ISO 27017: Cloud Security Controls Guide
ISO/IEC 27017 provides guidelines for information security controls applicable to the provision and use of cloud services. It extends ISO 27002 with cloud-specific implementation guidance and introduces seven additional controls unique to cloud computing.
What ISO 27017 Covers
The standard addresses security from both perspectives: cloud service providers (CSPs) and cloud service customers (CSCs). For each ISO 27002 control, ISO 27017 adds cloud-specific implementation guidance, clarifying responsibilities for each party.
Seven additional controls address cloud-specific concerns: shared roles and responsibilities, asset removal after contract termination, virtual environment segregation, virtual machine hardening, administrator operational security, cloud network monitoring, and alignment of security management across virtual and physical networks.
Who Needs ISO 27017
Cloud service providers seeking to differentiate on security should consider ISO 27017. It is particularly valuable for IaaS, PaaS, and SaaS providers that need to demonstrate cloud-specific security measures beyond what ISO 27001 alone covers.
Cloud customers in regulated industries also benefit, as ISO 27017 provides a framework for evaluating and managing cloud-related risks. Financial institutions and government agencies increasingly expect their cloud providers to hold ISO 27017 certification.
Certification Process
ISO 27017 is not a standalone certification. Organizations certify by extending their ISO 27001 scope to include ISO 27017 controls. This means you must have or be pursuing ISO 27001 certification first.
- Prerequisite — Establish an ISO 27001-certified ISMS
- Cloud risk assessment — Identify cloud-specific threats and vulnerabilities
- Control gap analysis — Map existing controls to ISO 27017 requirements
- Implement additional controls — Address the seven cloud-specific controls
- Extend audit scope — Include ISO 27017 in your next ISO 27001 audit cycle
Cost Considerations
For organizations already ISO 27001 certified, the incremental cost of adding ISO 27017 is modest. Primary expenses include additional consulting for cloud-specific gap analysis, documentation updates, and slightly expanded audit scope. Expect $15,000 to $30,000 in incremental costs for a mid-size cloud provider.