ISO/IEC 27017

What is ISO/IEC 27017?

ISO/IEC 27017 gives guidance on information security controls for cloud services. It takes the controls of ISO/IEC 27002 and adds cloud-specific guidance and extra controls, written for both sides of the relationship: the cloud service provider and the cloud service customer. It applies to every deployment model: public, private and hybrid.

The second edition was published in July 2026. It replaced the 2015 edition, which ISO has now withdrawn, so check that contracts, policies and audit scopes refer to the current version.

Why does it matter?

Cloud security problems often come from unclear responsibilities. A customer may assume the provider backs up its data or manages access, while the provider assumes the customer does. ISO/IEC 27017 helps both sides see how each control applies when infrastructure and operations are shared, and who does what. The 2015 edition’s extra cloud controls dealt with topics such as shared security roles, separating one customer’s environment from another’s, monitoring cloud services, removing customer assets when a contract ends and documenting administrator operations. Check the 2026 edition for its current set.

Who uses it?

• Providers use it to design their services and to show customers how they handle security in the cloud.
• Customers use it to decide what to ask providers for, and which controls they still have to run themselves.

Can you certify to it?

There is no separate certificate to ISO/IEC 27017 on its own. Organisations usually ask their certification body to assess it as part of an ISO/IEC 27001 certification, with the cloud controls added to the scope and the Statement of Applicability. The certificate then refers to both.

How does it relate to other frameworks?

It sits alongside ISO/IEC 27018, which covers personal data in public clouds, and the cloud controls of frameworks such as the CSA Cloud Controls Matrix and FedRAMP. Providers often cover several of these with one integrated set of controls.