ISO/IEC 27017:2015 Compliance – Cloud Security Controls Explained

What is ISO/IEC 27017:2015?

ISO/IEC 27017:2015 is the first edition of the international code of practice for information security controls in cloud services. Developed jointly by ISO/IEC and ITU-T, the standard is dual-numbered ISO/IEC 27017 and ITU-T X.1631 with identical content.

The 2015 edition gives guidelines for information security controls applicable to the provision and use of cloud services by providing additional implementation guidance for relevant controls specified in ISO/IEC 27002, and additional controls with implementation guidance that specifically relate to cloud services. It was built on ISO/IEC 27002:2013 and provided guidance for both cloud service providers and cloud service customers.

For many years, ISO/IEC 27017:2015 was the most widely recognized cloud security standard, adopted by cloud providers, SaaS companies, data centers, and organizations using cloud services around the world.

What Does ISO/IEC 27017:2015 Compliance Mean?

ISO/IEC 27017:2015 compliance means that an organization has implemented the standard's cloud-specific guidance and controls within its information security system. In practice, this involves:

• Applying cloud-specific guidance to relevant ISO/IEC 27002:2013 security controls
• Implementing the seven additional cloud controls defined in the standard
• Clearly defining and documenting shared security responsibilities between provider and customer
• Securing virtual environments, configurations, and administrative operations
• Providing customers with appropriate information and monitoring capabilities
• Managing the secure removal of customer assets at the end of a service
• Maintaining evidence that cloud controls are operating effectively

ISO 27017 supplements ISO 27001 and ISO 27002 by providing enhanced guidance for 37 existing controls and introducing seven entirely new cloud-specific controls. Since it is a code of practice rather than a management system standard, compliance is demonstrated by including its controls within the scope of an ISO 27001 ISMS and having them assessed during ISO 27001 certification audits.

Structure of ISO/IEC 27017:2015

Understanding the structure of the standard is key to ISO/IEC 27017:2015 compliance:

Clauses 1 to 4: Scope, References, Terms, and Overview
Define the scope of the standard, normative references, cloud computing terminology, and how the document is structured, including the roles of cloud service providers and customers.

Clauses 5 to 18: Cloud Guidance for ISO/IEC 27002:2013 Controls
These clauses follow the structure of ISO/IEC 27002:2013, covering information security policies, organization of information security, human resource security, asset management, access control, cryptography, physical and environmental security, operations security, communications security, system acquisition and development, supplier relationships, incident management, business continuity, and compliance. For relevant controls, separate implementation guidance is given for cloud service customers and cloud service providers.

Annex A: Cloud Service Extended Control Set
Contains the additional cloud-specific controls and their implementation guidance.

Annex B: References on Cloud Computing Risks
Provides references to sources of information on information security risks related to cloud computing.

The Seven Cloud-Specific Controls in ISO/IEC 27017:2015

The most distinctive part of ISO/IEC 27017:2015 compliance is its seven additional cloud controls, identified with the "CLD" prefix:

CLD.6.3.1 – Shared Roles and Responsibilities Within a Cloud Computing Environment
Responsibilities for information security between the cloud service provider and the cloud service customer must be clearly defined, documented, allocated, and communicated.

CLD.8.1.5 – Removal of Cloud Service Customer Assets
Customer assets held on the provider's premises must be returned or removed in a timely manner when the cloud service agreement ends.

CLD.9.5.1 – Segregation in Virtual Computing Environments
Each customer's virtual environment must be protected from other customers and unauthorized persons, ensuring proper isolation in multi-tenant environments.

CLD.9.5.2 – Virtual Machine Hardening
Virtual machines must be configured securely, with only necessary ports, protocols, and services enabled, and appropriate protections such as malware controls and logging in place.

CLD.12.1.5 – Administrator's Operational Security
Procedures for administrative operations in the cloud environment, especially critical operations that could cause irreversible damage, must be defined and documented.

CLD.12.4.5 – Monitoring of Cloud Services
Cloud service customers must have the capability to monitor specified aspects of the cloud services they use.

CLD.13.1.4 – Alignment of Security Management for Virtual and Physical Networks
Security policies for virtual networks must be consistent with those for physical networks when configuring virtual network environments.

Key Cloud Guidance Areas in ISO/IEC 27017:2015

Beyond the seven new controls, ISO/IEC 27017:2015 compliance requires applying cloud guidance to existing security controls, including:

• Information Security Policies: Policies addressing cloud-specific risks and responsibilities
• Supplier Relationships: Treating cloud providers as suppliers and agreeing on security responsibilities in service agreements
• Access Control: User registration, privileged access management, and secure authentication for cloud services
• Cryptography: Information on encryption options and key management responsibilities
• Operations Security: Capacity management, backup, logging, and change management in cloud environments
• Incident Management: Defining how incidents are reported and coordinated between provider and customer
• Compliance: Identifying legal requirements, including data location and jurisdiction considerations

Shared Responsibility in ISO/IEC 27017:2015 Compliance

Shared responsibility is the foundation of ISO/IEC 27017:2015 compliance. The division of responsibilities depends on the type of cloud service:

• IaaS: The provider secures physical infrastructure and virtualization, while the customer secures operating systems, applications, and data.
• PaaS: The provider also manages the platform, while the customer secures applications and data.
• SaaS: The provider manages most of the service stack, while the customer manages user access, configuration, and data usage.

Organizations must document these responsibilities in service agreements and communicate them clearly to avoid security gaps.

ISO/IEC 27017:2015 vs ISO/IEC 27017:2026

ISO/IEC 27017 provides guidance on information security controls for cloud services. The comparison below highlights the differences between the 2015 edition and the stated 2026 edition in terms of structure, reference standards, cloud-specific controls, and terminology.

Note: Verify the publication status, official title, and technical changes of the 2026 edition against the official ISO catalogue before publishing this comparison.

The ISO lifecycle record shows ISO/IEC 27017:2015 as withdrawn and Edition 2 as published. The 2026 edition reorganizes those topics around the ISO/IEC 27002:2022 structure rather than preserving the old seven-control set.

Transitioning from ISO/IEC 27017:2015 to 2026

Organizations that currently comply with ISO/IEC 27017:2015 should plan their move to the 2026 edition. Since most organizations have already moved their ISMS to ISO/IEC 27001:2022, aligning ISO 27017 with the same control structure makes the overall system more consistent and easier to audit. A typical transition involves:

• Reviewing the changes in ISO/IEC 27017:2026
• Mapping the seven CLD controls and existing cloud guidance to the new structure
• Performing a transition gap assessment
• Updating the Statement of Applicability to reflect the new control references
• Revising cloud security policies, procedures, and service agreements
• Confirming that controls meet the updated guidance
• Conducting an internal audit and management review on the updated system
• Including the 2026 edition in your next certification audit

Organizations starting fresh should implement ISO/IEC 27017:2026 directly rather than the 2015 version.

Why Choose TopCertifier for ISO/IEC 27017 Compliance?

TopCertifier is a leading ISO consulting and certification service provider that helps organizations maintain ISO/IEC 27017:2015 compliance and transition smoothly to ISO/IEC 27017:2026. Our experienced consultants provide end-to-end support, including compliance gap assessments, control mapping, shared responsibility review, Statement of Applicability updates, documentation, internal audits, and certification audit preparation.

Whether you're maintaining your current 2015 controls or moving to the latest edition, TopCertifier delivers practical solutions tailored to your cloud services and deployment models. We also help integrate ISO 27017 with ISO 27001, ISO 27018, and ISO 27701 for complete cloud security and privacy assurance, helping you build client trust and stay certified with confidence.