ISO 27017 Certification Requirements Explained

Understanding ISO 27017 Certification Requirements

Many organizations search for "ISO 27017 requirements" expecting a list of mandatory clauses. In reality, ISO 27017 works differently from management system standards like ISO 27001.

ISO/IEC 27017 provides additional guidance for relevant controls specified in ISO/IEC 27002:2022, along with additional controls and guidance that specifically relate to cloud services. It is a guidance standard, not a standalone management system.

ISO 27017 is not independently certifiable as a standalone management system standard. It supplements ISO/IEC 27001 certification. This means ISO 27017 certification requirements come from two sources:

• ISO 27001 Management System Requirements: Clauses 4 to 10, which must be met in full.
• ISO 27017 Cloud Security Controls: Controls included in the Statement of Applicability and implemented based on cloud risks and organizational responsibilities.

Understanding both parts is essential for preparing successfully for ISO 27017 Certification.

ISO 27017 Cloud Security Control Requirements

ISO 27017 controls follow the applicable ISO/IEC 27002 control structure. The following are key cloud security requirements organizations typically address under each control theme.

Organizational Controls

• Cloud Security Policies: Establish policies addressing cloud-specific risks, responsibilities, and services.
• Shared Roles and Responsibilities: Clearly define, document, allocate, and communicate security responsibilities between cloud providers and customers.
• Supplier Relationships: Establish cloud service agreements specifying security responsibilities and requirements.
• Cloud Service Use: Establish processes for securely acquiring, using, managing, and exiting cloud services.
• Information Classification and Labelling: Handle cloud customer information according to its classification.
• Asset Management: Maintain cloud asset inventories and securely return or remove customer assets when services end.
• Incident Management: Establish agreed processes for reporting and coordinating security incidents between providers and customers.
• Legal and Regulatory Compliance: Identify applicable legal requirements, including data location and jurisdiction requirements.
• Evidence and Records: Establish arrangements for collecting and sharing evidence relevant to cloud incidents.

People Controls

• Screening and Responsibilities: Ensure personnel with access to cloud environments are appropriately screened and understand their responsibilities.
• Awareness: Ensure staff understand cloud security policies, especially personnel managing cloud services.
• Confidentiality: Ensure personnel handling customer information are bound by confidentiality obligations.

Physical Controls

• Secure Facilities: Protect cloud provider data centers against unauthorized physical access.
• Equipment Security: Ensure secure siting, maintenance, and disposal of equipment hosting cloud services.
• Secure Disposal: Ensure customer data is securely erased from storage media before reuse or disposal.

Technological Controls

• Access Control and Identity Management: Secure user registration, privileged access management, and authentication for cloud services.
• Segregation in Virtual Environments: Isolate customer data, workloads, and networks.
• Virtual Machine and Configuration Hardening: Securely configure virtual machines, containers, and cloud resources.
• Administrator Operational Security: Establish documented procedures for administrative operations, especially critical operations.
• Cryptography: Define encryption options and responsibilities for encryption key management.
• Logging and Monitoring: Establish event logging, clock synchronization, and monitoring capabilities available to customers.
• Backup: Define backup responsibilities and capabilities.
• Network Security: Align virtual network security with applicable network security policies.
• Change and Capacity Management: Control changes and maintain adequate capacity in cloud environments.
• Vulnerability Management: Manage and communicate technical vulnerabilities affecting cloud services.

Requirements for Cloud Service Providers vs. Cloud Service Customers

ISO 27017 provides guidance for both cloud service providers (CSPs) and cloud service customers (CSCs). Organizations must apply the requirements relevant to their cloud roles and responsibilities.

Organizations that act as both providers and customers, such as SaaS companies, should address the responsibilities relevant to both roles.

The Statement of Applicability: A Key Requirement

The Statement of Applicability (SoA) is one of the most important documents for ISO 27017 Certification. It records the controls selected to address information security risks and explains their applicability and implementation status.

• List the applicable ISO 27001 Annex A controls and relevant ISO 27017 cloud security controls.
• State whether each control is applicable.
• Justify why each control is included or excluded.
• Indicate the implementation status of applicable controls.

Auditors use the Statement of Applicability as a reference during the audit. It should accurately reflect the organization's cloud role, services, risk assessment, and selected controls.

Why Choose TopCertifier for ISO 27017 Certification?

TopCertifier supports organizations preparing for ISO 27017 Certification with cloud security gap analysis, risk assessment, shared responsibility mapping, documentation support, control implementation guidance, internal audits, and certification audit preparation.

Our approach is tailored to your cloud services, deployment models, business requirements, and existing ISO 27001 Information Security Management System. We help identify gaps, organize relevant documentation, and prepare your organization to demonstrate the implementation and effectiveness of applicable cloud security controls.

Whether your organization operates as a cloud service provider, a cloud service customer, or both, TopCertifier can help you build a structured approach to cloud security and prepare for the applicable certification audit requirements.