Services

ISO 27017

ISO 27017 isn't a standalone certification — it's a code of practice that extends ISO 27001's controls with guidance specific to cloud services, and it applies to both sides of the relationship: cloud providers and the customers using those services. If you're already running an ISO 27001 information security management system and you operate in or depend heavily on the cloud, 27017 fills in gaps that the base standard doesn't address directly.

The controls it adds are specifically about things that get murky in cloud environments: who's responsible for what when a provider and a customer share infrastructure, how data is actually segregated between tenants, what happens to your data and access rights when you terminate a cloud service, and how virtualized environments are secured and monitored.

Why this matters beyond the paperwork

A lot of cloud security incidents trace back to exactly the kind of ambiguity 27017 is meant to close — an assumption about who patches what, or who's responsible for configuring a storage bucket correctly. Walking through the standard properly means those responsibilities get written down and tested, not assumed.

How I'd approach it

If you're already ISO 27001 certified, this is a targeted gap analysis against the cloud-specific controls, not a rebuild from scratch. If you're not yet certified at all, it usually makes more sense to build 27001 and the 27017 cloud controls together rather than bolting one onto the other later. Either way, the goal is controls that reflect how your cloud environment actually works — your specific provider, your specific architecture — not a generic checklist that technically passes an audit.

If cloud security responsibilities in your organization are more assumed than documented, that's worth fixing. Let's talk through where you stand.