ISO 27017 Guide: Cloud Security Certification Explained

ISO 27017 Explained in Simple Terms

When a business moves its data and applications to the cloud, security becomes a team effort. The cloud provider looks after some parts, such as data centers, servers, and virtualization. The customer looks after other parts, such as user access, configurations, and the data itself. Problems arise when neither side is sure who is responsible for what.

ISO 27017 solves this problem. It is an international standard that gives cloud providers and cloud customers a common set of security controls and clearly explains each party's responsibilities. In simple terms, ISO 27017 is a rulebook for keeping information secure in the cloud, written for both sides of the cloud relationship.

This ISO 27017 guide walks you through everything you need to know, from the basics to certification.

What is ISO 27017?

ISO/IEC 27017 is developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). It provides guidance for implementing information security controls in cloud services. It builds on ISO/IEC 27002 by adding cloud-specific guidance and additional controls for both cloud service customers and cloud service providers.

The standard helps organizations address security risks that arise from the shared nature of cloud computing. ISO/IEC 27017 applies to all cloud deployment models, including public, private, and hybrid cloud environments.

Key Cloud Security Terms Explained

Understanding a few key terms makes ISO 27017 much easier to follow:

• Cloud Service Provider (CSP): An organization that offers cloud services, such as hosting, infrastructure, platforms, or software.
• Cloud Service Customer (CSC): An organization that uses cloud services.
• IaaS (Infrastructure as a Service): Cloud services providing computing, storage, and networking resources.
• PaaS (Platform as a Service): Cloud services providing platforms for building and running applications.
• SaaS (Software as a Service): Ready-to-use software delivered over the internet.
• Multi-Tenancy: Multiple customers sharing the same cloud infrastructure while their data stays separate.
• Virtualization: Technology that creates virtual servers and networks on shared physical hardware.
• Shared Responsibility: The division of security responsibilities between provider and customer.
• Statement of Applicability (SoA): A document listing which security controls an organization applies and why.
• ISMS: Information Security Management System, the framework defined by ISO 27001.

Where ISO 27017 Fits in the ISO 27000 Family

ISO 27017 is part of a family of related standards. The following table explains how these standards connect and contribute to information security and cloud protection.

ISO 27017 builds on ISO 27001 and ISO 27002 by adding the cloud security layer. On the privacy side, ISO/IEC 27018:2025 applies specifically to the protection of personally identifiable information in public cloud services when the cloud service provider acts as a PII processor.

What Changed in the 2026 Edition?

If you've read about ISO 27017 before, you may have seen references to the 2015 version and its seven "CLD" controls. The newer edition changes how cloud security topics are organized:

• Updated Edition: ISO/IEC 27017:2026 replaces ISO/IEC 27017:2015.
• Alignment with ISO/IEC 27002:2022: The newer edition is based on ISO/IEC 27002:2022, whereas the 2015 edition was built on the previous ISO/IEC 27002 structure.
• Reorganized Cloud Controls: Cloud security topics are reorganized around the ISO/IEC 27002:2022 structure rather than preserving the previous seven-control set.

The core ideas, such as shared responsibility, segregation, and secure administration, remain important. They are organized within the newer control structure, making integration with ISO 27001:2022 more straightforward.

How Shared Responsibility Works

Shared responsibility is at the heart of this ISO 27017 guide. The division of security responsibilities depends on the type of cloud service being used.

IaaS Example: Infrastructure as a Service

A company rents virtual servers from a cloud provider. The provider secures the data center, hardware, and virtualization layer. The company secures the operating systems, applications, user access, and data.

PaaS Example: Platform as a Service

A company builds applications on a cloud platform. The provider secures the infrastructure and platform. The company secures its application code, configurations, and data.

SaaS Example: Software as a Service

A company uses a cloud-based HR system. The provider secures the application and underlying infrastructure. The company manages who has access, how the system is configured, and what data is entered.

ISO 27017 helps ensure that these responsibilities are clearly defined, documented, agreed upon, and communicated so that important security tasks are not overlooked.

The Most Important ISO 27017 Control Areas

While the full standard contains detailed guidance, the following are important cloud security control areas for many organizations:

• Clear Responsibilities: Documenting who secures what between the provider and customer.
• Customer Isolation: Ensuring one customer cannot access another customer's data or resources.
• Secure Configurations: Hardening virtual machines and cloud settings.
• Controlled Administration: Managing privileged administrator actions carefully.
• Visibility for Customers: Giving customers the ability to monitor relevant aspects of their cloud services.
• Safe Exit: Returning or securely removing customer assets when a service ends.
• Network Consistency: Applying appropriate security standards to virtual and physical networks.
• Access and Encryption: Managing who can access cloud services and how data is encrypted.
• Incident Coordination: Agreeing how security incidents are reported, investigated, and handled.

For a deeper look at each control area, see our ISO 27017 Cloud Security: Controls, Benefits & Certification page.

How Cloud Security Certification Works

ISO 27017 is not a standalone management system standard. It supplements ISO/IEC 27001 certification. The process generally involves the following steps:

• Step 1: Establish an ISMS: Build or use an ISO 27001 Information Security Management System.
• Step 2: Define the Scope: Include relevant cloud services and ISO 27017 controls within the ISMS scope and Statement of Applicability.
• Step 3: Implement Controls: Apply the relevant cloud security controls across your cloud environments.
• Step 4: Verify Readiness: Conduct an internal audit and management review to assess implementation and identify corrective actions.
• Step 5: Complete the Certification Audit: A certification body audits the ISMS, including the applicable ISO 27017 controls, through Stage 1 and Stage 2 audits.
• Step 6: Achieve Certification: Following successful completion of the applicable certification process, the organization receives confirmation of conformity within the assessed scope.

Organizations that already hold ISO 27001 can extend their existing system to include cloud-specific controls. Organizations without ISO 27001 can implement the relevant requirements together. For the full step-by-step approach, see our main ISO 27017 Certification page.

Why Choose TopCertifier for ISO 27017 Certification?

TopCertifier is an ISO consulting and certification service provider that helps cloud providers and cloud customers prepare for ISO 27017 implementation and certification. Our experienced consultants provide end-to-end support, including cloud gap analysis, risk assessment, shared responsibility mapping, documentation, control implementation, internal audits, and certification audit preparation.

We explain ISO 27017 in practical terms, help organizations align cloud controls with the applicable edition of ISO/IEC 27017, and support integration with ISO 27001, ISO 27018, and ISO 27701 where appropriate. Our approach helps organizations strengthen cloud security, build client trust, and prepare for the certification audit with confidence.