ISO/IEC 27017

ISO/IEC 27017:2015 is an international standard created by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). This was created conjointly by technical committee ISO/IEC JTC 1/SC 27 (Information security, cybersecurity, and protection of privacy) IT Governance+3ISO+3ISO+3. It belongs to the ISO/IEC 27000 family that talks about information security management systems (ISMS) and related practice controls. Wikipedia+1. The standard gives guidance for information security controls for cloud service providers (CSPs) and cloud service customers (CSCs). Specifically adapted to cloud specific environments like responsibility, virtualization, dynamic provisioning, and multi-tenant infrastructure. Ignyte+3Microsoft Learn+3Google Cloud+3.^[1]

The main purpose of ISO/IEC 27017 is to provide the controls in ISO/IEC 27002 (Code of practice for security controls). By giving guidance for cloud services usage and offering controls. Microsoft Learn+2ISO+2. The ISO abstract standard is: "gives guidelines for information security controls applicable to the provision and use of cloud services by providing (a) additional implementation guidance for relevant controls specified in ISO/IEC 27002; (b) additional controls with implementation guidance that specifically relate to cloud services." ISO+1. It was suppose to be used by organizations that give or use cloud services and want to use those practices for cloud security controls, mainly when their ISMS is based on ISO/IEC 27001 or ISO/IEC 27002. ISMS.online+1. Cloud models use third party providers usually and share responsibilities, virtual and ephemeral assets, and dynamic scaling. ISO/IEC 27017 focuses on clarifying roles of control implementation in cloud computing. Google Cloud+1.

ISO/IEC 27017:2015 was created December 2015 (Edition 1). ISO+1. The standard was last updated in 2024 and still remains. ISO. A 2nd Edition of ISO/IEC DIS 27017 is under development and is under inspection. This will update the guidance on ISO/IEC 27003:2022 and address the changing cloud service risks. ISO+1.

ISO/IEC 27017 collects the clause structure of ISO/IEC 27002. (Covering information security policy, organizations, human resources security, asset management, access control, cryptography, physical and environmental security, operations security, communication security, and system acquisition/development/maintenance. Wikipedia+1.

• Additional guidance for multiple ISO/IEC 27002 controls as they use them in a cloud context. Microsoft Learn+1.
• Seven cloud specific controls are labelled CLD that addresses the shared roles and responsibilities with the environment of cloud computingIT Governance+1, The removal or return of customer assets at the end of a contract IT Governance+1, Protection and separation of the customer's environment, Virtual machine configuration and/or hardening IT Governance+1, Operational security of admins and cloud environments operations procedures, Monitoring of cloud service activity for the customer IT Governance+1, and lastly the alignment of security management for virtual and physical networks in a cloud environment IT Governance+1. This furthers the standard and highlights the shared responsibility by giving guidance for the provider and the customer.

ISO/IEC are applicable and benefits

• Cloud service providers (CSPs) that want to show strong, internationally security controls for their offers. As an example, Google Cloud follow ISO/IEC 27017:2015 for multiple services. Google Cloud.
• Cloud service costumers (CSCs) use cloud services to hope their service provider controls and shared responsibilities are positioned with the good practices and that they themselves hold their promises and responsibilities. Microsoft Learn.
• Organizations are creating public and private hybrids that extend their ISMS based on ISO/IEC 27001/27002 in cloud domains 6clicks.com.

Assistance have been improved the roles and responsibilities to help vendors and its customers. This creates more preparedness for audits and compliances. BSI Group+1. However this also requires organizations to combine the standards with their internal governance, contracts/SLAs, and monitoring/automation of frameworks.

Shared Responsibilities Model highlights what the cloud service providers does versus what the customer retains responsibility for. The importance in cloud computing connects infrastructure, platform, data, and applications can last for multiple parties. Google Cloud+1.

Asset and Data Lifecycle Management make cloud services commonly involve complex provisioning, elasticity, disposal of virtual assets and data at the end of services. ISO/IEC 27017 has rules for the return or secure deletion of the consumer's data and assets when the contract ends. IT Governance.

Virtualisation, Multi Tenancy and Segregation provides the controls for a secure configuration of virtual machines and technology. The separation of the customer's environment, segregation of duties, and tough templates and monitoring of virtual models ISMS.online+1.

Monitoring, Logging & Auditability

The cloud context gives visibility into provider operations, changes, configuration, and audit logs are important. This underlines the CSP and CSC roles with monitoring Microsoft Learn+1.

Contractual/Supplier Relationship Alignment

Cloud services commonly involve multiple suppliers, sub-processors, global data flow and complex service relationships. ISO/IEC 27017 gives direction to its customers and provides how to incorporate cloud security controls in the contracts (SLAs and supplier management) IT Governance+1.

Integration with ISMS and Other Standards

This standard was created to integrate with an ISMS (e.g., ISO/IEC 27001) and to connect with ISO/IEC 27002. Organizations adopt and use ISO/IEC 27017 as a supplementary layer once their general ISMS are fully in place.

Implementation Considerations

Organizations implementing ISO/IEC 27017 should follow with a structured approach like:

1. Define Scope and Context - Determine the types of cloud services (IaaS, PaaS, SaaS), deploy models (public, private, hybrid) and define the roles of CSP or CSC.
2. Risk Assessment - Identify specific threats like loss of visibility, multi-tenant leakage, dynamic provisioning risks, sub-processor dependency, and the assess the impact or likelihood.
3. Select Applicable Controls - Use the standard's guidance to layout the controls for both general and specific to the environment and give responsibilities.
4. Contrast /SLAs Alignment - Make sure the provider and customer contracts have shared responsibilities. Asset and data return or deletion plans of action, audit rights, monitoring obligations, and sub-processor transparency.
5. Implement Controls and Technical Measures - Have virtual machine hardening, segregation the environments, manage the lifecycle of assets in the cloud, have a monitoring or logging infrastructure, or change the framework managements.
6. Monitor, Audit, and Evidence - Collect evidence of effectiveness like audit reports, certificates, logs, and dashboards. Review the provider under scope and have periodic reviews and updates.
7. Continuous Improvement - Cloud technologies change fast (serverless, edge, and AI). Organizations must remain in control relevant like monitoring emerging risks and be ready to adapt to any updates Secureframe.

Certification and Compliance

It is important to know that ISO/IEC 27017 is a code of practice and not a certification in itself unlike ISO/IEC 27001 that defines requirements for management systems Vanta. Multiple cloud service providers include ISO/IEC 27017 in their portfolios and audits. Certification bodies often give a provider's ISMS under ISO/IEC 27001 and reference to ISO/IEC 27017 controls or reports. As an example, IBM Cloud issued an audit documentation for ISO/IEC 27017 IBM. Customers should proceed with cation when reviewing the scope of any certificate or audit statements to determine what services, regions, and controls are protected. ISO/IEC 27017 compliant certification helps the assurance and procurement decisions.

Benefits:

• It enhances clarity in shared responsibilities of the models between CSPs and CSCs.
• It gives a cloud-specific navigation and help reduce cloud-specific risks in security like multi-tenant exposure, data, remanence, and virtual asset misconfiguration.
• It helps organizations align cloud with governance and operations with internationally accepts best-practice controls that leads to being more trustworthy, stakeholder confidence, and audit readiness BSI Group+1.
• Used as a code of practice and does not mandate controls. Organizations interpret and use the navigation within their risk context.
• In 2015, the edition may not fully reflect the latest cloud technologies like serverless, container orchestration, and edge computing. Continuous adaptation is needed 6clicks.com.

Some organizations treat ISO/IEC 27017 certification claims as the same to ISO/IEC 27001 certification because due diligence is needed to understand the audit coverages.

ISO/IEC 27017 is mainly used in conjunction with several related standards:

• ISO/IEC 27001: Needs requirements for establishing, implementing, maintaining, and improving an ISMS. Organizations layer ISO/IEC 27017 gives guidance to an ISMS that was built on ISO/IEC 27017 Vanta.
• ISO/IEC 27002: give the controls objectives and the creation of guidance for general information security controls. ISO/IEC 27017 adapts these for cloud environments Microsoft Learn+1.
• ISO/IEC 27018: gives a code of practice to protect personal identifiable information (PII) in pubic clouds acting as PII processors. ISO/IEC27017 is general for cloud security and 27018 is more focus on privacy/PII in the cloud Wikipedia+1.
• Frameworks like Cloud Security Alliance (CSA) and Cloud Controls Matrix (CCM) commonly map their controls set to ISO/IEC 27017. A lot of cloud-compliance tools and vendor assurance frameworks use these mappings IT Governance.

Future Developments

In the future, ISO/IEC DIS 27017 (Edition 2) is scheduled to align with the standards with ISO/IEC 27002:2022 and update the cloud-specific controls to evolve severless architectures, muliti-cloud/hybrid deployments, edge computing, and AI services. Organizations should can anticipate that the future updates will incorporate more dynamic controls and have more emphasis on automation and improve the guidance for future models.

• International Organization for Standardization (ISO). ISO/IEC 27017:2015 – Information technology — Security techniques — Code of practice for information security controls based on ISO/IEC 27002 for cloud services. ISO. ISO+2ISO+2
• Microsoft. ISO/IEC 27017:2015 code of practice for information security controls. Microsoft Learn. Microsoft Learn+1
• Google Cloud. ISO/IEC 27017 – compliance. Google Cloud. Google Cloud
• IBM Cloud. ISO 27017 Compliance – IBM Cloud. IBM. IBM
• BSI Group. ISO/IEC 27017 – Information Security for Cloud Services. BSI. BSI Group
• IT Governance UK. ISO/IEC 27017 and ISO/IEC 27018 – Cloud security standards. IT Governance. IT Governance
• Secureframe. How to Secure Your Cloud Infrastructure with ISO 27017 Compliance. Secureframe Blog. Secureframe
• Sprinto. ISO 27017 – Security & Compliance Techniques. Sprinto Blog. Sprinto
• NordLayer. ISO 27017: Cloud Protection Essentials. NordLayer article. NordLayer
• 6clicks. ISO 27017: Comprehensive Guide to Cloud Security Standards. 6clicks Resources. 6clicks.com
• Barr Advisory. ISO 27000 Series: The Ins and Outs of ISO 27001, ISO 27002, ISO 27017 & ISO 27018. Barr Advisory. BARR Advisory
• A-LIGN. Strengthening the Cloud: ISO 27017 and ISO 27018. A-LIGN article. A-LIGN
• EUNETIC. Understanding ISO/IEC 27017: Cloud Service Security Standards. EUNETIC Knowledge Base. eunetic.com
• Wikipedia contributors. ISO/IEC 27017. Wikipedia. Wikipedia
• OECD (for example – you may add a standard-body or regulatory white-paper)
• CSA / Cloud Security Alliance materials (add mapping of 27017)
• Academic paper: “An Analysis of the Cloud Computing Security Problem” (Almorsy, Grundy, Müller, 2016) — covers cloud risk, helpful for context. arXiv
• Academic paper: “Security and Privacy of Sensitive Data in Cloud Computing: A Survey of Recent Developments” (Gholami & Laure, 2016) — cloud security context. arXiv
• Wikipedia contributors. ISO/IEC 27000 family. Wikipedia. Wikipedia

• Additional source: e.g., ISMS.online article ISO/IEC 27017 Cloud Security Controls. ISMS.online

• ISO Website