you stand on ISO/IEC 27017.
A readiness review shows what an assessor would find today and what it will take to close the gaps.