Extend your ISMS to the cloud with ISO 27017, without the busywork

ISO 27017 is an international code of practice for information security in cloud services, published by ISO and IEC as ISO/IEC 27017:2015. It takes the ISO/IEC 27002 control set and adds cloud-specific guidance for cloud service providers and cloud service customers. It also introduces seven additional cloud controls, such as shared roles and responsibilities, virtual machine hardening and monitoring of cloud services.

No. ISO 27017 is a voluntary standard and no law requires it. Organisations adopt it because customers, partners or procurement processes ask for assurance about cloud security. Some contracts and tenders name it as a requirement, which makes it contractually expected for those suppliers. There are no statutory penalties for not following it, but missing it can cost you deals with security-conscious buyers.

ISO 27017 is guidance rather than a management system standard, so it is not usually certified on its own. Instead, organisations include its controls in their ISO/IEC 27001 information security management system and Statement of Applicability. An accredited certification body then assesses them, typically issuing an ISO 27001 certificate that references ISO 27017 or a separate attestation of conformity with it.

ISO 27001 sets the requirements for an information security management system, while ISO 27017 gives cloud-specific guidance on implementing security controls. ISO 27001 applies to any organisation; ISO 27017 focuses on cloud service providers and customers. In practice, ISO 27017 extends an ISO 27001 ISMS, clarifying who is responsible for each control in a cloud environment and adding seven cloud controls.

The seven cloud controls in ISO 27017 are: CLD.6.3.1 shared roles and responsibilities within a cloud computing environment, CLD.8.1.5 removal of cloud service customer assets, CLD.9.5.1 segregation in virtual computing environments, CLD.9.5.2 virtual machine hardening, CLD.12.1.5 administrator's operational security, CLD.12.4.5 monitoring of cloud services, and CLD.13.1.4 alignment of security management for virtual and physical networks.

ISO 27017 covers information security controls for cloud services in general, while ISO 27018 focuses on protecting personally identifiable information processed in public clouds. They complement each other and both build on ISO/IEC 27001 and 27002. Cloud providers that handle personal data often implement both, using ISO 27017 for cloud security responsibilities and ISO 27018 to support privacy obligations such as those under UK GDPR.

Yes, a revision is in progress. ISO/IEC 27017:2015 remains the current published edition, but ISO has been preparing a second edition aligned with the ISO/IEC 27002:2022 control structure. Organisations certified against the 2015 edition should check with their certification body about transition timing once the new edition is formally published.

Yes. OneClickComply supports ISO 27017 today. Because it is mapped to the same controls as ISO 27001, evidence you collect for your ISMS also counts towards ISO 27017. OneClickComply helps with automated cloud evidence collection, policy generation and continuous monitoring, and our in-house audit team can guide you before your certification body assessment.