ISO/IEC 27017 · CLOUD SECURITY
ISO 27017 compliance for cloud providers and cloud users
Add cloud-specific security controls to your ISO 27001 ISMS and show customers exactly who secures what in your cloud.
What is ISO 27017?
ISO/IEC 27017 is a code of practice that gives cloud-specific guidance on information security controls for both cloud service providers and cloud customers. It builds on ISO 27002 and adds seven cloud-specific controls. Organisations usually achieve it as an extension to their ISO 27001 certification.
Cloud customers want to know who secures what.
In the cloud, security is shared between provider and customer, and gaps appear in the handover. ISO 27017 makes those responsibilities explicit and adds controls for virtual environments, admin operations and cloud monitoring.
Clear shared-responsibility matrix for customers
Cloud-specific controls audited alongside ISO 27001
Stronger answers to enterprise cloud questionnaires
What our ISO 27017 service covers
Gap assessment
Your ISMS against ISO 27017 guidance.
Shared responsibility
Provider and customer roles documented.
Cloud controls
The seven additional cloud controls implemented.
Cloud security audit
Configuration evidence from AWS, Azure or GCP.
Policy updates
ISMS documents extended for cloud.
Audit support
Assessment alongside your ISO 27001 audit.
How we get you there
Gap assessment
Against ISO 27017 and your SoA.
Responsibility matrix
Who owns each control.
Implement
Cloud controls and configuration fixes.
Evidence
Cloud audit and monitoring records.
Audit
Certification body assessment with ISO 27001.
The seven cloud-specific controls in ISO 27017
| Control | What it requires |
|---|---|
| CLD.6.3.1 | Shared roles and responsibilities in a cloud computing environment |
| CLD.8.1.5 | Removal of cloud customer assets when the service ends |
| CLD.9.5.1 | Segregation in virtual computing environments |
| CLD.9.5.2 | Virtual machine hardening |
| CLD.12.1.5 | Administrator's operational security |
| CLD.12.4.5 | Monitoring of cloud services |
| CLD.13.1.4 | Alignment of security management for virtual and physical networks |
What you get
Who needs ISO 27017?
SaaS, PaaS and IaaS providers
Companies hosting customer data in AWS, Azure or GCP
Vendors facing cloud security questionnaires
Organisations already ISO 27001 certified
Why teams choose HostX for ISO 27017
Cloud-native
Our cloud auditors produce your evidence.
Efficient
Audited together with ISO 27001.
Clear
Customers see exactly who does what.
Tracked
Controls live in the Compliance Tool.
Related services
Frequently asked questions
Show customers your cloud is secured the right way.
Book a consultation to add ISO 27017 to your ISO 27001 scope.